Privacy Policy

Introduction

CAAS PPL Practice Tests (the "site", available at quiz.caaspracticetest.com) is an online study tool for student pilots preparing for the Civil Aviation Authority of Singapore Private Pilot Licence theory exams. The site is operated by a sole developer based in Singapore.

This policy explains what information we collect when you use the site, how we use it, and the choices you have. We try to keep data collection to the minimum needed to run the service, and we take the privacy of our users seriously.

Information we collect

When you create an account, we collect basic account information through Firebase Authentication. This typically includes your email address and, if you sign in with a provider such as Google, your display name. We do not ask for your home address, date of birth, or any government identifiers.

As you use the practice tests, we store your quiz progress and results in Firebase Firestore. This includes which subjects you have attempted, the questions you have answered, your scores, and timestamps. We use this to show your history and progress within the app.

If you subscribe to the paid tier, your billing information is handled by Stripe. We do not store your card number, expiry date, or CVV on our servers. We do receive limited information from Stripe such as your subscription status, the last four digits of your card for display, and the billing email you used.

We also collect basic usage data, such as which pages were visited and which quizzes were started, to understand how the site is used and to improve it. See "Analytics and usage data" below for details.

Analytics and usage data

To understand how the site is used and to improve it, we operate our own first-party event analytics. When you use the site we record events such as page views, quizzes started and completed, results viewed, and sign-in or sign-up actions, along with the subject involved and a timestamp. These events are stored in our own database and are not sold or shared for advertising.

We also use Google Analytics 4, loaded via Google's gtag tag, to produce aggregate usage statistics. Google Analytics sets its own cookies and processes data under Google's privacy policy. You can learn more at policies.google.com/privacy.

Our first-party analytics relies on two cookies:

• caas_vid — a durable, randomly generated visitor identifier that lets us count returning visitors and distinguish one browser from another without using your name or email.
• caas_sid — a short-lived session identifier that groups the events from a single visit together.

For abuse prevention and to enforce free-tier limits, we record your IP address and browser user-agent only as one-way salted hashes. A salted hash is a scrambled, irreversible fingerprint: we cannot turn it back into your real IP address or user-agent string, and we never store the raw values. These hashes let us detect patterns of abuse without retaining identifying network data.

Cookies and similar technologies

We use cookies and similar local storage technologies for a few purposes:

• Authentication cookies that keep you signed in across pages so you do not have to log in each time.
• Analytics cookies that help us measure aggregate site usage. These include a durable first-party identifier cookie named caas_vid and a per-session cookie named caas_sid (see "Analytics and usage data" below).
• Advertising cookies served by Google and its partners on the free, ad-supported version of the site (see the next section for details).

Third-party advertising — Google AdSense

We use Google AdSense to serve ads on the free, ad-supported version of this site.

Google, as a third-party vendor, uses cookies to serve ads on our site.

Google's use of advertising cookies enables it and its partners to serve ads to our users based on their visit to our sites and/or other sites on the Internet.

Users may opt out of personalised advertising by visiting Google's Ads Settings.

You can also opt out of a third-party vendor's use of cookies for personalised advertising by visiting www.aboutads.info.

For more on how Google uses information from sites that use its services, see policies.google.com/technologies/partner-sites.

Paid subscribers see an ad-free version of the site.

Payment processing — Stripe

Stripe is our payment processor. When you start a subscription, you enter your card details directly into Stripe's hosted checkout. Card data is collected, processed, and stored by Stripe under their privacy policy, which is available at https://stripe.com/privacy. We receive only the limited subscription metadata needed to grant you access.

Authentication — Firebase

Sign-in is handled by Google Firebase Authentication. Your authentication data is stored on Google infrastructure and is subject to Google's terms and privacy policy. We use Firebase to verify who you are when you load the app and to associate your quiz progress with your account.

Data retention

We keep your account and quiz history for as long as your account exists. If you want your account and the data tied to it deleted, email us at the address below and we will remove it.

Your rights

You can ask us to:

• Tell you what personal information we hold about you.
• Correct anything that is wrong.
• Delete your account and the data associated with it.

Send your request to lowkeycapdev@gmail.com. We will reply within a reasonable time.

Children's privacy

This site is not directed at, and not intended for, users under the age of 16. We do not knowingly collect personal information from children. If you believe a child has created an account, email us and we will remove the account.

Changes to this policy

We may update this policy from time to time as the site evolves or as the law changes. When we do, we will update the "Last updated" date at the top of this page. The date there always reflects the most recent update.

Contact

Questions about this policy or about how your data is handled can be sent to lowkeycapdev@gmail.com. You can also use the contact page for general enquiries.