Privacy Policy
Last updated: September 28, 2026
TopASVAB ("we", "us") provides ASVAB study and practice tools at topasvab.com. This policy explains what we collect and why. We sell a study product — we do not sell your personal data.
Information we collect
- Account data — your email address, whether it has been verified, and optionally a display name. If you set a password we store only a salted hash of it, never the password itself; magic-link-only accounts have no password at all. We also record when the account was created and last changed. If you agree to study tips and product news by email, we store that choice and when you made it, and when you turn it off. If you sign in with Google, we also store your Google account ID (see the next item).
- Sign in with Google (optional) — if you choose Continue with Google, you sign in on Google's own page and Google sends us your Google account ID (an identifier for your Google account), your email address and whether Google has verified it, and your name, along with a few other profile details such as a link to your profile photo, which we don't keep. We never see your Google password, and we ask Google for nothing else: not your contacts, files or calendar. Google can confirm an email address for us only when Google runs that mailbox: a Gmail address, or an address at an organization that uses Google Workspace. Only then, and only when Google has verified it, do we use the address to find, confirm or create your account, and it is, or becomes, your account's address. For any other address, sign in or create your account with your email first; you can then link Google from your account page. We store your Google account ID with your account so that Continue with Google signs you in next time, and we email your account's address whenever Google sign-in is added to an existing account. Your name is only used to pre-fill the optional name field when you create an account, and is stored only if you keep it there. If that address has no account yet, these details wait in your browser for up to 5 minutes while you answer the sign-up questions, and are deleted if you sign out, choose to start over, or sign in or sign up with your email instead; if you don't finish, or we can't create an account for you, nothing is stored. You can unlink Google from your account page at any time and still sign in with a link we email to you; unlinking also signs you out on your other devices. After you unlink it, Continue with Google no longer signs in to your account and will not link it again by itself (we keep the date you unlinked it with your account); you can link it again from your account page, shortly after signing in. Resetting your password unlinks Google the same way. Deleting your account removes the link too.
- Sign-up questions — when you create an account, with a password or with Google, we ask for the month and year you were born. We use them at that moment to check that we can create the account, whether we can offer you marketing email, and whether you could be under 18. We store when you answered and, only if you could be under 18, the first date on which you will certainly be 18: the first day of the month after the month you turn 18 (March 2 if you were born in February). For an adult we keep nothing about the answer itself. For someone under 18 that date is all we keep, although the month and year of birth can be worked out from it. Until that date we don't send you marketing email and your account can't buy Pro; once it passes, we delete it. Accounts created before we asked this question, and accounts confirmed without the password chosen at sign-up (for example by a sign-in link or a password reset), are asked the same question before they can continue, and can delete the account instead; if the answer means the account holder could be under 13, we delete the account. We also ask, optionally, how you heard about us. If you answer, your answer is held with your sign-up until you confirm your email address. When you confirm with the link from the sign-up email and the password you chose, we add one to a running count for that answer; the count is not linked to your account. However you confirm, the answer is then removed from your sign-up. If you never confirm, it is deleted along with the unconfirmed sign-up. If you create your account with Google, Google has already confirmed your address, so your answer is added to the count when the account is created and is not kept anywhere else.
- Sign-in data — a hashed session identifier and its expiry for each device you are signed in on, plus short-lived hashed tokens for email verification, magic-link sign-in and password reset.
- Study data — saving results is a Pro feature, so we store this only for Pro accounts. For each session you complete: the subtest and mode, how many questions you answered, how many you got right, how long the session took, the ability estimate for adaptive tests, and your individual answer choices with the time spent on each question, so we can show per-topic strengths and weaknesses rather than just a score. We also record which questions you have already been shown, so a second sitting of a subtest does not repeat items you have already seen. Anonymous and free accounts keep results in the browser tab for the current session only; nothing is saved.
- Billing data — if you subscribe, payment is processed by Stripe and your card number never reaches us. We store your Stripe customer and subscription identifiers, which plan you are on, the subscription status, the current billing period dates, and whether it is set to cancel at period end. When you subscribe, a record of your agreement to automatic renewal (which version of the wording you agreed to, and when) is kept with your purchase at Stripe, and it stays there after you delete your account.
- Technical data — your IP address is used in the moment to rate-limit sign-in, sign-up and contact-form requests and, when bot protection is enabled, to verify a Cloudflare Turnstile challenge. Rate-limit counters are held in memory only and are not written to our database. We also use Cloudflare Web Analytics, which is aggregate and cookieless.
- Messages you send us — if you use the contact form, its contents (and your account email, if you are signed in) are emailed to our support address.
