Privacy Policy
This Privacy Policy explains how EonDigi Inc., a United States corporation (“Operator”, “we”, “us”, or “our”) collects, uses, and shares information when you use CFA Drill (https://cfa-drill.com). It is intended to help you understand our practices under frameworks such as CCPA/CPRA (California), GDPR (EEA/UK where applicable), and other applicable privacy laws.
1. Who we are
The controller / operator of CFA Drill is EonDigi Inc..
Privacy and data-protection requests: support@cfa-drill.com.
For product or account issues unrelated to privacy rights, use support@cfa-drill.com.
2. Information we collect
Account data: email address, display name (optional), authentication provider identifiers (e.g., Google), and email verification status via Firebase Authentication.
Usage and progress data: question statuses (unseen / learning / mastered / blindspot), correct and incorrect attempt counts, subject filters, and related timestamps stored in Firestore under your user id.
Technical data: IP address, device/browser type, and logs as processed by hosting and security infrastructure (Firebase / Google Cloud).
Payment data: processed by Stripe. We do not store full card numbers on our servers. We may store plan status, Stripe customer/subscription ids, and purchase metadata needed to provision Pro.
Advertising and device data (free tier): when ads are enabled, Google AdSense and related Google advertising technologies may place or read cookies, use web beacons, collect IP addresses or similar identifiers, and use other technologies to serve and measure ads. Third parties (including Google) may be placing and reading cookies on your browser, or using web beacons or IP addresses to collect information as a result of ad serving on this site.
3. How we use information
To provide and secure the Service (auth, sync progress, unlock Pro).
To communicate about account verification, security, and material product changes.
To show ads on the free tier (beside drill content only) and measure basic ad performance.
To enforce Terms, prevent abuse, and comply with law.
4. Advertising, cookies, and Google
Ads appear only for free-tier users beside interactive drill content—not on these static legal or study articles, and not on empty login-only screens.
On first visit outside EEA/UK/Switzerland we show a consent choice: accept personalized ads, or continue with non-personalized ads only. Your choice is stored locally in your browser (localStorage) so we can apply Google Consent Mode and AdSense non-personalized settings. You can clear site data in your browser to see the choice again.
For visitors in the European Economic Area, the United Kingdom, and Switzerland, we rely on Google AdSense Privacy & messaging (Funding Choices / European regulations messages) when published for this site—those prompts list ad technology providers and collect consent under Google’s EU User Consent Policy. Enable and publish that message in your AdSense account (Privacy & messaging) for cfa-drill.com.
Google’s use of data when you use sites or apps that partner with Google is described here: https://policies.google.com/technologies/partner-sites. We also link to that page from our site footer.
Pro subscribers do not see AdSense units in the study UI while Pro is active.
5. Legal bases (GDPR where applicable)
Contract performance (providing the account and purchased features).
Legitimate interests (security, product improvement, fraud prevention) balanced against your rights.
Consent for non-essential advertising cookies and personalized advertising where required (EEA/UK and similar regimes).
Legal obligation when we must retain or disclose information.
6. Sharing
We share data with processors who help run the Service: Google Firebase / Google Cloud, Google AdSense (free tier), and Stripe (payments). They process data under their own terms and privacy policies.
We may disclose information if required by law, to protect rights and safety, or in connection with a corporate transaction (merger, acquisition) subject to appropriate safeguards.
We do not sell personal information for money. Advertising partners may process data for personalized ads only where permitted and where you have consented (or where non-personalized ads are shown instead).
7. International transfers
Data may be processed in Canada, the United States, and other locations where our providers operate. Where required, we rely on appropriate transfer mechanisms offered by those providers.
8. Retention
We retain account and progress data while your account is active. You may request deletion; we will delete or anonymize data except where retention is required for legal, security, or accounting purposes (e.g., payment records). Browser-stored consent choices remain until you clear them.
9. Your rights
Depending on your location, you may have rights to access, correct, delete, port, or restrict processing of personal data, and to object to certain processing or withdraw consent.
To exercise rights, email support@cfa-drill.com with subject line “Privacy request — CFA Drill”. You may also lodge a complaint with a supervisory authority where applicable.
California residents may have additional rights under CCPA/CPRA, including knowing categories of data collected and requesting deletion. We do not discriminate for exercising privacy rights.
10. Children
The Service is not directed to children under 16 (or higher age required locally). We do not knowingly collect personal data from children. Contact us if you believe we have collected such data.
11. Security
We use industry-standard provider controls (Firebase Auth, HTTPS, access rules). No method of transmission or storage is 100% secure.
12. Changes
We may update this Policy by posting a new version with a revised effective date. Significant changes will be highlighted where practicable.
13. Contact
Privacy and data-protection requests: support@cfa-drill.com.
Product support (non-privacy): support@cfa-drill.com.