Privacy Policy

FirstPassPA LLC ("we," "us," or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information when you use the FirstPassPA platform at firstpasspa.com (the "Platform").

By using the Platform, you consent to the data practices described in this Policy. If you do not agree with this Policy, do not use the Platform.

1. Information We Collect

1.1 Information You Provide Directly

• Account registration information: email address and password (stored in encrypted form)
• Payment information: credit/debit card details — note: we never store your full card number. Payment data is transmitted directly to and stored by Stripe, our payment processor
• Communications: any messages you send us via email or contact forms

1.2 Information Collected Automatically

• Question activity: questions answered, answer choices selected, accuracy rates, study sessions, streaks, flashcard views, and other performance data
• Usage and analytics events: features used, pages and screens viewed, buttons and links clicked, time spent on the Platform, and similar product-analytics events
• Device and browser information: browser type, operating system, device type, and screen or viewport size
• Log data: IP address, pages visited, referring URLs, and timestamps
• Error and diagnostic data: technical details captured when something goes wrong, so we can find and fix problems
• Cookies and similar technologies: used for authentication, to keep the Platform working, and for product analytics (see Section 6)

1.3 Information We Generally Do Not Collect

• We do not ask for your legal name, physical mailing address, or date of birth to create an account
• We do not collect Social Security numbers or government identification
• We do not knowingly collect personal information from children under 18
• Your full payment card number is handled by Stripe and is never stored on our servers

2. How We Use Your Information

We use the information we collect to:

• Create and manage your account
• Process your subscription payments through Stripe
• Provide, operate, and improve the Platform
• Personalize your study experience (spaced repetition, weakness targeting)
• Generate your performance analytics and progress tracking
• Understand how the Platform is used through product analytics so we can improve it
• Monitor for and diagnose errors, outages, and other technical problems
• Send you service and account emails (for example, receipts, password resets, and important account notices)
• Send you lifecycle and marketing emails about features, study tips, and offers — you can unsubscribe from these at any time
• Measure the performance of our advertising and reach people who may be interested in the Platform, including through advertising and social-media platforms such as Meta (Facebook and Instagram)
• Respond to your questions or support requests
• Enforce our Terms of Service
• Detect and prevent fraud, abuse, and security incidents
• Comply with legal obligations

We do not sell your personal information in the everyday sense of exchanging it for money. Some privacy laws define "sale" and "sharing" broadly to include the use of advertising and analytics tools that pass identifiers to third parties. To the extent our use of those tools is treated as a "sale" or "share" under those laws, you can opt out — see Your Privacy Choices below.

3. How We Share Your Information

We share your information only in the following limited circumstances:

3.1 Service Providers and Processors

We work with the following third-party providers, who process your information on our behalf or in connection with the Platform:

• Supabase (supabase.com) — database storage and user authentication. Your account data, question activity, and usage data are stored in Supabase's infrastructure.
• Stripe (stripe.com) — payment processing. Stripe receives your payment card information directly; your full card number is never stored on our servers. Stripe's own Privacy Policy governs its use of your payment data.
• Resend (resend.com) — email delivery for our service, account, lifecycle, and marketing emails.
• PostHog (posthog.com) — product analytics. Helps us understand how the Platform is used so we can improve it.
• Sentry (sentry.io) — error monitoring and diagnostics, so we can detect and fix technical problems.
• Crisp (crisp.chat) — support chat. Powers the in-app chat you use to contact us.
• Meta / Facebook (meta.com) — advertising and measurement. We use the Meta Pixel and Meta's Conversions API to measure ad performance and reach potential users on Facebook and Instagram.
• Anthropic (anthropic.com) — AI tutoring features. When you use the AI Tutor, your questions and the relevant question context are sent to Anthropic's API.
• Vercel (vercel.com) — Platform hosting and content delivery.

3.2 Advertising and Analytics Partners

As described above, we use analytics and advertising tools (such as PostHog and the Meta Pixel and Conversions API) that may receive certain information about your device and activity on the Platform. Depending on how your local privacy laws define these terms, this activity may be considered "sharing" or a "sale" of personal information. You can opt out of it — see Your Privacy Choices.

3.3 Legal Requirements

We may disclose your information if required by law, regulation, legal process, or governmental request.

