Privacy Policy

TopASVAB ("we", "us") provides ASVAB study and practice tools at topasvab.com. This policy explains what we collect and why. We sell a study product — we do not sell your personal data.

Information we collect

• Account data — your email address, whether it has been verified, and optionally a display name. If you set a password we store only a salted hash of it, never the password itself; magic-link-only accounts have no password at all. We also record when the account was created and last changed.
• Sign-in data — a hashed session identifier and its expiry for each device you are signed in on, plus short-lived hashed tokens for email verification, magic-link sign-in and password reset.
• Study data — saving results is a Pro feature, so we store this only for Pro accounts. For each session you complete: the subtest and mode, how many questions you answered, how many you got right, how long the session took, the ability estimate for adaptive tests, and your individual answer choices with the time spent on each question, so we can show per-topic strengths and weaknesses rather than just a score. We also record which questions you have already been shown, so a second sitting of a subtest does not repeat items you have already seen. Anonymous and free accounts keep results in the browser tab for the current session only; nothing is saved.
• Billing data — if you subscribe, payment is processed by Stripe and your card number never reaches us. We store your Stripe customer and subscription identifiers, which plan you are on, the subscription status, the current billing period dates, and whether it is set to cancel at period end.
• Technical data — your IP address is used in the moment to rate-limit sign-in, sign-up and contact-form requests and, when bot protection is enabled, to verify a Cloudflare Turnstile challenge. Rate-limit counters are held in memory only and are not written to our database. We also use Cloudflare Web Analytics, which is aggregate and cookieless.
• Messages you send us — if you use the contact form, its contents (and your account email, if you are signed in) are emailed to our support address.

How we use it

To operate your account, save your progress across devices, rotate questions so you see new material, process subscriptions, send transactional email (verification, magic-link sign-in, password reset), answer your support messages, and keep the service reliable and free of abuse. We do not use your data for third-party advertising, and we do not profile you for anything other than showing you your own results.

Service providers

We share data only with providers that help us run TopASVAB: Stripe (payments), Resend (transactional and support email), Neon (database hosting), and Cloudflare (hosting, bot protection, and cookieless analytics). Each processes data on our behalf under their own terms. No other third party receives your data through this site — our web fonts are served from topasvab.com rather than from a font CDN, so loading a page does not disclose your IP address to anyone else.

Cookies & local storage

We use a single strictly-necessary, first-party, HTTP-only cookie (session) to keep you signed in — it is essential to operate the Service and is exempt from consent requirements. We do not use third-party advertising, tracking, or cross-site cookies, and our usage analytics (Cloudflare Web Analytics) are cookieless. We use your browser's local storage for exactly one thing: remembering that you dismissed the cookie notice. Your study progress is never written to local storage — it is held in memory for the current session and, for signed-in users, on our server. Clearing cookies signs you out.

Data retention

We keep your account, study and subscription data while your account is active. Session records and verification, magic-link and password-reset tokens expire on their own and are short-lived. Stripe retains its own payment records independently of us, as it is required to.

Your rights

You may request access to, correction of, or deletion of your personal data. You can delete your account yourself at any time from your account page, which removes your account, study history and question-exposure records; or email [email protected] and we will respond within a reasonable time. We retain only what the law requires us to keep after a deletion.

Children

TopASVAB is intended for users 13 and older preparing for U.S. military enlistment. We do not knowingly collect data from children under 13.

Contact

Questions about this policy? Email [email protected].

TopASVAB is an independent study tool and is not affiliated with, endorsed by, or sponsored by the U.S. Department of Defense or any branch of the U.S. Armed Forces.