Privacy policy

It covers crcstacademy.com and the study tools on it — the practice test, practice, mock exams, the review queue, and your account. It does not cover the HSPA website, Prometric test centres, or any other site you reach from a link here.

• Your email address. Sign in with Google or a one-time email link. We store your email address and the date the account was created. If you choose Google, Supabase also receives your Google account identifier and basic profile information, such as your name and profile picture, to authenticate you. We do not receive your Google password.
• Your study activity. For each attempt we store which questions it contained, the answer you chose, whether it was correct, the times you started and finished, your score, and the score for each exam domain. This history is what the readiness dashboard and the review queue are built from.
• Your purchase. Payment is handled by Stripe on Stripe’s own pages. We store the Stripe identifiers for your checkout and payment, the product, the amount, the status, and the date. If a checkout ends without a payment, we record that it expired or that the payment failed, with the general kind of decline (for example, not enough funds). Card numbers never reach our servers, and we do not store any card details.
• Guarantee claims. A claim stores the email address you give, your exam date, when you finished the qualifying mock exam, the file names of the two documents, the claim status, and any feedback you choose to send. The documents themselves are delivered to a private review inbox as email attachments. They are not stored in our database.
• Messages you send us. The contact form stores the account id when you are signed in, the reply email, topic, message, whether you checked spam and junk, the browser user agent, status, and submission time. We keep messages while they are needed to answer you and retain the support record.
• Abuse prevention. The refund and public contact forms are rate limited. To do that we store a one-way hash of the relevant email, account, or network address with a counter. Raw network addresses are not stored in those rate-limit records.

To run the product and nothing more: to sign you in, to serve questions and score them, to show which domains need work, to give you access to what you paid for, to check a guarantee claim against its conditions, to answer your messages, and to keep the site from being abused.

We record which guided lessons and glossary terms a browser starts and finishes, and the time of that activity, so we can see which lessons help and which free lessons lead to a sign-up. We also record where a browser entered the site: the first page it opened, the name of the site that linked to it (for example google.com, never the full address), the campaign tags in that link (utm_source, utm_medium and utm_campaign), and whether the visit came from one of our Google ads. We keep the first entry for each browser identifier, so we can see which pages and channels lead to a sign-up. A pseudonymous browser identifier (a cookie named crcst_learning_visitor, kept for 30 days) may be linked to your account when you sign in. These records do not include your answers, personal scores, or email address. This collection is on unless you decline it at the top of this page, and we honor the Do Not Track and Global Privacy Control browser signals. Glossary study progress also stays in your browser so you can revisit it.

Signing in sets a session cookie. It keeps you signed in and the site cannot work without it.

Free guided lessons save your steps in this browser so you can return later. When you sign up or sign in in the same browser, we transfer that progress to your account and remove the confirmed browser copy. Clearing your browser’s site data removes progress that has not yet been transferred.

We use Vercel Analytics for aggregate page counts — how many people reached a page, not who they are. It does not set advertising cookies and does not follow you to other sites.

We advertise on Google. If you arrive from one of our Google ads, the Google tag on this site sets a cookie so Google can tell us that the ad led to a sign-up or a purchase. When you sign up or buy, the tag may also send Google a hashed, unreadable form of your email address to make the same match. Google’s privacy policy covers what Google does with that data. You can turn off personalized ads at adssettings.google.com.

We use Google Analytics 4, loaded through Google Tag Manager, to understand which pages people visit, how they reach the site, and which visits lead to a purchase. Analytics uses cookies to recognize a browser across visits. Purchase events include an order identifier, the product, amount, and currency. We do not include your email address, answers, or study scores in these Analytics events. You can learn about Google’s use of this information at Google’s partner sites policy and use the Google Analytics opt-out browser add-on.

After email confirmation, a cookie named crcst_signup carries a one-way hash of the account's random ID for up to ten minutes. Google uses that stable transaction ID to discard repeat reports, and the browser removes the cookie after reporting the conversion. It does not contain the account ID or email.

There are no ads on this site. We do not sell your data, and we do not share it with data brokers.

• Supabase. Accounts, authentication, sign-in links, and the database.
• Stripe. Payments and refunds.
• Vercel. Hosting and the aggregate analytics above.
• Google. Optional Google sign-in, website analytics through Google Analytics and Tag Manager, and conversion measurement for our Google Ads campaigns, as described above.
• Resend. Delivery of guarantee claims and contact notifications to our review inbox.

These providers process data on our behalf, under their own terms, and may process it in the United States.

Your account, study history, and purchase records stay while your account exists. Ask us to delete the account and the profile and study history go with it. Purchase records are kept for as long as accounting and tax rules require, and a guarantee claim is kept as the record of that decision.

Documents attached to a guarantee claim are never written to our database. They stay in the review inbox with the claim email.

Contact messages stay while they are needed to answer you and to keep a support record. Account deletion removes the account link, but the message and reply address may remain in that record.

Sign in and use the contact form to ask for a copy of what we hold, a correction, or a deletion. Deleting your account ends your access, including any remaining paid access, and cannot be undone.

Sign-in uses one-time email links, so there is no password to steal. The connection to the database is encrypted. Study data is written only by our server — a browser cannot write scores, answers, or purchases directly.

CRCST Academy is built for people working in or training for sterile processing. It is not directed at children, and we do not knowingly collect data from a child under 13.

When the product changes, this page changes with it. The date at the top of the page shows the last change.

Send questions about this policy through the contact page. See also our terms of service.