Privacy Policy

Effective October 3, 2026

PassFish provides certification exam practice through the PassFish iOS and Android apps and the website quiz.alx37.com (the “Service”), operated by ALX37 LTD. This policy explains what we collect, how we use it, where it is stored and how you can delete it.

Data we collect

• Email address — to identify your account and send verification codes.
• Password — stored only as a salted PBKDF2 hash, never in plain text.
• Device identifier — a random UUID created on first launch, used to tell your devices apart. It is not an advertising identifier.
• Access code and device name — when you activate with an access code, to check the code and limit how many devices use it at once. The device name (such as the phone model) is shown in device management so you can remove old devices.
• Study progress — answers, bookmarks, mock exam scores, reading position and saved words, synced across your devices.
• AI tutor questions — processed only to generate an answer and not stored; we keep a daily request count.
• IP address — used to rate-limit sign-in and verification attempts.

What we don’t do

No ads, no third-party analytics or advertising SDKs, no tracking across apps or websites, and we never sell or rent your personal data. The app does not access contacts, location, photos, camera or microphone.

Where data is processed

Cloudflare hosts our servers, database, file storage and AI inference (Meta Llama 3.1 on Workers AI; your questions are not used for training). Resend delivers verification emails and receives only your email address and the code. These providers may process data outside your country; all traffic is encrypted with HTTPS.

Retention

Account data and progress are kept until you delete your account. Sessions expire after 30 days and verification codes after 10 minutes.

Deleting your account

In the iOS or Android app, open Me → Delete Account and confirm with your password; deletion is immediate. You can also email support@alx37.com from your registered address and we will process it within 30 days. Your email, password hash, sessions, exam access and cloud progress are permanently removed. To prevent reuse, an already-used access credential stays marked as used; that record contains no personal information.

Your rights, children and changes

You may access, correct, export or delete your data at any time by contacting us. The Service is intended for adults preparing for professional certifications and is not directed to children under 14. We will update the effective date above when this policy changes materially.

Contact

ALX37 LTD · support@alx37.com