Privacy Policy

Last updated: February 22, 2026
Effective date: February 22, 2026

This Privacy Policy describes how CFA Quest ("we," "us," or "our") collects, uses, and shares information about you when you use our mobile application and website (collectively, the "Service").

1. Information We Collect

Account Information

When you create an account, we collect your email address and password (stored as a secure hash). This information is processed by Supabase, our authentication provider. We do not store plain-text passwords.

Study Progress Data

We store your study activity to sync your progress across devices, including:

XP points, level, and streak data
Card review history and spaced repetition schedules
Chapter and lesson completion status
Achievement records

Usage Analytics (Future)

We plan to introduce analytics to improve the app experience. When enabled, we may collect anonymized usage patterns such as which features are used most frequently, session duration, and screen navigation. We will update this policy before enabling analytics and provide an opt-out mechanism.

2. How We Use Your Information

To authenticate you and secure your account
To sync your study progress across devices
To calculate achievements, streaks, and XP progression
To improve app features and fix bugs (anonymized usage data, when enabled)

3. Third-Party Services

We use the following third-party service providers:

Supabase (authentication and database): Your email address and study progress are stored in Supabase's infrastructure. See Supabase's Privacy Policy.
Google Cloud (AI and text-to-speech): Lesson explanations and text-to-speech audio are processed through Google APIs. No personally identifiable information is sent to these services.

4. Advertising (Future)

We may introduce advertising in a future version of the app. Before doing so, we will update this Privacy Policy and, where required by law, obtain your consent. Any advertising partners will be listed here.

5. Data Retention

We retain your account and study data for as long as your account is active. You may request deletion of your account and associated data at any time by contacting us.

6. Your Rights

Depending on your location, you may have the following rights regarding your personal data:

GDPR (EU/UK): Right of access, rectification, erasure, restriction, portability, and objection.
CCPA (California): Right to know, delete, and opt-out of sale of personal information. We do not sell personal information.
Other jurisdictions: We respect applicable local privacy laws.

To exercise your rights, contact us at the address below.

7. Children's Privacy

The Service is not directed to children under 13 years of age. We do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, please contact us for prompt removal.

8. Security

We use industry-standard security measures including encrypted connections (HTTPS/TLS), hashed passwords, JWT authentication, and row-level security policies in our database. However, no method of transmission over the internet is 100% secure.

9. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by updating the "Last updated" date at the top of this page.

10. Contact Us

If you have questions about this Privacy Policy or wish to exercise your data rights:

Email: privacy@cfaquest.com