/privacy · legal
PrivacyPolicy.
Jump to section · 12 sections
What we collect
You give us
- Email address (account).
- Name (optional).
- Practice submissions: written answers, voice recordings, multiple-choice responses.
- Payment info — processed by Stripe and RevenueCat. We never see your card number.
We collect automatically
- Device type, operating system, app version.
- Usage analytics — which features, how long, when.
- IP address — security and approximate geolocation.
- Crash reports.
How we use it
- Run your account.
- Grade your practice and predict your CLB score.
- Improve clbpass — find what works, see where users get stuck.
- Send transactional email (receipts, password resets).
- Send marketing email — opt-in only.
- Prevent fraud and abuse.
- Meet legal obligations.
Who we share with
Third-party processors who handle data on our behalf. Each has its own privacy commitments. We pick ones that handle data responsibly.
Stripe
web payments
RevenueCat
subscriptions
Loops
email
Vercel
website hosting
Apple · Google
distribution + IAP
Anthropic
AI grading
PostHog
analytics
Sentry
error monitoring
We do not sell your personal data. Ever.
AI grading & your submissions
When you submit a practice answer for AI grading, the text or audio is sent to our AI provider (currently Anthropic) for analysis. They do not retain it for training general-purpose models without explicit consent.
We may use anonymized, aggregated practice data to improve clbpass — for example, noticing 70% of users miss a grammar rule and adjusting drills accordingly. Aggregate data cannot be linked back to you.
You can delete individual practice submissions at any time from your account. Deletion is permanent within 30 days.
Your rights
Wherever you live, you can:
- Ask what data we have about you.
- Ask us to correct inaccurate data.
- Ask us to delete your account.
- Export your data in a portable format.
- Withdraw consent for marketing emails.
Data retention
- Account data
- Until you delete it
- Practice submissions
- Until you delete them or your account
- Payment records
- 7 years (Canadian tax law)
- Anonymized analytics
- Indefinitely (no longer linked to you)
Children
clbpass is for users 18 and over. We don't knowingly collect data from anyone younger. If we learn we have, we delete it.
Security
Industry-standard encryption — HTTPS everywhere, encrypted databases at rest, hashed passwords. No system is perfectly secure, but we take this seriously. If a breach affects you, we'll notify you and the relevant authorities promptly.
International transfers
clbpass is operated from Canada. If you use it from elsewhere, your data is transferred to Canada and to countries where our processors operate — primarily the United States for Stripe, Anthropic, and similar.
Transfers happen under standard contractual clauses and the processors' own compliance frameworks.
Cookies
Our website uses minimal cookies:
- Essential — login, security, session state.
- Analytics — anonymized and privacy-conscious.
No third-party advertising or cross-site tracking cookies. Where required, a consent banner appears.
Changes
We may update this policy. Material changes get an email notice. The version posted with the latest date at the top is always current.
Contact
founder@clbpass.comclbpass, Toronto, Ontario, Canada