3.4 Business Transfers

If FirstPassPA LLC is acquired, merged, or sells substantially all of its assets, your information may be transferred as part of that transaction. We will notify you of any such change.

4. Data Retention

We retain your account information and usage data for as long as your account is active. If you delete your account, we will delete your personal data within 30 days, except where we are required to retain it for legal or regulatory purposes (such as records of financial transactions, which we retain for 7 years as required by law).

Anonymized, aggregated usage data (which cannot be linked back to you) may be retained indefinitely for Platform improvement purposes.

5. Data Security

We implement industry-standard security measures to protect your information, including:

• Encryption of data in transit using TLS/SSL
• Encrypted storage of passwords (we never store passwords in plain text)
• Secure third-party infrastructure (Supabase, Vercel) with their own security certifications
• Row-level security policies ensuring users can only access their own data

No method of transmission over the internet or electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your information, we cannot guarantee absolute security.

6. Cookies and Tracking Technologies

We and our providers use cookies and similar technologies (such as local storage and pixels) for a few purposes:

• Essential: authentication cookies to keep you logged in, and session storage to maintain your study session state. The Platform can't function without these.
• Analytics: product-analytics technologies (for example, PostHog) that help us understand how the Platform is used so we can improve it.
• Advertising and measurement: technologies such as the Meta Pixel that help us measure the performance of our advertising and reach people who may be interested in the Platform.

You can control cookies through your browser settings — most browsers let you block or delete cookies, though blocking essential cookies may prevent you from logging in or using the Platform. See Your Privacy Choices for more ways to opt out of analytics and advertising.

7. Your Privacy Choices

You have several ways to control how your information is used:

• Marketing email: every marketing email we send includes an unsubscribe link. Click it to stop receiving marketing and lifecycle emails. You'll still receive essential service and account emails (such as receipts and password resets).
• Browser cookie controls: you can block or delete cookies through your browser settings, and use browser privacy features or extensions to limit tracking. Note that blocking essential cookies may prevent you from logging in.
• Do Not Sell or Share My Personal Information: we do not sell your personal information for money. To the extent our use of analytics and advertising tools is considered a "sale" or "sharing" of personal information under applicable law, you may opt out. We honor the Global Privacy Control (GPC) browser signal — if your browser or a browser extension sends a GPC signal, we treat it as a valid request to opt out of the sale or sharing of your personal information for that browser. You can also email us at legal@firstpasspa.com to make this request.

8. Your Rights

Depending on your location, you may have the following rights regarding your personal information:

• Access: request a copy of the personal data we hold about you
• Correction: request that we correct inaccurate personal data
• Deletion: request that we delete your personal data (subject to legal retention requirements)
• Portability: request your data in a portable format
• Objection: object to certain processing of your data

To exercise any of these rights, email us at legal@firstpasspa.com. We will respond within 30 days.

9. California Privacy Rights (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act, as amended by the CPRA:

• The right to know what personal information we collect, use, share, or sell
• The right to delete personal information we have collected from you
• The right to correct inaccurate personal information
• The right to opt out of the sale or sharing of your personal information
• The right to non-discrimination for exercising your rights

We do not sell your personal information for money. To the extent our use of advertising and analytics tools is treated as a "sale" or "sharing" under California law, you can opt out as described in Your Privacy Choices — including by sending a Global Privacy Control (GPC) signal from your browser. To exercise any of your California privacy rights, contact us at legal@firstpasspa.com.

10. European Users (GDPR)

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, we process your personal data under the following legal bases:

• Contract: processing necessary to provide the Platform services you have requested
• Legitimate interests: improving the Platform, preventing fraud, ensuring security
• Legal obligation: complying with applicable laws

You have the right to lodge a complaint with your local data protection supervisory authority.

11. Children's Privacy

The Platform is not directed to individuals under the age of 18. We do not knowingly collect personal information from children under 18. If you believe we have inadvertently collected information from a child under 18, please contact us immediately at legal@firstpasspa.com and we will delete the information promptly.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated Policy on the Platform and updating the "Last Updated" date. Your continued use of the Platform after changes are posted constitutes your acceptance of the revised Policy.

13. Contact Us

FirstPassPA LLC
Email: legal@firstpasspa.com
Website: firstpasspa.com
State of Formation: Michigan, United States

We will respond to all privacy-related inquiries within 30 days.