Privacy Policy

Information we collect

• Account information. Your name and email address when you sign up. If you sign in with Google, we also receive a Google account ID and profile image. If you signed up through another user’s referral link, we also store which account referred you. If you buy a pass with Apple Pay or Google Pay without signing in, we use the email address your wallet shares to create your account (or add the pass to the account that already uses that address) and email you a sign-in link.
• Authentication data. Hashed passwords (we never store your password in plain text), session tokens, email verification tokens, and the one-time sign-in codes we email you, which we store only in hashed form. In our mobile app, your sign-in tokens are kept in your device’s secure storage.
• Study progress. Which chapters you have read, flashcards marked as known or needs-review, quiz and practice-test scores, and timestamps of your activity.
• Payment information. We do not receive or store your credit card details. Payments on our website are processed by Stripe; we store a record of the purchase, such as the Stripe session reference, the pass you purchased, the purchase and expiry dates, and the price. Purchases in our mobile app are processed by Apple or Google; we receive and store a record of the purchase, such as a transaction reference, the pass you purchased, the purchase date, and the price.
• Usage data. Basic analytics events (page views, feature usage) collected via Google Analytics 4 to help us understand how the Service is used. In our mobile app we may use Google Analytics for Firebase, which also collects device information (which can include device identifiers), app-version information, and an internal account identifier, never your name or email address.
• Data stored on your device. Our mobile app keeps study content and your progress on your device so you can study offline. Signing out of the app removes it.
• Email reminders. If you ask us to email you a study plan after a free practice test, we store the email address you provide, the test date you optionally share, and the per-chapter breakdown of that attempt — so we can send your plan and, if you gave a date, reminders as your test approaches. If you ask for reminders about your citizenship eligibility date, we store your email address, that date, and a record of when you asked and confirmed. We delete it within a few weeks if you don’t confirm it or you stop the reminders, and otherwise about a year after that date. You can unsubscribe from these emails at any time using the link in every message.
• Ratings and feedback. If you respond to a request for a rating, we store the rating, any comments you write or choose, the province or territory you optionally select, and — where we asked — whether you passed the official citizenship test, did not pass it, or are still waiting for your result. We also store the wording of the notice shown to you at the time, and the choice you made about being shown.

How we use your information

• To create and manage your account and keep you signed in.
• To track and display your study progress across devices.
• To process payments and grant access to the features included in your pass.
• To send transactional emails: email verification, password resets, welcome messages, purchase confirmations, pass expiry reminders, and — if you set a test date — reminders as your test day approaches.
• If you ask for them, to send reminders about your citizenship eligibility date.
• To occasionally contact you about our paid passes — including a personal note that may reference your own practice activity on the site. You can opt out at any time by replying or emailing support@canadatest.ca.
• If you leave a rating or comments, we may show them on our site or in our marketing, credited with only your first name and province or territory. This is on by default. You can opt out of display when you submit, or at any time afterwards by emailing support@canadatest.ca; we will stop using it and remove it from our site. Whether you have taken the official test is shown only if you choose a comment that says so. We may shorten what you wrote, but we never reword it. If you tell us a test did not go well, what you write then stays private — we never show it.
• We may include ratings in anonymous average scores, always shown with the number of ratings behind them. A rating may still count in an average score, without your name, after you opt out of display when you submit.
• We may describe one person’s results — for example, a change in their practice-test scores and how many tests they took — without their name, province, dates, or anything else we think could identify them. We do this only where that person wrote or chose the words we quote, and we stop if they ask us to.
• We ask for your province or territory only if we have a first name to credit you with, and only on the optional step where you can add comments. If you choose Quebec there, none of this is on by default: we show your rating or your words only if you tick the box beside it, and we do not use your response in the one-person descriptions above. Your rating may still count in an anonymous average score.
• To improve the Service by analyzing aggregate usage patterns.
• To detect, investigate, and prevent abuse, fraud, and security issues.

We do not sell your personal information, and we never give advertising platforms your name or email address. Cookies used to measure and attribute advertising are described below.

