Privacy Policy

Last updated: October 18, 2026 · Effective: October 18, 2026

This policy explains what the Pass the CSE app collects, why, who helps us process it, and what you can do about it. We wrote it to be read, not skimmed past.

The short version: we collect only what the app needs to keep your account, your progress and your purchase working. We also count a few app events on our own server to see where the app confuses people. No ads, no tracking across other apps or websites, no third-party analytics tools, and we never sell your data.

Who we are

Pass the CSE is made by Godfrey Zubiaga, an individual developer in the Philippines, who is the personal information controller for the app. You can reach us at [email protected], or the developer directly at [email protected]. When this policy says "we" or "us", it means him.

What we collect

If you only use the free sampler, you don't need an account. Your answers stay on your phone. The app creates a random identifier for your installation (not linked to your phone's hardware or advertising ID). It is sent to us with the app's usage events (below) and if you report a question.

When you sign in, we collect:

• Account details. Your email address. If you sign in with Google, also the name and profile photo Google shares with us. If you use Sign in with Apple, Apple may give us a private relay address instead of your real email, and your name only if you choose to share it. If you sign in with an emailed link, just your email.
• Sign-in records. To keep you signed in, we store a session along with the IP address and device or browser type it was created from, and the sign-in tokens Google or Apple return to us.
• Study activity. For each question you answer: which question, its section and topic, the mode (sampler, practice, timed, mock exam or drill), the practice session it belongs to, the answer you picked, whether it was right, and when. Answers you gave before signing in are uploaded once you sign in. This is what lets us restore your progress and readiness score on a new phone.
• Purchase status. When you unlock the full reviewer, we receive a record of the purchase from RevenueCat: a transaction reference, the product, the amount, the store (Apple or Google) and whether it is paid or refunded. If you pay on our website with QR Ph, PayMongo sends us the payment's reference, amount and status instead. We never see your card, GCash, Maya or bank details. Apple, Google and PayMongo handle the payment.

Usage events. The app sends our own server a short note when you reach certain steps: opening the app (once a day), finishing an onboarding step, starting and finishing a free practice session (with its mode, number of questions and score), opening the payment screen (and which button led there), tapping buy or cancelling, and signing in. Each note includes the installation identifier, the time, your platform (iOS or Android) and the app version, plus your account if you're signed in. They never include your email, name, answers you typed or anything you wrote. We use them only as counts, to see where people get stuck and to improve the app. No third party receives them.

Question reports. If you report a mistake in a question, we receive the question, the kind of problem (wrong answer key, typo or unclear), the note you wrote if any, the installation identifier, and your account if you're signed in. Please don't put personal details in the note.

Android testers. If you sign up to test the app before launch, we keep the email (and name, if you give one) you enter so we can add you to the Google Play test, unlock the app for the account you sign in with using that email, and contact you about the test. We delete it when you ask, or once the test is over.

Support emails. If you email us, we keep the conversation so we can help you.

Stays on your phone only: your settings (exam level, exam date, daily goal, answer view, theme, animations, vibration), your study streak, and the downloaded question bank. Your answers are also stored on the phone so the app works offline.

What we don't collect

• No advertising, and no advertising identifiers.
• No tracking of you across other companies' apps or websites.
• No third-party analytics or crash-reporting SDKs in the app. Usage events go only to our own server.
• No location, contacts, camera, microphone or photos.
• No payment card details.

Why we use it

• To create and secure your account and keep you signed in.
• To sync your answers so your progress, readiness score and history follow you to another phone.
• To unlock the full reviewer after you pay, restore it later, and handle refunds and duplicate charges.
• To fix questions you report and tell you when a fix is published.
• To understand, from usage events, where people get stuck and what to improve.
• To answer your support requests.
• To prevent abuse and meet legal and accounting obligations.

