Privacy policy

This policy covers the Citizenship mobile app and this website. They are run by the operator of Citizenship (“we”). Questions about it, or about your data, go to support@localhost.

In short: we collect what is needed to run your practice and measure your readiness. We do not sell your data, show ads, track you across other apps or websites, or use an analytics or advertising SDK. You can delete your account, and everything in it, at any time from inside the app.

What we collect

• Account: your email address and password (stored only as a one-way hash). Optionally a display name, your preferred language, the country whose test you are preparing for, your region of residence where the test depends on it, and your exam date.
• Learning activity: the questions you answer, whether you were right, how long you took, your practice and mock-exam results, your study plan, the questions you save, and the mastery and readiness scores we calculate from them. The list of questions you got wrong is worked out from these answers; it is not stored separately.
• Reports you send: when you report a problem with a question or with a tutor explanation, the reason, any note you write and, for a tutor explanation, the text you are reporting. When you report an organization, the reason and your note; the organization is not told who reported it. When you block one, which organization, and your email address so that it cannot invite you again.
• Devices and sign-in: for each signed-in session, the device’s user agent and IP address, kept to detect stolen sessions. If you allow notifications, the device’s push token, platform and app version. Security records of actions on your account, such as deleting it, with the request’s IP address.
• Notifications: your notification settings and the notifications we sent you.
• Purchases: which pass you bought, its price, when it began and ends, and the store’s transaction reference. We never receive your card or payment details.
• Product experiments: which version of a screen you were shown, so we can tell which version helps learners more.
• Organizations: if a school, library or settlement agency invites you and you accept, the record of your consent and which group you joined.

On your phone, the app keeps the downloaded questions, your progress, your saved questions and any answers waiting to be sent, so practice works offline. Your text size and light or dark choice stay on the phone and are never sent to us. Your sign-in is kept in the iOS Keychain or Android encrypted storage. The app does not access your contacts, photos, location, camera or microphone.

On this website, the only cookie we set ourselves is your choice of light or dark appearance, and only if you pick one. It holds that word and nothing else, and is not shared with anyone.

Why we use it

• To provide the service: practice, mock exams, readiness, study plans and reminders.
• To keep your account secure and prevent abuse.
• To fix questions that are wrong or out of date.
• To provide a pass you bought, and to keep records of purchases.
• To improve the product from results across learners, never to profile you for ads.

Where the GDPR or UK GDPR applies, our legal bases are performance of our contract with you (running the service), our legitimate interests (security and improving questions), your consent (notifications, and sharing with an organization) and legal obligation (records of purchases).

Who processes it for us

These providers process data only to provide their service to us. We do not sell your personal data or share it with anyone for their own purposes.

• Our hosting and storage providers run the servers and database that hold your account and learning data.
• Google Firebase Cloud Messaging (and, for iPhones, Apple’s push service, which Firebase relays through) delivers notifications; older versions of the app use Expo’s push service. They receive the device’s push token, a Firebase installation ID and the notification text, never your name, email or answers. We use Firebase for messaging only: no analytics and no advertising.
• Resend sends the six-digit codes that verify your email or reset your password. It receives your email address and the code.
• RevenueCat validates App Store and Google Play purchases. It receives our internal id for your account, not your name or email.
• Stripe processes purchases made on the website. It receives your email (for the receipt) and our internal id for your account.
• Anthropic powers the optional AI tutor that explains a question. It receives only the published question, its answer options and the reviewed explanation, never anything about you, your answers or your device.

Apple and Google also process purchases you make in their stores, under their own privacy policies. Our providers may process data outside your country; where they do, we rely on the safeguards the law requires, such as standard contractual clauses.

Organizations you share progress with

An organization sees your progress only after you accept its invitation and agree to the sharing terms it shows you. It then sees your name, your group, and a summary of your progress: how many questions you have answered, how many correctly, when you last practised and your readiness. It never sees your individual answers. You can stop sharing at any time in the app, and the organization stops seeing your progress immediately.

Leaderboards, friends and challenges

Competing is optional and private by default. If you choose a nickname, your friends see it with your level, tier and score; they never see your name or email. Public leaderboards are off until you turn them on: then anyone using the app sees your nickname and score on the country and world boards. You can turn them off, change your nickname or delete it at any time.

Friendship needs both people to agree. In a challenge, your opponent sees your nickname and, once it is decided, your score, time and the questions you both missed; never your other answers. There is no messaging. You can block anyone, which hides you from them everywhere, and report a nickname or behaviour to our moderators, who never tell the other person who reported them. We keep the XP and results you earn so your progress and the boards are correct; they are deleted with your account.

Tournaments rank everyone who plays the same questions; the standings show you, your friends and players on public boards by nickname, and only count everyone else. If you ask us to find you an opponent, we pair you with another adult learner at a similar level, who sees only your nickname. Your theme choice and your flashcard schedule are stored with your account. Signing in on this website uses cookies that only keep you signed in; we use no advertising or analytics cookies.

How long we keep it

We keep your data while you have an account. When you delete your account, the account and everything linked to it: profile, learning history, saved questions, study plans, results, XP, nickname, friendships, challenges, reports, notifications, devices, purchase records and organization links: are deleted at once. We keep only the security record that an account was deleted, with nothing that identifies whose it was. Encrypted server backups exist only for disaster recovery and are overwritten on their normal rotation.

Codes sent by email stop working after ten minutes. Sign-in sessions expire on their own, and signing out ends every session.

Your choices and rights

• Delete your account: in the app, open Notifications and account, then Delete account, or delete it on the web.
• Notifications: turn each kind on or off in the app, or turn them all off in your phone’s settings.
• Organizations: stop sharing at any time from Organizations in the app.
• Access, correction and a copy of your data: email support@localhost and we will answer within one month. You may also complain to your data-protection authority.

Security

Everything between the app and our servers is encrypted in transit (HTTPS). Passwords are stored only as one-way hashes. In our database, each learner’s data is isolated by row-level security, and staff actions are logged.

Children

The service is for adults preparing for a citizenship test and is not directed at children. We do not knowingly collect data from anyone under 16; if you believe a child has created an account, contact us and we will delete it.

Where a law asks app stores to share a user’s age range (some US states do), the app asks the store for it on your device. The age range itself stays on your device and is never sent to us. The only thing we keep is whether it shows you are under 18, so that the protections below apply on every device you use. If it shows you are under 18, you stay off public leaderboards and can only play challenges with friends; a pass can be bought only with a parent’s approval in the store, and sharing progress with an organization needs a parent’s agreement. If it shows you are under 13, the account cannot be used, and a parent or guardian can delete it from the app.

Not a government service

Citizenship is an independent study aid. It is not affiliated with or endorsed by any government, and it does not give legal or immigration advice.

Changes

When this policy changes we update the date above. If a change is significant, we will tell you before it applies to you.