Privacy Policy

Cytross Nursing (“Cytross Nursing”, “we”, “us”, or “our”) is an adaptive NCLEX-RN® exam-preparation web application. It provides an adaptive practice and exam engine, social study features (friends, duels, and squads), a saved-notebook library, and subscription-share referrals.

This Privacy Policy explains what personal data we collect when you use the service, why we collect it, who we share it with, how long we keep it, and the rights you have over it. The service is delivered as an API with a single-page web application (SPA) front end; where the technical design of the service affects your privacy (for example, how we store passwords or handle your study history), we describe it plainly below.

This policy covers the Cytross Nursing application and its supporting API. It does not cover any third-party website that may link to or from our service.

We collect the following categories of personal data. We collect most of it directly from you when you register and use the service; some is generated by the service as you study.

2.1 Account and identity data

• Email address — collected at registration, used to sign you in, to verify your account, and to send transactional email (see Section 3). Your email is private to your account; it is never exposed to other users.
• Username (public handle) — this is a public identifier. Other users can search for your handle to send you a friend request, so please do not put personal information you wish to keep private into it. We store a normalised (case-folded) form for search and uniqueness and keep your original casing for display.
• Password— we never store your password in plaintext. Passwords are hashed with the argon2id algorithm and additionally protected with a secret “pepper” held outside the database, so that even a copy of our database would not reveal usable passwords. We only ever store this irreversible hash.
• Optional security data — if you enable two-factor authentication (MFA), we store the secret needed to verify your authenticator codes.

2.2 Study and learning data

• Response and study data — the questions you are served, your answers, timing, whether items are correct, and your practice and exam session records.
• Adaptive ability estimates (“learner state”) — the service maintains a statistical model of your ability across nursing topics, which it updates as you answer questions. This is what powers adaptive item selection, your progress report, readiness band, and review queue.
• Saved notebooks— the Deep Review lectures you bookmark to your library, together with a snapshot of each lecture’s topic/domain/system for display.
• Flagged items — when you report a problem with a question (for example an unclear rationale or a suspected wrong answer key), we store the item identifier, your report text, and who reported it, as content-quality-assurance input.

2.3 Social and referral data

• Friend, duel, and squad relationships — records of your friendships and the head-to-head duels and squad contests you take part in.
• Referral / subscription-share relationships — when you invite someone or are invited via a subscription-share link, we store the relationship and an associated share percentage (share_pct). Invite links are stored only as a hashed token, never as the raw link.

2.4 Technical data

• IP address — used for security and rate-limiting. Question-bank anti-harvesting caps are keyed to your account when you are signed in; your IP address is used only on pre-login routes (login, registration, password reset) to throttle repeated attempts, and it is recorded in the security audit log described below.
• Security audit log — we keep an append-only log of security-relevant events (for example logins, token rotation, and password changes), which may include the associated account identifier and IP address.

2.5 The identity / behavioural split

By design, we keep your identity (email, password hash, MFA secret) separate from your behavioural data (your study responses and ability estimates). Your behavioural data is keyed to a separate pseudonymous identifier (pseudonym_id) that is generated independently of your account identifier. This means that when an identity is deleted, the associated study history can be left in an anonymous form rather than tied to you. See Section 8 (Data retention).

2.6 Cookies

We use a strictly-necessary authentication cookie only. See Section 11.

We use your personal data to:

• Provide the service — authenticate you, run adaptive practice and exams, compute your progress, readiness band, and review queue, and operate the social and library features.
• Send transactional email — account verification, password reset, security notices (such as a password-change confirmation), and activity notifications (such as practice and exam results, friend requests, and duel/squad invites). We send this email through Amazon SES. We do not send marketing email and we do not sell or rent email lists. Email verification uses double opt-in: you confirm your address before your account is fully enabled, and we suppress sending to addresses that hard-bounce or register a complaint.
• Keep the service secure — rate-limiting, abuse prevention, protecting the proprietary question bank from automated harvesting, and maintaining the security audit log.
• Improve the learning engine — study responses (in the anonymised, pseudonym-keyed form described above) inform the adaptive engine and its training pool.
• Comply with our legal obligations and enforce our Terms of Service.

Where the EU/UK General Data Protection Regulation applies, we rely on the following legal bases:

• Performance of a contract (Art. 6(1)(b)) — to create and operate your account and deliver the practice/exam, social, and library features you sign up for, and to send the transactional email needed to run the service.
• Legitimate interests (Art. 6(1)(f)) — to keep the service secure, prevent abuse, protect our question bank from harvesting, and improve the learning engine. We balance these interests against your rights and use pseudonymised data for engine improvement wherever possible.
• Consent (Art. 6(1)(a)) — where we ask for it (for example, any optional processing we may introduce). You can withdraw consent at any time.
• Compliance with a legal obligation (Art. 6(1)(c)) — where we must process data to meet a legal requirement.

