Privacy policy
Effective from October 17, 2026 · Last updated October 17, 2026
1. Scope
This policy explains how CertGrove (“we” or “us”) collects, uses and protects personal data when you use CertGrove, including the website, blog and study app.
2. Data we collect
| Data type | Examples | Source |
|---|---|---|
| Account | Name, email and profile picture | Provided by you, or by Google when you sign in with Google |
| Learning data | Completed lessons, flashcard results, practice and mock exam answers, error tags and study streaks | Generated when you use the Service |
| Imported content | Your CSV/JSON question sets | Uploaded by you |
| Technical | Device type, browser, IP address and error logs | Automatically when you visit |
| Communications | Blog newsletter email address and support messages | Provided by you |
When you sign in with Google, we request only basic profile information: name, email and profile picture. We do not access Gmail, Drive or other data in your Google account.
3. How we use data
- Create and manage accounts and enable sign-in.
- Save progress, schedule flashcard reviews, analyze weak domains and suggest study plans.
- Send account emails and blog newsletters if you subscribe.
- Protect security, detect abuse and fix errors.
- Improve content and features using aggregate usage statistics.
4. Basis for processing
We process data based on your consent when registering and using the Service, and as necessary to provide the features you request. You may withdraw consent at any time; some features may then stop working.
5. Cookies and browser storage
We use cookies and browser storage to maintain sign-in sessions and remember preferences such as light/dark mode and language. We use Google Analytics to measure traffic and page usage in aggregate. You can opt out with the Google Analytics Opt-out browser add-on or your browser’s tracking protection.
6. Data sharing
We do not sell personal data. Data is shared only with:
- Google — when you choose to sign in with Google.
- Infrastructure providers — to host and operate the Service: Cloudflare (website hosting and database) and Google Firebase (account authentication).
- Email services — to send account emails and newsletters: Google Firebase.
- Government authorities — when required by law.
7. International data transfers
Data may be stored on servers in the United States and other regions where Cloudflare and Google operate servers. When transferring data outside Vietnam, we comply with applicable Vietnamese personal data protection requirements.
8. Retention
Account and learning data is retained while your account is active. After you request account deletion, data is deleted within 30 days, except where longer retention is required by law.
9. Security
We apply appropriate technical and organizational safeguards, such as encryption in transit and restricted internal access. No system is completely secure; we will notify you as required if an incident affects you.
10. Your rights
Send requests to [email protected]. We respond within the time required by law.
11. Children
The Service is intended for people aged 16 or older. We do not knowingly collect data from people below this age; if discovered, we will delete it.
12. Updates and contact
When updating this policy, we will change the “Last updated” date and give advance notice of material changes.