Privacy Policy

Cytross Nursing (“Cytross Nursing”, “we”, “us”, or “our”) is an adaptive NCLEX-RN® exam-preparation web application, operated by Swipesoft, which is the data controller for the personal data described here. The service provides an adaptive practice and exam engine, social study features (friends, duels, and squads), a saved-Notebook Library, and subscription-share referrals.

This Privacy Policy explains what personal data we collect when you use the service, why we collect it, who we share it with, how long we keep it, and the rights you have over it. The service is delivered as an API with a single-page web application (SPA) front end; where the technical design of the service affects your privacy (for example, how we store passwords or handle your study history), we describe it plainly below.

This policy covers the Cytross Nursing application and its supporting API. It does not cover any third-party website that may link to or from our service.

We collect the following categories of personal data. We collect most of it directly from you when you register and use the service; some is generated by the service as you study.

2.1 Account and identity data

• Email address — collected at registration, used to sign you in, to verify your account, and to send transactional email (see Section 3). Your email is private to your account; it is never exposed to other users.
• Username (public handle) — this is a public identifier. Other users can search for your handle to send you a friend request, so please do not put personal information you wish to keep private into it. We store a normalised (case-folded) form for search and uniqueness and keep your original casing for display.
• Password— we never store your password in plaintext. Passwords are hashed with the argon2id algorithm and additionally protected with a secret “pepper” held outside the database, so that even a copy of our database would not reveal usable passwords. We only ever store this irreversible hash.
• Optional security data — if you enable two-factor authentication (MFA), we store the secret needed to verify your authenticator codes.

2.2 Study and learning data

• Response and study data — the questions you are served, your answers, timing, whether items are correct, and your practice and exam session records.
• Adaptive ability estimates (“learner state”) — the service maintains a statistical model of your ability across nursing topics, which it updates as you answer questions. This is what powers adaptive item selection, your progress report, readiness band, and review queue.
• Saved Notebooks— the Deep Review Notebooks you bookmark to your Library, together with a snapshot of each Notebook’s topic/domain/system for display.
• Flagged items — when you report a problem with a question (for example an unclear rationale or a suspected wrong answer key), we store the item identifier, your report text, and who reported it, as content-quality-assurance input.

2.3 Social and referral data

• Friend, duel, and squad relationships — records of your friendships and the head-to-head duels and squad contests you take part in.
• Referral / subscription-share relationships — when you invite someone or are invited via a subscription-share link, we store the relationship and an associated share percentage (share_pct). Invite links are stored only as a hashed token, never as the raw link.

2.4 Technical data

• IP address — used for security and rate-limiting. Question-bank anti-harvesting caps are keyed to your account when you are signed in; your IP address is used only on pre-login routes (login, registration, password reset) to throttle repeated attempts, and it is recorded in the security audit log described below.
• Security audit log — we keep an append-only log of security-relevant events (for example logins, token rotation, and password changes), which may include the associated account identifier and IP address.

2.5 The identity / behavioural split

By design, we keep your identity (email, password hash, MFA secret) separate from your behavioural data (your study responses and ability estimates). Your behavioural data is keyed to a separate pseudonymous identifier (pseudonym_id) that is generated independently of your account identifier. This means that when an identity is deleted, the associated study history can be left in an anonymous form rather than tied to you. See Section 8 (Data retention).

2.6 Cookies

We use a strictly-necessary authentication cookie only. See Section 11.

We use your personal data to:

• Provide the service — authenticate you, run adaptive practice and exams, compute your progress, readiness band, and review queue, and operate the social and library features.
• Send transactional email — account verification, password reset, security notices (such as a password-change confirmation), and activity notifications (such as practice and exam results, friend requests, and duel/squad invites). We send this email through Amazon SES. We do not send marketing email and we do not sell or rent email lists. Email verification uses double opt-in: you confirm your address before your account is fully enabled, and we suppress sending to addresses that hard-bounce or register a complaint.
• Keep the service secure — rate-limiting, abuse prevention, protecting the proprietary question bank from automated harvesting, and maintaining the security audit log.
• Improve the learning engine — study responses (in the anonymised, pseudonym-keyed form described above) inform the adaptive engine and its training pool.
• Comply with our legal obligations and enforce our Terms of Service.

