CivicPass Privacy Policy

1. Introduction & Privacy-First Philosophy

CivicPass ("CivicPass", "we", "us", or "our") provides an independent digital study platform engineered to help candidates prepare for government naturalization and citizenship exams, including the United States USCIS Civics Test, the United Kingdom Life in the UK Test, the Canadian Discover Canada Citizenship Test, and the Australian Citizenship: Our Common Bond Examination.

Unlike conventional online education platforms that gather personal profiles and monetize test-taker analytics, CivicPass is built from the ground up on a privacy-first, client-side execution model. When you prepare for your naturalization test on CivicPass, everything is client-side: your tests run directly in your web browser, and no personal or financial information is required to access our study tools.

2. Information We Explicitly Do Not Collect

CivicPass adheres to the principle of comprehensive data minimization. We have deliberately architected our platform so that the following sensitive data categories are never requested, collected, or stored:

• No Credit Card or Payment Details: We do not collect credit card numbers, debit cards, card expiration dates, CVV/CVC security codes, bank routing information, or billing addresses. CivicPass is completely free. There are no paywalls, paid tiers, checkout forms, or recurring subscriptions. We never ask for or process any payment data.
• No Sensitive Personal Data: We do not ask for, collect, process, or hold any sensitive personal data (special category data under GDPR Article 9, UK GDPR, and CCPA/CPRA). This includes:
  • Government-issued identification numbers (Social Security Numbers, Alien Registration / A-Numbers, National Insurance Numbers, Passport numbers, Driver's License IDs, or Taxpayer IDs).
  • Immigration case records, petition numbers, filing documents, or legal status paperwork.
  • Biometric, facial recognition, or genetic information.
  • Special category personal characteristics, including racial or ethnic origin, religious or philosophical beliefs, political affiliations, trade union membership, medical records, or sexual orientation.
• No Mandatory User Accounts or Passwords: You are never forced to register, provide your real name, submit an email address, or link third-party social media profiles (such as Google, Apple, or Facebook) to take practice exams or read statutory guides.
• No Cross-Site Commercial Ad Trackers or Data Brokers: We do not embed surveillance trackers, behavioral ad pixels, or third-party marketing brokers. We never sell, rent, or monetize your study activity or test habits with advertisers.

3. Client-Side Architecture: Everything Is Client Side

A core pillar of CivicPass is that everything is client side. We deliberately avoid server-side test scoring and remote database tracking to protect your educational privacy:

• 100% Client-Side Test Execution: When you select an exam track (such as US, UK, Canada, or Australia), the relevant question pool is fetched by your browser. All test mechanics—including question randomization, countdown timers, answer selection, score calculation, pass/fail grading, and statutory feedback—execute strictly within your browser's local JavaScript runtime.
• Zero Server-Side Answer Tracking: Your individual test answers, the questions you get right or wrong, your overall test scores, and your diagnostic performance metrics are never transmitted to, analyzed by, or stored on our servers. We do not track or log what questions you missed or how you performed.
• Local Browser Storage: To allow you to review your test results or retain interface preferences (such as selected country track and timer pacing) between visits, CivicPass uses your browser's local storage capabilities (localStorage and sessionStorage). This information is saved exclusively on your local device.
• Instant Local Deletion: Because all test activity remains entirely on the client side, you maintain full sovereignty over your data. You can erase your test history, scores, and preferences at any moment by clearing your browser's site data or cache for civicpass.org. Because no copy is ever saved to a server database, clearing your browser deletes your history permanently and irrevocably.

4. Information We Collect and How It Is Used

To maintain platform availability, defend against cyber threats, and support users who voluntarily reach out, we process minimal technical data:

A. Standard Server Logs (Hosting Infrastructure)

When your browser requests web pages, static stylesheets, or question files, edge hosting servers record standard HTTP server access logs. This limited technical telemetry may include:

• Your Internet Protocol (IP) address (used solely for real-time edge routing, DDoS mitigation, rate limiting, and coarse country-level routing).
• Browser user-agent, operating system version, and device type.
• Requested URL path, HTTP status codes, and request timestamps.

These infrastructure logs are used exclusively for security auditing, network integrity, and platform health. They are never tied to individual study habits and are routinely purged on an automated retention cycle.

B. Voluntary Support Inquiries

If you choose to contact us via our Contact Us page (e.g., to report a typographical error, request clarification, or provide editorial feedback), we receive the details you choose to provide:

• Your name (or pseudonym).
• Your email address (solely to reply to your inquiry).
• The category of inquiry, selected exam track, and message body.

This information is used strictly to respond to your message. We never use support emails for marketing campaigns, newsletter subscriptions, or third-party sharing.

5. Legal Bases for Processing (GDPR & UK GDPR)

For individuals residing in the European Economic Area (EEA) and the United Kingdom, CivicPass processes technical data under the following lawful bases:

• Legitimate Interests: To deliver reliable and secure civic educational materials, maintain edge network stability, defend against malicious denial-of-service attacks, and troubleshoot infrastructure errors.
• Consent: When you voluntarily send a message to our support or editorial inbox.

6. Your Privacy Rights (GDPR, UK Data Protection Act & CCPA/CPRA)

Depending on your jurisdiction, you possess statutory rights regarding personal data:

• Right of Access & Portability: You may request confirmation of whether CivicPass holds any personal correspondence relating to you and receive a copy.
• Right to Rectification & Erasure: You have the right to request correction or prompt deletion of any support messages or correspondence you have sent to us.
• Right to Object & Restrict: You may object to or restrict processing of your technical information where applicable.
• California Residents (CCPA/CPRA): We do not sell or share personal information. We do not collect credit cards or sensitive personal information. You have the right to request disclosure of data practices and request erasure without discrimination.
• Client-Side Data Self-Service: Because all study progress, mock scores, and exam answers reside solely on your device in browser local storage, you can exercise full data erasure instantly by clearing your browser's site data.

To exercise any statutory privacy rights regarding support communications, please contact us through our Contact Page or email privacy@civicpass.org.

7. Data Security and Encryption

We adhere to rigorous technical safeguards to protect our platform:

• Transport Layer Security: All communications between your browser and our edge servers are encrypted using modern TLS (HTTPS) protocols.
• Zero Payment Attack Surface: Because we do not collect or store credit card details or bank credentials, our systems carry zero risk of payment card breaches or financial data leakage.
• Least-Privilege Administration: Server infrastructure access is strictly restricted to authorized platform administrators.
• Client Isolation: Because test state is kept client-side, your test sessions are isolated entirely to your local device.

8. Third-Party Edge Infrastructure Providers

We partner with reputable cloud infrastructure and edge network providers (such as Cloudflare and global content delivery networks) to host CivicPass and ensure low-latency worldwide availability. These infrastructure partners handle network-level requests, DDoS filtering, and static content caching strictly in accordance with robust enterprise data protection standards.

9. Children's Online Privacy (COPPA Compliance)

CivicPass is designed for adults and young adults preparing for official national citizenship exams. We do not knowingly collect personal identifiable information from children under the age of 13 (or under 16 in applicable jurisdictions). If you believe a minor has submitted personal details through our contact form, please notify us at privacy@civicpass.org and we will delete the correspondence immediately.

10. Updates to This Privacy Policy

We may periodically update this policy to reflect platform improvements or statutory developments. When updates are published, the effective date at the top of this policy will be revised accordingly. We encourage you to revisit this page periodically to stay informed about our privacy architecture.

11. Contact Our Privacy Team

If you have questions, feedback, or data privacy requests regarding this Privacy Policy or our client-side architecture, please contact our compliance coordinator: