Privacy Policy

Pass California is an independent study product for the California Department of Real Estate salesperson examination. We sell one thing, a one-time Premium upgrade in the mobile app and the web app, and we make no money from data. There is no advertising in the app or on this site, no advertising network, no data broker, and no tracking of you across other companies' apps or websites.

The website

No account, no email. There is no registration and no sign-in, and the site never asks for an email address. Every practice question, calculator and guide works without one.

Study progress stays in your browser. Which areas you have opened, which questions you answered and whether you got them right, your confidence marks, and your most recent sampler and mock results, plus unfinished practice attempts, are stored in your browser's local storage under a single key. Unfinished attempts expire after seven days and cannot be resumed if their question content changes. None of this study data is sent anywhere. A visible control on the study guide index and the review page clears it.

Usage analytics

We use PostHog to see which pages and study tools people use, so we know what to improve and what nobody reads. It is the only third-party service that runs in your browser on this site.

When you visit, PostHog receives:

• The pages you view, the page you came from, and how long you stayed.
• Selected product links you click: the store badge or web app link you followed and its location on the page. Automatic capture of other clicks, answer text and form inputs is disabled.
• Whether you started, finished or restarted the five-question sample on Try a question, and whether you started and finished a practice exam, with its length and whether answers showed as you went. Never which answers you chose, your score, or your confidence marks.
• Device and connection details: browser, operating system, screen size, and your IP address, which PostHog uses to estimate an approximate location such as city and country.
• A random identifier, stored in a first-party cookie and in your browser's local storage, so a repeat visit is counted as the same visitor rather than a new one.

What it does not receive: your name or email address, because this site never asks for them; anything you type into a calculator; your study progress; or a recording of your screen. Session recording is switched off. We do not build a profile of you, we do not combine this with any other data, and we do not use it for advertising.

PostHog processes this data on our behalf as a service provider, under its own privacy policy, and keeps it on its standard retention schedule.

Turning analytics off

• Global Privacy Control or Do Not Track. If your browser sends either signal, PostHog is never loaded: no script, no cookie, no request. We honor Global Privacy Control as a valid opt-out under California law.
• A content blocker that blocks PostHog also stops it. Blocking cookies alone does not: the identifier then lasts only until you close the tab, but page views are still counted.
• Clearing this site's cookies and site data discards the identifier, so a later visit starts as a new visitor.

Nothing on the site works differently with analytics off. Every page, question and calculator is the same.

Everything else on the website

Calculator inputs are not stored. Figures you type live in the page while you use it and are gone when you leave.

If browser storage is blocked, everything still works. Progress tracking is an enhancement, not a requirement.

Fonts and links. Font files are served from this site's own domain. They are downloaded once when the site is built and shipped with it, so opening a page makes no request to Google or to any other font host. Links to DRE pages, eLicensing and other outside sites are ordinary links: following one takes you to that organization, whose own privacy practices apply. Analytics records that the link was clicked, and nothing about what you do once you get there.

The web app

The web app at app.passcaliforniarealestate.com is the same study product as the mobile app, in a browser. You sign in to use it, and your account and study progress are handled exactly as described for the mobile app below, in the same Firebase project, so one account works in both.

Purchases in the web app are sold and processed by Paddle.com Market Ltd, our merchant of record, which handles the checkout, payment, tax, receipts, billing support and refunds. Your card details go to Paddle, never to us. Paddle tells us the purchase status, the transaction and receipt identifiers, and the email used at checkout, so we can record Premium on your account; we also pass that status to RevenueCat so the same purchase unlocks the mobile app.

Web app analytics

The web app uses PostHog too, in the same project as this website, so a visit here and a later session in the app count as one visitor. Because the app is where you study, it measures more than the website does:

• Pages and screens you open, and the buttons and links you click.
• Study activity: for each practice question, its content area, whether it was part of an exam, whether your answer was correct and how long you took; for each session, how many questions and how many correct; for flashcards, how many cards you reviewed; and the score of a practice result you bring over from this website.
• Upgrade and sign-out: that you opened the checkout, and that you signed out. Payment details go to our payment processor, never to PostHog.
• Device and connection details, the same as on the website.

Linked to your account. Once you sign in, these events are tied to your account's internal ID and to whether you have the free or the paid plan, so we can see how studying and upgrading relate. Your email address and name are never sent to PostHog. Session recording is switched off in the web app as on the website, and what you type into a field, such as a note or a support message, is not captured. Signing out ends the link, so the next person on a shared computer is not counted as you.

Global Privacy Control and Do Not Track work in the web app exactly as on the website: with either one on, PostHog never loads.

The mobile app

You can study as a guest. Guest progress is kept on that device only and is never uploaded, which also means it is lost if you delete the app. Creating an account is what turns on backup and sync across your devices.