We do not use your personal data for automated decision-making that produces a legal or similarly significant effect on you. The engine’s ability estimates decide which question you are shown next; they decide nothing about you outside the service.

Where the EU/UK General Data Protection Regulation applies, we rely on the following legal bases:

• Performance of a contract (Art. 6(1)(b)) — to create and operate your account and deliver the practice/exam, social, and library features you sign up for, and to send the transactional email needed to run the service.
• Legitimate interests (Art. 6(1)(f)) — to keep the service secure, prevent abuse, protect our question bank from harvesting, and improve the learning engine. We balance these interests against your rights and use pseudonymised data for engine improvement wherever possible.
• Consent (Art. 6(1)(a)) — where we ask for it (for example, any optional processing we may introduce). You can withdraw consent at any time.
• Compliance with a legal obligation (Art. 6(1)(c)) — where we must process data to meet a legal requirement.

We do notsell your personal data. We share it only with the service providers (“subprocessors”) that we rely on to run the service, and only as needed for them to perform their function. Our current subprocessors are:

Application hosting is in the same European region as the primary data store. If we move hosting, storage, or email delivery to another region, we will update this table and the effective date above before the move takes effect.

We have the ability to enable Sentry for error and performance monitoring, but it is not enabled: no error data, and therefore no personal data, is sent to it. If we turn it on, we will add it to the table above and update the effective date.

We may also disclose personal data where required to do so by law, to comply with legal process, or to protect the rights, property, or safety of Cytross Nursing, our users, or others. If Swipesoft is ever involved in a merger, acquisition, or sale of assets, personal data may be transferred as part of that transaction; we will tell you before it happens and before any new controller applies a different policy to it.

Our primary data store, application hosting, and email delivery are in the European Union (Atlas and SES in the eu-north-1 region). Cloudflare provides DNS and edge protection and, by the nature of a content delivery network, routes requests through the point of presence nearest to you, which may be outside the EU.

Where personal data is transferred outside the European Economic Area, we rely on the European Commission’s Standard Contractual Clauses, which form part of our agreement with each subprocessor, together with the technical measures described in Section 7 — principally that traffic is encrypted in transit and that authentication secrets are stored only as irreversible hashes. If you are outside the EU, your data is processed in the EU, and the same safeguards apply in reverse.

We take the following measures to protect your data:

• Password protection — argon2id hashing with a secret pepper stored outside the database; passwords are never stored or logged in plaintext.
• Session security — short-lived (10-minute) JSON Web Token access tokens held only in memory by the app, plus long-lived, opaque refresh tokens that are single-use, rotated on each use, and revocable; only a hash of each refresh token is stored, so a database copy would not yield usable sessions. Detecting a reused refresh token causes the whole token family to be revoked.
• Encryption in transit — traffic is served over TLS.
• Rate limiting and abuse controls — to defend against credential stuffing, automated harvesting of the question bank, and other abuse.
• Optional two-factor authentication (MFA) for accounts that enable it.
• Least-exposure design — sensitive tokens (email verification, password reset, and invites) are stored only as hashes, not as raw values.

If we become aware of a personal-data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours of becoming aware of it, and we will notify you directly where the law requires it.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

We keep your personal data for as long as your account is active and as needed to provide the service. The specific periods are:

• Account and study data — kept while your account exists. Deleting your account removes it as described below.
• Session credentials — access tokens expire after 10 minutes. A refresh token expires 14 days after it was last used and, in any case, 90 days after it was first issued; expired rows are removed automatically.
• One-time links — a password-reset link expires after 1 hour and an email-verification link after 24 hours. Both are stored only as a hash and are removed automatically once expired.
• