Privacy

Updated November 12, 2026

This page explains what TransitPrep collects, why, and what you can do about it. Questions go to [email protected].

What we collect

• Your account: your email address, optional display name, study city, planned test date, daily question goal, time zone and practice focus; your password stored only as a one-way scrambled form (a hash) we can’t read back, when you signed in, and a random code in a cookie that keeps you signed in. To stop password guessing, we note failed sign-ins with the email tried and the network address for one day.
• Your purchases: which city pack you bought, when, the amount, and Stripe’s references for the payment. Stripe handles your card details; we never see them.
• Your practice: the questions and answers you select, saved quiz drafts, quiz and mock test scores, and completed question reviews, so you can resume, review results and track progress.
• City list: if you ask us to email you when a city opens, we store your email address, the city, the page you signed up on, the time, and the wording of the consent you gave.

Your browser may also keep quiz choices that have not synced yet, associated with your account and test, to recover from a connection failure. The app removes this recovery copy when the result is saved.

Cookies

Account cookies keep you signed in and let the site show “Your practice”. We also save your optional analytics choice in your browser for up to 180 days. Cloudflare Web Analytics provides cookie-free visit counts. Google Analytics 4 is loaded on public pages only if you choose “Allow analytics”; it uses cookies lasting up to 180 days. We disable Google advertising features and automatic enhanced measurement. We send the public page address without query strings or fragments, a referring site’s origin, and coarse practice-completion or pack-interest events. We do not send form entries, quiz answers, scores, email addresses or account identifiers to Google, and our tag is absent from sign-in, checkout and email-token pages. Use “Analytics preferences” in the footer to change your choice. A browser Global Privacy Control or Do Not Track signal disables optional analytics. Google processes this visit information; see Google’s privacy policy.

Why

To give you the practice you bought, to email you sign-in codes, password links and purchase details, to answer your questions, and, if you asked, to tell you when your city opens. We do not sell your information. The service providers described here process information for these purposes, and we do not send marketing email you did not ask for.

Who handles it for us

Stripe processes payments (see Stripe’s privacy policy). Amazon Web Services hosts our servers and database in Canada, Cloudflare delivers and protects our website, and Resend delivers our email. Their servers may be outside Canada, so your information may be processed in other countries, such as the United States.

How long we keep it

We keep your account and practice history while you have an account. We keep purchase records for as long as tax and accounting rules require, even after an account is closed. City-list addresses are deleted when you unsubscribe.

Your choices

To see, correct or delete your information, email [email protected] from the address on your account. Every city-list email has an unsubscribe link, and unsubscribing deletes your address from the list.