How we use it
To operate your account, save your progress across devices, rotate questions so you see new material, process subscriptions, send transactional email (verification, magic-link sign-in, password reset, a welcome email when you confirm your address or create your account with Google, and a notice when Google sign-in is added to or removed from your account), answer your support messages, and keep the service reliable and free of abuse. We do not use your data for third-party advertising, and we do not profile you for anything other than showing you your own results. The "how did you hear about us" counts only tell us which ways of finding TopASVAB work.
Marketing email is opt-in. We send study tips and product news only if you tick the box for them when you create your account (it starts unticked), and we offer that box only when the month and year of birth you give show you are 18 or older. You can withdraw at any time from your account page or by emailing support@topasvab.com, and every marketing email will include an unsubscribe link. Withdrawing does not affect account emails such as sign-in links and password resets.
Service providers
We share data only with providers that help us run TopASVAB: Stripe (payments), Resend (transactional and support email), Neon (database hosting), and Cloudflare (hosting, bot protection, and cookieless analytics). Each processes data on our behalf under their own terms. If you choose Continue with Google, you sign in on Google's own page, so Google knows you are signing in to TopASVAB; that is covered by Google's own privacy policy, and we send Google nothing about you. No other third party receives your data through this site — our web fonts are served from topasvab.com rather than from a font CDN, so loading a page does not disclose your IP address to anyone else.
Cookies & local storage
We use a strictly-necessary, first-party, HTTP-only cookie (session) to keep you signed in — it is essential to operate the Service and is exempt from consent requirements. If we cannot create or keep an account for you after asking your month and year of birth, we also set a strictly-necessary, first-party, HTTP-only cookie (signup_blocked) for 2 hours, so the question cannot simply be answered again differently; it records only that, and holds no personal data. If you use Continue with Google, we set up to two more strictly-necessary, first-party, HTTP-only cookies, each deleted from your browser once it has been used and of no use after it expires: google_oauth, for up to 10 minutes, which holds encrypted one-time values that protect the sign-in from forgery; and, only while you are creating an account, google_signup, for up to 5 minutes, which holds your Google account ID, email address and name, encrypted, until you finish the sign-up questions. Once your account exists, google_signup no longer signs anyone in to it. We do not use third-party advertising, tracking, or cross-site cookies, and our usage analytics (Cloudflare Web Analytics) are cookieless. We use your browser's local storage for exactly two things: remembering that you dismissed the cookie notice, and remembering that you hid the suggestion to install TopASVAB on your device. Your study progress is never written to local storage — it is held in memory for the current session and, for signed-in users, on our server. Clearing cookies signs you out.
Where your browser supports it, TopASVAB also keeps copies of its own public files — the app's code, fonts, images and a short offline notice — in your browser's cache storage, so pages load faster on later visits and you see that notice rather than an error when you lose your connection. These files are the same for every visitor. Pages that show your account, your questions and answers, and your results are never stored there. Signing out empties it; the same public files are downloaded again the next time a page loads.
Data retention
We keep your account, study and subscription data while your account is active. Session records and verification, magic-link and password-reset tokens expire on their own and are short-lived. If someone requests a sign-in link for an address that has no account, we keep that address only to send one email saying no account exists; it is removed automatically once it has gone 7 days unused (the clean-up runs as the site is used, so it can take a little longer), unless an account is created. Stripe retains its own payment records independently of us, as it is required to. We also keep nightly backups of our database for 35 days, only to recover from data loss; each backup is deleted automatically after 35 days. Your marketing email choice and the date you answered the age question are kept with your account and deleted with it, and so is your Google account ID, unless you unlink Google sooner. The date you will be 18, if we hold one, is deleted once it passes (the clean-up runs as the site is used, so it can take a little longer). The "how did you hear about us" counts are not linked to any account and are kept for as long as we run the service.
Your rights
You may request access to, correction of, or deletion of your personal data. You can delete your account yourself at any time from your account page, which removes your account, study history, question-exposure records and any link to your Google account; or email support@topasvab.com and we will respond within a reasonable time. Deleted data leaves our live database immediately and disappears from our backups within 35 days. Apart from that, we retain only what the law requires us to keep after a deletion.
Children
TopASVAB is intended for people 13 and older preparing for U.S. military enlistment, and is not directed to children under 13. We ask for a month and year of birth when an account is created, and before an older account can continue, and we do not create or keep an account for anyone who may be under 13. We do not knowingly collect personal information from children under 13; if we learn that we have, we delete it. If you believe a child under 13 has given us personal information, email support@topasvab.com and we will delete it.
Contact
TopASVAB is operated by Josh Preston d/b/a TopASVAB, registered in Idaho. Questions about this policy, or a formal privacy request, can be sent to:
TopASVAB is an independent study tool and is not affiliated with, endorsed by, or sponsored by the U.S. Department of Defense or any branch of the U.S. Armed Forces.