The short version

We collect the minimum needed to run a paid course: an email address for your account, whether you have paid, and aggregate visit statistics. We do not run advertising, we do not use tracking pixels, and we do not sell your data to anyone.

What we store, and why

• Your email address. So you can sign in, and so we can send you a password reset if you ask for one.
• Your display name, if you choose to enter one. Optional, and only used to greet you.
• Whether you have paid, and when your access ends. This is what decides which labs, quizzes and notebooks you can open.
• Your account id. An internal identifier generated when you sign up; it is what links your subscription to you.
• A payment reference (a Stripe session or subscription id) so that a payment can be traced back to the right account if something goes wrong.
• Your agreement to the terms and refund policy. When you buy, we record that you accepted them, with a timestamp and the version you accepted.
• Your study progress. Which practice questions and bonus questions you have answered, whether each answer was right, which option you picked, when you last worked in each module, and where you stopped. This is held against your account so you can sign in on another device and carry on from the same place. You can erase it at any time with Reset all progress on the quiz pages, which clears both your browser and our copy.

We do not collect your name, address, phone number, or anything else. We never see or store your card number — that goes directly to Stripe.

What stays in your browser

Clearing your browser data clears these. The keys are:

• gcp-quiz-progress, gcp-quiz-state, gcp-bonus-quiz-state — which questions you have answered and whether you got them right. When you are signed in these are a working copy of the progress stored with your account, and they are cleared when you sign out.
• gcp-progress:* — bookkeeping for the progress sync: your account id, the last sync time of each answer, and the position to resume from.
• gcp-bank:<uid>:<core|bonus> — a cached copy of the question bank, so your quiz does not re-download it every time.
• gcp-prep-authed — a hint that you are signed in, so the page does not flash its signed-out state.
• gcp-resume — the page to return you to after signing in. Cleared as soon as it is used.

Google Analytics also sets two cookies of its own, which is how visits are counted:

• _ga — a random identifier, so a returning visitor can be told apart from a new one.
• _ga_<container-id> — keeps the current visit's state, so it is not counted twice.

They are used only to count visits and see which guides, labs and quizzes are actually used. They are not used for advertising and are not shared with advertisers. Your browser's cookie settings, or an ad-blocking extension (which blocks these requests too), turn them off — the site works normally without them.

Who else touches your data

• Google Firebase (Authentication, Cloud Firestore, Hosting) — stores your account and subscription and serves this site. Firebase is operated by Google.
• Google Analytics (part of Firebase) — counts visits, page views and how long pages are open. It sees your IP address and a random cookie identifier, not your email address. Operated by Google.
• Stripe — processes payments and holds your payment details as the merchant of record for the transaction.
• Google Fonts — the typefaces are loaded from Google's font service, which means Google sees your IP address when a page loads.

These providers process data on our behalf, or (in Stripe's case) as an independent controller for payments. We do not sell or share your data with anyone else, except where the law requires it.

How long we keep it

For as long as your account exists. If you ask us to delete your account, we delete your email, display name and account record. We may keep the record of a payment for as long as tax and accounting rules require.

Your choices

• Ask for a copy of what we hold about you, or ask us to correct it.
• Ask us to delete your account and the data in it.
• Sign out at any time. Signing out clears the copy of your progress held in that browser; the copy stored with your account stays, so it is waiting when you sign back in.

Email support@norstudy.com for any of these. Depending on where you live, you may also have the right to complain to your local data protection authority.

Where the law comes from

NorStudy is operated from Ontario, Canada, and Canadian privacy law (PIPEDA) applies to how we handle your information. Depending on where you live, your own privacy laws may also apply — for example, residents of the European Economic Area or the United Kingdom have rights under the GDPR or UK GDPR, including access, correction, deletion and portability. Email support@norstudy.com and we will honour the rights that apply to you.

Security

Traffic to this site is encrypted. Access to paid content is enforced on the server, by database security rules that nobody can bypass from the browser. Nobody at NorStudy has a reason to ask you for your password, and we never will.