Third-party services

We use a small number of trusted third parties to operate the Service. Each has its own privacy policy governing how they handle data. Our service providers process data in the United States and other jurisdictions outside Canada.

• Neon — PostgreSQL database hosting. Stores your account, study progress, and pass records.
• Stripe — payment processing, including Apple Pay and Google Pay payments on our website. Receives your email and payment details directly; we never see your card number.
• Apple and Google — payment processing for purchases in our mobile app, through the App Store and Google Play.
• RevenueCat — validates in-app purchases and reports them to our servers. Receives an internal account identifier, your purchase records, and basic device and connection information, not your name or email address.
• Expo — delivers updates to our mobile app. As part of that, Expo processes connection data such as your IP address and an app-installation identifier.
• Resend — transactional email delivery.
• Google — optional sign-in via Google OAuth, plus Google Analytics 4 (and, in our mobile app, Google Analytics for Firebase) for usage data.
• Microsoft Clarity — session recordings and heatmaps. When active, it records individual browsing sessions on the Service, including your clicks, scrolling, and the pages you visit, so that we can play those sessions back. Microsoft receives that data, including the URLs you visit and pseudonymized identifiers; we do not intentionally send your name or email address to Microsoft.
• Meta Pixel (Facebook) — we may use Meta Pixel to measure the performance of advertising campaigns and create retargeting audiences. When it is active, Meta receives event data including the URL of the page you visit, the names of conversion events (page view, sign-up, purchase), and pseudonymized identifiers that Meta uses to attribute ad performance. We do not transmit your name, email address, phone number, or other directly identifying information to Meta.
• Cloudflare — web hosting, serverless function execution, and content delivery. As the network your requests pass through, Cloudflare processes connection data such as your IP address and browser user-agent.

Cookies and tracking

We use strictly necessary cookies set by NextAuth to keep you signed in, and analytics cookies set by Google Analytics 4, Microsoft Clarity, and (when active) Meta Pixel to measure aggregate usage, to attribute ad performance, and — when Meta Pixel is active — to build retargeting audiences. If you open a referral link, we set a cookie for 30 days so we can credit the person who referred you when you create an account. Pages where you can buy a pass may load Stripe’s payment script, which can set cookies and collect device information to prevent fraud. You can disable cookies in your browser settings, but you will not be able to sign in without them.

Data retention

We retain your account and study progress for as long as your account is active. Pass purchase records are retained for billing and tax history even after a pass expires. If we published your rating or comments, we keep a record of what we published, the notice you were shown, and the figures behind it. If you request account deletion, we will remove your personal information within 30 days, except where we are required to keep records (for example, payment history) by law, or need them to show what we approved or published and on what basis. You can delete your account yourself in our mobile app, or ask us to delete it; see Delete your account.

Your rights

You can request access to, correction of, or deletion of your personal information by emailing us at support@canadatest.ca. Depending on where you live you may also have the right to object to certain processing or to file a complaint with your local data protection authority. Canadian privacy laws apply to how we handle your personal information, including British Columbia’s Personal Information Protection Act and the federal Personal Information Protection and Electronic Documents Act (PIPEDA). You can also withdraw your consent at any time by emailing us, subject to what we must keep (see Data retention).

Security

We take reasonable technical and organizational measures to protect your data, including bcrypt password hashing, rate limiting on authentication endpoints, and encrypted connections to all third parties. No online service can be 100% secure, so we encourage you to use a strong unique password.

Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will update the Effective date at the top of this page. Your continued use of the Service after a change means you accept the updated policy.

Contact

canadatest.ca is operated by Matroid Technologies, a sole proprietorship registered in British Columbia, Canada. The person in charge of protecting personal information is the owner of Matroid Technologies, reachable at support@canadatest.ca.

Within Matroid Technologies, only the owner can access account data; the service providers listed above process it on our behalf. We keep information as described under Data retention and delete it when it is no longer needed. Send privacy questions or complaints to support@canadatest.ca; we reply in writing within 30 days.

See also our Terms of Service.