What the app collects

• Account details. Your email address, and your name if you sign in with Apple or Google. Passwords for email sign-in are handled by Firebase Authentication and are never visible to us.
• Study data, when you are signed in: questions answered and the answer you chose, confidence marks, sessions and their timing, practice exam results, review scheduling, Math Coach progress, your notes and bookmarks, and your settings such as exam date and reminder time.
• Support requests. The topic and message you send, your account identifier and email, our replies, and the app version, platform and system version so we can reproduce a problem. A screenshot is attached only if you choose to add one.
• Question reports. If you tap Report on a question, we receive the question, what you told us, and your account identifier.
• Purchase status. Whether the one-time Premium purchase is active, through RevenueCat and the app store you bought it from. We never see your card details; Apple or Google processes the payment.
• A device notification token, if you allow notifications, so a reply to your support request reaches only your own devices.
• Usage analytics. Which study modes and screens you use, through Firebase Analytics. This is on by default and you can turn it off at any time in the app under Settings, then Share Usage Data. It is never used for advertising.
• Crash and performance reports, through Firebase Crashlytics and Sentry: the error, app version, device model and system version. Sentry is configured to remove email addresses and account identifiers before a report is sent.

How it is used

• To run the app: signing you in, saving your work, and syncing it across your devices.
• To choose what to show you next, which is what spaced repetition and weak-area practice do with your own answers.
• To send the daily study reminder you set, and to deliver replies to your support requests.
• To confirm your Premium purchase and restore it on a new device.
• To find and fix crashes, and to see which features are used so we know what to improve.

We do not sell or share your personal information, and we do not use it for advertising or marketing to you.

Who processes data for us

• Google Firebase (Authentication, Cloud Firestore, Storage, Analytics, Crashlytics, Cloud Messaging): accounts, sync, support attachments, analytics, crash reports and notifications.
• RevenueCat: purchase and entitlement status.
• Apple and Google: sign-in, if you choose it, and payment processing for the in-app purchase.
• Paddle: checkout, payment processing, tax, receipts, refunds and fraud prevention for web app purchases, as our merchant of record.
• Sentry: crash and performance reports.

Each has its own privacy policy governing what it does with the data we send it. We disclose data to them only so they can provide these services to us, never for their own marketing.

No advertising, no cross-app tracking

The app contains no ads and no advertising SDK. It does not collect Apple's advertising identifier, shows no App Tracking Transparency prompt, and the Android advertising ID permission is removed from the app. Nothing we collect is combined with data from other companies' apps or websites.

Your choices in the app

• Turn analytics off: Settings, then Share Usage Data.
• Turn reminders off: Settings, then Daily Reminder, or in your phone's notification settings.
• Clear your study history but keep the account: Settings, then Reset All Progress under Danger Zone.
• Delete your account and its cloud data: Settings, then Delete Account under Danger Zone. You may be asked to sign in again first. This removes your account, study progress, notes, bookmarks, exam results, preferences, question reports, support requests and any screenshots, and your notification registrations, from our live systems. If you cannot open the app, email us from the address on the account and we will delete it within one business day.

Deleting your account does not cancel a purchase, because Apple, Google or Paddle holds that record. Refund requests go to whichever of them sold it; the refunds page explains how.

How long it is kept

Your study data is kept while your account exists, so it is there when you come back, and is deleted when you delete the account. Support requests are kept while we handle them and for a reasonable period afterwards in case you write again. Crash reports expire on the provider's standard schedule. Our service providers may hold limited records longer where they need to for security, fraud prevention, legal obligations or routine backups.

Your rights in California

California residents have rights under the California Consumer Privacy Act, as amended by the CPRA: to know what personal information we hold and how it is used, to get a copy of it, to correct it, to delete it, and to opt out of any sale or sharing of it.

We do not sell or share personal information as those terms are defined in that law, and we do not use or disclose sensitive personal information beyond what is needed to provide the app. There is nothing to opt out of.

For the website, the only personal information we hold is the analytics described above, which is tied to a random identifier and not to you by name, so we cannot look you up by name or email. To stop further collection, turn on Global Privacy Control. To have past events deleted, email us the value of the cookie on this site whose name starts with ph_, and we will delete every event recorded under it.

For the web app, analytics events are tied to your account ID. Deleting your account removes your study data from our own systems; to have your PostHog events deleted as well, email us from the address on the account and we will delete every event recorded under it.

For the mobile app, use Delete Account in the app, or email ktaukheer@gmail.com from the address on your account. We reply within one business day and will not treat you differently for asking. If you use an authorized agent, we will ask for proof that you authorized them.

The same requests are welcome from anyone, anywhere. We do not require you to be a California resident to ask us to delete your data.

Children

Pass California is built for adults preparing for a professional license, and a California salesperson license requires you to be 18. The app is not directed to children, and we do not knowingly collect personal information from anyone under 13. If we learn that we have, we delete it.

Security

Data in transit is encrypted with HTTPS. Firebase security rules restrict every record to the account that owns it, Firebase App Check reduces unauthorised access to our backend, and sign-in attempts are rate limited. No system is perfect, but study data of this kind is held no more loosely than that.

Changes to this policy

This page was last updated on October 6, 2026. If we change how data is handled, we update this page and note it in updates. Material changes to the app are also described in the app's release notes.

Contact

Questions about this policy, or a request about your data, go to ktaukheer@gmail.com, or to Settings, then Contact Support in the app. The support page covers the common questions.