Privacy Policy

Version 1.3 · Effective November 12, 2026 · Version française

In short

• You can read the notes and try the free sample with no account. In that case we store nothing about you on our servers.
• If you sign in, we keep your Google account ID, your email address, your study progress and, if you buy, a record of the purchase.
• We have no advertising and no tracking. We count visits only as anonymous daily totals, with no cookie and nothing that could identify you. We do not sell your information. We do not send marketing emails.
• Your card details go to Stripe, our payment company. We never see them.
• Our database is in the United States.
• Having an account here can suggest that you are applying for Canadian citizenship. We treat that as sensitive and use it only to run the study features.
• You can ask us by email to delete your account. We do it within 30 days. Accounts not used for 2 years are deleted automatically.

1. Who is responsible

Citizenship Prep is run by Injoy AI Solutions Inc., a company in British Columbia, Canada. Our Privacy Officer is responsible for how we handle personal information.

• Privacy Officer, Injoy AI Solutions Inc.
• 44-10488 124 St, Surrey, British Columbia, Canada V3V 0E9
• support@canadacitizenshipprep.online

We follow Canada's privacy laws for businesses, including the federal Personal Information Protection and Electronic Documents Act (PIPEDA) and British Columbia's Personal Information Protection Act.

2. What we collect

If you do not sign in

We store nothing about you on our servers. Your progress stays in your own browser. Our hosting company, Amazon Web Services, uses your IP address to deliver the pages to you. We do not store IP addresses and we do not keep visitor logs. Your visit is added to anonymous daily totals (see Visit counts below).

If you sign in with Google

• From Google: Google sends us your Google account ID, your email address, whether the email is verified, your name and a link to your profile picture. We keep only the account ID and the email. We do not store your name or your picture. We never receive your password.
• Profile: the times of your first and your latest sign-in.
• Sign-in session: a scrambled copy (a hash) of your sign-in cookie, with your account ID, your email, and the times it was created and expires.
• Study progress: for each question number, whether your last 8 answers were right or wrong; your last 50 mock test results (time, score, score by chapter, type of test); your test date, if you choose to enter one; and technical details used to sync your progress.

If you buy full access

• Purchase record: the email you gave at checkout, Stripe's reference numbers for the checkout and the payment, the amount, the currency, the time of purchase, the date your access ends, how many purchases you have made, whether you ticked the box accepting our Terms at checkout, and the time of any refund or bank dispute.
• Card details: Stripe collects your name, card details, country and postal code on its own page. We never receive your card details.
• Server logs: when a purchase or refund is recorded, our logs note your internal account ID, Stripe's reference number and your access end date. Logs also hold error messages.

Mock tests

While a mock test is running, our server keeps the list of questions, the start time, the deadline and the time you submit. This record is not linked to you.

If you email us

We keep your message and our replies so we can help you and keep a record of your request.

Visit counts

To learn how the site is used, every page you open adds 1 to that day's total for the page. Once a day, your visit also adds 1 to the totals for the kind of device (phone, tablet or computer), the operating system and browser family (for example iPhone and Safari), your country (in Canada, your province), and the kind of site that sent you (for example a search engine, Reddit, or none). Amazon Web Services works out the country or province from your IP address while it delivers the page. We sort each visit into these groups as it arrives and then discard the details. We store only the day's totals: no IP address, no browser details, no account and nothing else that could identify you. Your browser keeps the date of your last visit, so you are counted as a visitor once a day.

We also count, as daily totals, how many people sign in, create an account, start checkout, buy, get a refund and start a mock test.

If your browser sends a Global Privacy Control or Do Not Track signal, your page visits are not counted. (Sign-ins, purchases and the other actions above are still counted, because they happen on our server.) Because the totals are not linked to anyone, we cannot find or delete your share of them.

3. Sensitive information

An account on this site can suggest that you are applying for Canadian citizenship. Your test date, if you enter it, says when. We treat both as sensitive. We use them only to run the study features, such as your countdown and daily goal. We do not use them for anything else and we do not give them to anyone, except the service providers named below who store them for us.

