Privacy Policy
At ExamBased (“we”, “us”, or “our”), we are committed to protecting the privacy and personal data of real estate license candidates. This Privacy Policy explains in clear, direct terms what information we collect when you use our platform, how authentication (Email and Google Sign-In) functions, our exact use of cookies and local storage, our upcoming in-app purchases (IAP), and how you can exercise full control over your data.
Flexible Access & Sign-In
Practice as a guest or sign in seamlessly using Email & Password or your Google account to sync your scores and study history across devices.
Transparent Local Storage & Cookies
No covert ad-tracking networks. We explicitly itemize every cookie and local storage key used to keep you logged in and save your test progress.
No Data Broker Sales
We never sell, rent, or trade your personal email, study answers, or test results to third-party marketing brokers, recruiter spam lists, or advertisers.
1. Information We Collect & Authentication (Email and Google Sign-In)
ExamBased provides both guest access and optional account creation. When you create an account, we collect only the necessary credentials required to authenticate you and sync your study journey:
When registering with your email address, we collect your email, an optional display name, and a securely hashed password. Passwords are salted, encrypted, and managed through Google Firebase Authentication; we never possess or view your plaintext password.
When choosing “Continue with Google”, authentication is handled directly via Google's secure OAuth 2.0 protocol. Google provides us with your verified email address, Google account user ID (UID), display name, and profile picture URL. We do not receive, solicit, or store your Google account password or access to your personal inbox.
When signed in, your exam simulation attempts (state track, score percentage, passing status, completion timestamp, and question breakdown) are synchronized to our secure cloud database (Firebase Firestore) so you can review past performance on any device.
Note on Guest Users: If you use ExamBased without logging in, your practice scores and state selections remain strictly on your local browser device.
2. Platform Model & Upcoming In-App Purchases (IAP)
ExamBased operates on a freemium model. Core practice questions, flashcards, and candidate resources are available for practice. We are actively integrating In-App Purchases (IAP) and optional premium subscription tiers to unlock advanced simulator features, comprehensive state law question banks, and unlimited AI Tutor explanations.
All financial transactions and in-app purchases are conducted through certified, PCI-DSS compliant payment gateways and official app store billing systems (such as Apple App Store, Google Play In-App Billing, or Stripe). ExamBased does not collect, receive, or store your credit card numbers, CVVs, or bank account credentials on our servers. The payment processor provides us solely with a secure transaction confirmation token, purchase timestamp, and entitlement status to grant your account access to paid features.
3. Exact Cookies & Client-Side Storage We Use
We believe in complete technical transparency. Below is an exhaustive breakdown of the cookies, tokens, and browser localStorage keys used by ExamBased:
| Identifier / Key | Storage Type | Function & Data Held | Duration |
|---|---|---|---|
| Firebase Auth Session Tokens | Essential Cookie / Token | Authenticates your logged-in state (Email or Google account), verifies session validity, and secures API requests against CSRF attacks. | Session / Until Sign-Out |
| prepfast_theme | Local Storage | Stores your visual display preference ('dark' or 'light' mode) so the interface does not flicker on reload. | Persistent |
| prepfast_last_state | Local Storage | Saves your selected US state or Canadian jurisdiction (e.g., Texas, California, Florida) to reload your relevant test track. | Persistent |
| prepfast_active_exam | Local Storage | Maintains your active mock exam state (current question number, answered selections, flagged items) to prevent data loss if your connection drops. | Cleared on exam submit |
| prepfast_exam_history | Local Storage | Temporarily caches recent mock exam scores locally for offline access and guest users before/while syncing to Firestore. | Persistent |
| prepfast_completed_topics_* | Local Storage | Records checklist progress across syllabus topics and state-specific subcategories. | Persistent |
| prepfast_gemini_api_key | Local Storage | Optional: If a candidate chooses to provide their own personal API key for AI tutoring, it is stored strictly in your local browser and never sent to our servers. | Persistent until cleared |
4. AI Legal Tutor & Query Processing
When you invoke the ExamBased AI Legal Tutor to receive explanations on statutory regulations (e.g., Texas TREC rules, California Civil Code, or Florida FREC statutes) or distractor traps, only the text of the practice question and your study prompt are transmitted to our secure inference API.
We do not attach your personal identity or contact records to AI prompts. Study prompts are strictly utilized to generate immediate educational responses and are never used to compile commercial advertising profiles.
5. Hosting, Security & Infrastructure
All transmissions between your web browser and ExamBased are encrypted using modern Transport Layer Security (TLS 1.3 / HTTPS). Cloud database records are hosted on enterprise-grade Google Cloud Platform / Firebase infrastructure with encrypted data storage at rest and strict role-based access rules.
Standard technical server logs (such as IP address, browser user-agent header, and request timestamps) are retained temporarily by our edge CDN for DDoS mitigation, bot defense, and uptime reliability before being automatically scrubbed.
6. Your Rights & Permanent Account Deletion
Regardless of where you reside, we honor core data privacy rights aligned with the California Consumer Privacy Act (CCPA/CPRA), the General Data Protection Regulation (GDPR), and the Canadian Personal Information Protection and Electronic Documents Act (PIPEDA):
- Right to Access & Portability: You can request a summary of the account details and exam history associated with your user ID.
- Right to Erasure (Right to Be Forgotten): You have the absolute right to have your account, profile records, and cloud-synced exam scores permanently deleted from our servers.
- Right to Non-Discrimination: We do not discriminate against candidates who exercise their statutory privacy rights.
To request total deletion of your account and cloud records, email us from your registered account address at support.millionbitsofficial@gmail.com. We process deletion requests within 30 days without undue delay.
7. Contact Information & Official Support
If you have questions regarding this Privacy Policy, your account data, cookie handling, or upcoming in-app purchase terms, please reach out to our team directly: