Skip to content
Sterile Exam PrepSign in
← Back to home

Legal

Privacy Policy

Effective date: September 24, 2026

Version: 1.1

Privacy contact: sterileexamprep@outlook.com

This Privacy Policy explains how Sterile Exam Prep handles personal information when you visit our website, create an account, answer practice questions, buy a study plan, or contact us. It describes the service as currently built. We will update it if the live service or its providers change.

1. Who we are and what this policy covers

SterileExamPrep.com is an independent CRCST study service operated by Winnie Zou, based in the United States. Winnie Zou is the individual responsible for determining how personal information is handled through this service. For privacy questions, requests, or other inquiries, email sterileexamprep@outlook.com.

This policy covers information handled through our website, account and study features, purchases, and support. A service you visit through an external link may have its own privacy policy.

2. Information we collect

Account information. If you register, we collect your email address, an account identifier, and the information needed to authenticate you. Email-and-password sign-in is handled by Supabase Auth; we do not intentionally store your password in readable form in our application database. If you choose Google sign-in, we may receive your email address, name or display name, and other basic profile information made available through that sign-in process.

Study information. When you use account-based practice features, we record the questions and answer choices you submit, whether an answer was correct, quiz or review sessions, timestamps, and progress derived from those records. We use this information to show your history, domain performance, mistake review, and study feedback. Scores and readiness indicators are study estimates, not official exam results.

Purchase information. If you start or complete a purchase, we handle your account email, selected plan, product and transaction identifiers, access dates, payment status, and refund status. Waffo Pancake hosts the payment page and processes payment details. We receive payment and refund notifications from Waffo Pancake and retain the event records needed to grant access, investigate a transaction, and handle refunds. Those notifications may include customer or billing details supplied by Waffo Pancake. Your full card number and card security code are entered on Waffo Pancake's checkout page, not on our website.

Messages you send us. If you email support or contact us about a privacy request, we receive your email address, message, and any information you choose to include, such as an order reference or screenshots. Please do not send a full payment card number or other sensitive information we have not requested.

Technical information. When you use the site, our hosting, authentication, and payment providers may process your IP address, browser and device information, request time, pages requested, cookies, and error or security logs as needed to deliver and protect their services. The application code currently does not include a separate advertising pixel or third-party marketing analytics tool.

3. How we use information

We use the information above to create and secure accounts; authenticate users; provide free and paid practice; save answers and display progress; start and verify purchases; grant or revoke paid access; respond to support and refund requests; troubleshoot errors; prevent misuse or fraud; and meet applicable accounting, tax, and legal obligations.

Where a law requires us to identify a legal basis, these activities may be necessary to provide the service you request, comply with a legal obligation, or protect the security and integrity of the service. We will obtain separate consent where applicable law requires it for an optional activity.

We do not use your practice answers to make decisions about certification, employment, or eligibility for professional work.

4. Cookies and browser storage

We use authentication cookies managed through Supabase to keep you signed in and maintain your session. If you choose a dashboard section, a dashboard_view cookie remembers that choice for up to 30 days. You can clear these cookies in your browser, but removing authentication cookies will sign you out.

The 15-question practice set on the homepage keeps your answers in the page while you work and saves the completed result in your browser's session storage. That homepage result is not automatically added to your account. Browser session storage is normally cleared when the browser session ends; you can also clear it using your browser controls.

Waffo Pancake and Google may use their own cookies or similar technologies when you use their checkout or sign-in pages. Their policies govern those activities. The current application does not set advertising or marketing cookies. If we add optional analytics or advertising technologies later, we will update this policy and provide any choice or consent mechanism required by law.

5. Services that process information

  • Supabase provides account authentication and the database used for profiles, practice activity, access records, and payment event records.
  • Waffo Pancake provides hosted checkout and may handle billing details, payment methods, taxes, fraud checks, and refunds under its own privacy policy.
  • Google is involved only if you choose Google sign-in. Google's own privacy policy applies to your interaction with Google.
  • Vercel provides website hosting and related infrastructure. Vercel may process technical information in the locations described in its privacy notice.

We may also disclose information when required by law, to protect the security of the service or its users, or to establish or respond to a legal claim. We do not currently sell account or study information or share it with advertising partners for targeted advertising.

6. How long we keep information

Account-linked study sessions and answer records currently have no automatic expiration in the application database. They are retained while the account exists and until they are removed following a verified deletion request, subject to information we must retain for legal, security, or transaction reasons.

Purchase, refund, support, and payment event records are kept for as long as reasonably needed to provide access, resolve disputes, prevent fraud, and meet applicable accounting or legal requirements. We determine the retention period by considering the type and sensitivity of the information, the purpose for which it was collected, applicable limitation periods, and tax, accounting, security, and legal requirements. Deletion from active systems may not immediately remove copies in provider backups; those copies follow the provider's backup cycle and are not used for ordinary business purposes.

7. Your choices and privacy rights

You may use the public homepage practice without creating an account. You may choose whether to use Google sign-in or the hosted checkout. You can manage browser cookies and session storage through your browser settings, although some features may stop working if necessary authentication cookies are blocked.

Depending on the law that applies to you, you may be able to request access to or a copy of your personal information, correction of inaccurate information, deletion, or another applicable privacy right. Email sterileexamprep@outlook.com with the subject Privacy Request and tell us which account and request are involved. We may ask for information needed to verify that the request comes from you. We will respond in the period required by applicable law and explain any legal reason that prevents us from fulfilling a request in full.

Deleting an account does not automatically erase transaction records that we or Waffo Pancake must keep under applicable law. To ask about information handled independently by Google, Waffo Pancake, or another provider, you may also use that provider's privacy process.

8. Security and international processing

We use account access controls, restricted database permissions, and payment notifications that must be verified before paid access is granted. Our providers also apply their own security measures. No online service can guarantee absolute security.

Our providers may process information in the United States and in other countries or regions outside your place of residence. Where applicable law restricts an international transfer, we rely on safeguards or another transfer mechanism recognized by that law.

9. Children

The service is designed for adults preparing for professional certification. You must be at least 18 years old to create an account or purchase access. We do not knowingly collect personal information from children. If you believe a child has provided information to us, contact sterileexamprep@outlook.com so we can review the situation and take appropriate action.

10. Changes and contact

We may update this policy when the service, providers, or legal requirements change. The effective date at the top of the published version will show when it applies. If a change materially affects how we use personal information, we will provide additional notice where required by law. Publishing this policy alone is not a substitute for consent where separate consent is required.

Privacy and support: sterileexamprep@outlook.com

Operator: Winnie Zou, United States

Website: https://sterileexamprep.com