4. How we use your information

• to sign you in and keep you signed in;
• to unlock full access after you pay, and to end it when it runs out or is refunded;
• to save your progress and show it on your devices;
• to answer your emails and handle refunds, access requests and deletion requests;
• to count visits, as section 2 describes, so we know which parts of the site are useful;
• to find and fix errors and keep the site secure;
• to meet our legal duties.

We do not use your information for advertising or profiling. We do not sell it. By signing in, you agree to the uses in this policy. You can take back your agreement at any time by asking us to delete your account.

5. Cookies and browser storage

• One cookie of our own: cp_sid keeps you signed in for up to 30 days. The site needs it to work. Scripts on the page cannot read it, and it is sent only over a secure connection.
• Storage in your browser: your theme choice; a copy of your progress (with your email once you sign in, so the browser knows whose progress it is); answers waiting to upload; an unfinished mock test; your study settings; which chapters you have mastered; which celebrations you have seen; the date of your last visit, for the visit counts; and a 15-minute copy of the questions. This stays in your browser. Signing out clears the copy of your progress from that browser.
• Google: Google's sign-in code loads only when you open the sign-in box. Google may then set its own cookies and see your IP address, under Google's privacy policy.
• Stripe: the checkout page is on Stripe's website and uses Stripe's own cookies.

We use no advertising or tracking cookies, and the visit counts use no cookie, so the site does not show a cookie banner.

6. Companies that help us

A service provider is a company that handles information for us, on our instructions. We use these:

• Amazon Web Services (United States): hosting, our database and our server logs.
• Google: sign-in.
• Stripe: payments. When you start checkout, we send Stripe your email, your internal account ID and the price. Stripe also keeps its own payment and tax records, under Stripe's privacy policy.
• Apple iCloud: it carries and stores emails sent to and from our support address.

We do not share your information with anyone else, unless a law or a court order requires it. If the company or this site is sold, your information may pass to the new owner, who must keep following this policy.

7. Where your information is kept

Our database and logs are in the United States (Amazon Web Services, Northern Virginia). Google, Stripe and our email providers also handle information in the United States and other countries. Information kept outside Canada is subject to the laws of that country. Courts and authorities there may be able to access it under those laws.

8. How long we keep it

• Account (profile, progress and purchase record): deleted automatically 2 years after your last activity. Activity means signing in, or studying while signed in. A purchase record is kept at least 2 years after its access ends.
• Sign-in session: 30 days, or until you sign out.
• Mock test in progress: 2 days.
• Server logs: 1 month.
• Daily visit totals: kept with no end date. They are not about any one person.
• Backups: our database keeps backups for 35 days. Deleted information can stay in backups for up to 35 days more.
• Emails you send us: up to 2 years after your request is closed.
• Stripe's payment and tax records: kept by Stripe for as long as Stripe's own policy and tax law require. We need them for our taxes.

Automatic deletion can take a few days after the dates above.

9. Your rights

You can ask us:

• for a copy of the information we hold about you;
• to correct information that is wrong;
• to delete your account: your profile, progress, purchase record and sign-in sessions.

Email support@canadacitizenshipprep.online from the email address you use to sign in, so we know the request is yours. We answer within 30 days. There is no charge. The site has no delete button, so a person handles each request. Stripe keeps its own record of your payment after we delete your account.

If you are not satisfied with our answer, you can complain to the Office of the Privacy Commissioner of Canada, to the Office of the Information and Privacy Commissioner for British Columbia, or to the privacy regulator of your province. In Quebec, that is the Commission d'accès à l'information.

10. Security

• The site uses a secure connection (HTTPS).
• We store no passwords and no card details.
• We store only a scrambled copy of your sign-in cookie.
• Only the people who run the site can open the database.

No system is perfectly secure. If a security breach creates a real risk of significant harm to you, we will tell you by email, and we will report it to the privacy regulators as the law requires.

11. Emails from us

We do not send marketing emails or newsletters. We email you only to answer you, or when we must tell you something important about your account, such as a security breach. Stripe sends your payment receipt.

12. Age

Sign-in and purchases are for people aged 18 and over. If we learn that someone under 18 has an account, we delete the account and refund any payment.

13. If you are outside Canada

This policy is written for Canadian law. If you use the site from another country, your information is handled as this policy describes.

14. Changes to this policy

If we change this policy, we post the new version on this page with a new version number and date. We do not send emails about changes.