Under the Data Privacy Act of 2012, we process this information because it is needed to provide the service you asked for (your account and purchase), to comply with legal obligations (such as keeping transaction records), and for our legitimate interest in keeping the question bank accurate, improving the app and keeping the service secure. We don't use your data for automated decisions that have legal or similar effects on you.

Who processes it for us

We share data only with the services that run the app, and only what each one needs:

• Google, if you sign in with Google, and as the Google Play store for Android purchases.
• Apple, if you use Sign in with Apple, and as the App Store for iOS purchases.
• RevenueCat, which processes in-app purchase receipts from Apple and Google and tells our server when an unlock is bought or refunded.
• PayMongo, which processes QR Ph payments made on our website and tells our server when one is paid.
• Resend, our email delivery provider, which sends sign-in links and other account emails to your address.
• OVHcloud, which hosts our server and database, and Cloudflare, which carries traffic between the app and our server.

Each of these handles data under its own privacy policy. Some of them process data outside the Philippines. We pick services that protect data to a standard comparable to Philippine law. We may also disclose information if the law requires it, for example a valid order from a Philippine court or government agency.

We do not sell, rent or trade your personal information to anyone.

How long we keep it

• Account details and study activity: while your account exists. Delete your account and we delete them.
• Usage events: up to 13 months, then deleted. If you delete your account, we delete the events from your account and your devices right away.
• Sign-in sessions expire on their own. Emailed sign-in links expire after 5 minutes.
• Question reports: kept so we can track fixes. If you delete your account, reports are no longer linked to it.
• Purchase records: kept, without your name or email, for as long as tax and accounting rules require. Your purchase receipts themselves are held by Apple, Google, RevenueCat and PayMongo under their own policies.
• Answers stored on your phone stay until you delete the app or its data.

Deleting your account

You can delete your account in the app under Profile → Account → Delete account, or by emailing [email protected] from the address on your account. We then delete your account details, sign-in records, study activity and usage events from our server. We keep only what we must for accounting or legal reasons, as described above. Deleting your account does not cancel or refund a purchase. See Support for step-by-step help.

Your rights

Under the Data Privacy Act of 2012 (Republic Act No. 10173), you have the right to:

• Be informed about how your personal information is processed (this policy).
• Access the personal information we hold about you.
• Correct information that is wrong or out of date.
• Erasure or blocking of your information, including by deleting your account.
• Object to processing, including withdrawing consent where we rely on it.
• Data portability: get a copy of your data, such as your answer history, in a common electronic format.
• Damages if you are harmed by inaccurate or unlawfully processed data.
• File a complaint with the National Privacy Commission (privacy.gov.ph).

To use any of these rights, email us. We'll reply within 15 days. We may ask you to confirm you own the account before we act on it.

Security

Data travels between the app and our server over encrypted connections (HTTPS). Your sign-in session is kept in your phone's secure storage, or in a browser cookie when you use Pass the CSE on the web. Access to our server and database is limited to the developer and, for support and refunds, one support helper. No system is perfectly secure. If a breach affects your personal information, we will notify you and the National Privacy Commission as the law requires.

Children

Pass the CSE is a reviewer for adult exam-takers and is not directed at children under 13. You must be at least 13 to use it. If you're a minor under Philippine law, please use the app and make any purchase with a parent's or guardian's consent. If you believe a child under 13 has given us personal information, email us and we'll delete it.

This website

This website is a few static pages. It sets no cookies and shows no ads. We count visits with Umami, a privacy-friendly counter that we host ourselves: it uses no cookies, stores no IP addresses and can't identify you, and tells us only things like which pages were viewed, the referring site or campaign link, and the browser, device type and country. Our web host keeps standard server logs (such as IP address and pages requested) for security and reliability. Fonts are loaded from Google Fonts.

Changes to this policy

If we change what we collect or how we use it, we'll update this page and the "Last updated" date. For significant changes we'll also tell you in the app or by email before they take effect.

Contact

Questions or requests about your privacy: [email protected]. Godfrey Zubiaga ([email protected]), Philippines.