Privacy Policy

1. Who is responsible

ASVAB Pilot is an independent, single-developer product, not a company with a privacy department. Independent prep app. Not affiliated with or endorsed by the U.S. Department of Defense.

Questions, deletion requests and complaints go to support@asvabpilot.com. There is no data protection officer; there is the person who answers that mailbox.

2. What we collect

If you only use this website

Nothing identifying. The free practice builder runs in your browser against static question files, does not require an account, does not post your answers anywhere, and keeps no record of what you got wrong after you close the tab. Your browser sends the usual request metadata (IP address, user agent, requested path) to our hosting provider as part of delivering the page; we do not add our own tracking on top of that.

Identity, if you create an account

You may start as a guest and register later. If you register, we store:

• your email address, when you sign in with an email verification code - the code itself is stored only as a hash and expires in ten minutes;
• the stable subject identifier Apple or Google sends us when you sign in with either, used only to recognise you on the next launch. We do not receive or store your Apple or Google password, and we do not read anything else from those accounts;
• a device identifier, used to attach guest progress to a device so it can be merged into your account when you do sign in;
• session tokens: a short-lived access token (fifteen minutes) and a refresh token stored on our side only as a SHA-256 hash, rotated on every use.

Learning data, the actual product function

To do the things a prep app is for - wrong-answer book, progress, re-drills - we need your answers. For each question you respond to we record: the question ID, its subtest and topic, whether you were correct, which option you chose, how long you took, a timestamp, and the session type (practice, mock or review).

Those events are compressed into one aggregated row per user per question: attempts, correct count, last result, last answered date, favourite flag and wrong-book flag. Raw events are kept for a short operational window and then moved out of the live database into cold archive storage; the aggregate is what your app and reports read.

Mock exams

A timed mock creates a session record holding the exact questions served and the versions they came from, plus your selections and timing, so a session can be resumed after a lost connection and so a report you already have never silently changes when we fix a question.

Messages you send us

Feedback and error reports contain whatever you type, the question ID if you quote one, and optionally an email address so we can reply.

3. What we do not collect

• No third-party advertising SDKs, and no advertising on either the app or this site.
• No name, address, date of birth, SSN, dependency status, ASVAB scores or military history. Please do not send those in feedback.
• No precise location. We use the coarse region implied by your network only for abuse prevention, and store nothing derived from it.
• No payment card data. Version 1 has no in-app purchases at all; when paid passes arrive, the purchase is processed by the App Store or Google Play and, for cross-platform state, RevenueCat. We receive an entitlement record (what you own and when it expires), never a card number.
• No contact list, photos, microphone or files. The app requests only what sign-in requires.

4. Why we process it

Legitimate interest and, for accounts, contract performance: to keep your progress across devices, to show you what to study next, to grade timed sessions fairly, to operate and secure the service, and to fix questions users report as wrong. We do not profile you, and we do not sell or rent your data to anyone - that is not a policy nuance, it is the business model constraint the product was designed around.

5. Where it lives and who touches it

Everything runs on Cloudflare infrastructure: this website as static assets, the API as a Cloudflare Worker, the database as Cloudflare D1, and question packs and archives in Cloudflare R2 object storage, all operated under our own account. Transactional email is sent through Cloudflare's email service. Human verification on sign-up and feedback uses Cloudflare Turnstile, which processes the data described in its own privacy notice.

No other processors are involved. Backups are ours, at rest in the same provider, and access to production systems is limited to the operator plus the platform's own administrators bound by their terms. Logs are configured not to capture tokens or verification codes.

6. Retention

• Account, device and learning aggregates: kept while your account exists.
• Verification codes: ten minutes, and the send cooldown prevents reuse.
• Access tokens: fifteen minutes; refresh tokens: thirty days, then expired records are swept.
• Mock session snapshots: kept so historic reports stay truthful, until you delete your account.
• Feedback: kept until resolved, then retained in a reduced form for quality tracking.
• Deleting your account removes your identity, learning history, sessions and messages, keeping only anonymous counts such as "one account deleted" that cannot be tied back to you.

7. Your rights, and how to use them

You can export or erase everything without talking to us: in the app, Profile opens account controls including deletion, which cascades through the server. If you would rather ask by email - for access, correction, portability, objection, or a complaint about how this policy was applied - write to support@asvabpilot.com. Requests from account holders are answered within thirty days. If you are in the EU/UK, California, or elsewhere, you have the corresponding statutory rights; we handle all of them the same way rather than maintaining three tiers of care. There is no fee and no gatekeeping form.

8. Children

ASVAB Pilot is built for people preparing to enter the U.S. military, which means an age range starting at 17. It is not directed at children, we do not knowingly accept accounts from under-16s, and there is no purchase or social feature that would expose a minor. If you believe a child has given us data, tell us and it will be deleted.

9. Security, stated concretely

• HTTPS everywhere, including the API and the question-pack CDN.
• Passwords do not exist - sign-in is verification codes and platform identity, so there is no password store to leak.
• Refresh tokens are hashed at rest and rotated; a reused token is rejected.
• Admin access is a separate path behind its own identity check and an email allowlist, and every write is recorded in an audit log.
• The official answer key for a mock exam is never sent to your device before you submit.
• Backups run daily and restoration has been practised, not just configured.

No system is perfectly secure. If a breach ever affects your data, you will be told what happened and what we did, rather than reading about it in a status page.

10. International transfers

Infrastructure is operated in Cloudflare's global network with primary data in the United States. If you use the service from elsewhere, your data is processed there. We rely on the provider's own compliance mechanisms rather than pretending we invented one.

11. Changes to this policy

Material changes get a dated revision here and, where they affect what we collect, a note in the app on next launch. Continuing to use ASVAB Pilot after that is acceptance; if you do not agree, deleting your account is the right move and takes one tap.

Related: Terms of Use. Official test and eligibility questions are answered by the services that run the ASVAB, not by ASVAB Pilot - https://asvabpilot.com is an independent study product.