We do notsell your personal data. We share it only with the service providers (“subprocessors”) that we rely on to run the service, and only as needed for them to perform their function. Our current subprocessors are:

Sentry error tracking is optional and is only active if configured for a given deployment; when it is not enabled, no data is sent to it.

We may also disclose personal data where required to do so by law, to comply with legal process, or to protect the rights, property, or safety of Cytross Nursing, our users, or others.

Our primary data store and email delivery are hosted in the European Union (Atlas and SES in the eu-north-1region). Depending on the configuration of a given deployment, some subprocessors (such as hosting or monitoring) may process data in the United States or route it through a global edge network. Where personal data is transferred outside your jurisdiction, we rely on appropriate safeguards for such transfers (for example, the European Commission’s Standard Contractual Clauses). [Confirm the specific transfer mechanism and processing locations with counsel.]

We take the following measures to protect your data:

• Password protection — argon2id hashing with a secret pepper stored outside the database; passwords are never stored or logged in plaintext.
• Session security — short-lived (10-minute) JSON Web Token access tokens held only in memory by the app, plus long-lived, opaque refresh tokens that are single-use, rotated on each use, and revocable; only a hash of each refresh token is stored, so a database copy would not yield usable sessions. Detecting a reused refresh token causes the whole token family to be revoked.
• Encryption in transit — traffic is served over TLS.
• Rate limiting and abuse controls — to defend against credential stuffing, automated harvesting of the question bank, and other abuse.
• Optional two-factor authentication (MFA) for accounts that enable it.
• Least-exposure design — sensitive tokens (email verification, password reset, and invites) are stored only as hashes, not as raw values.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

We keep your personal data for as long as your account is active and as needed to provide the service.

• Erase-your-history— the service provides an “erase history” feature. When you use it, your ability state and full response log are moved to an inactive archive bucket and your learner profile is reset to a fresh state, so your study history is no longer associated with your active profile. Archived responses may be retained in anonymised form as part of the engine’s training pool.
• Account deletion — because of the identity/behavioural split described in Section 2.5, deleting your identity (email, password hash, and related account fields) can be performed while leaving your past study responses in an anonymous, non-identifying form. [Confirm the exact deletion workflow and any operational retention windows.]
• Flagged items— reports you submit about questions are deliberately not keyed to your erasable pseudonym, because they are about the item’s quality; they may be retained as content-QA input even after you erase your history.
• Security audit log — retained for a period appropriate to security and fraud-prevention purposes.
• Email suppression list — addresses that hard-bounce or complain are retained on a suppression list so we do not send to them again.

[Confirm specific retention periods with counsel.]

Depending on your jurisdiction (including under the GDPR/UK GDPR), you may have the right to:

• Access the personal data we hold about you.
• Correct inaccurate or incomplete data (you can update much of your profile in the app).
• Delete / erase your data — reset your study history at any time with the in-app erase-history feature, and request deletion of your account and identity data by contacting us (see Section 8). [Self-service account deletion is being added; until then, deletion requests are handled manually.]
• Port your data — receive certain data in a structured, machine-readable format.
• Object to or restrict certain processing, including processing based on legitimate interests.
• Withdraw consent where processing is based on consent.
• Lodge a complaint with your local data protection authority.

To exercise any of these rights, use the relevant in-app controls where available or contact us at [Contact email, e.g. privacy@cytross.com]. We will respond within the time required by applicable law. We may need to verify your identity before acting on a request.

The service is intended for adults and nursing students preparing for a professional licensing examination. It is not directed to children and is not intended for anyone under the age of 16 (or under 13 where a lower threshold applies). We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it.

The service is an API with a single-page web application, and it uses a minimal set of cookies. Specifically, we set one strictly-necessary authentication cookie — the refresh-token cookie — which is:

• HttpOnly (not readable by page scripts),
• Secure (sent only over HTTPS),
• SameSite=Strict, and
• scoped narrowly to the token-refresh endpoint so it is not sent on ordinary requests.

This cookie is essential to keep you signed in securely and cannot be switched off if you wish to use the service. We do not set advertising cookies, and we do not use third-party analytics or tracking cookies.

We may update this Privacy Policy from time to time. When we make material changes, we will update the “Effective date” above and, where appropriate, notify you through the service or by email. Your continued use of the service after an update takes effect constitutes acceptance of the revised policy.

If you have questions about this policy or how we handle your data, contact us at:

• Email: [Contact email, e.g. privacy@cytross.com]
• Postal address: [Company address]
• Data controller: [Legal entity name]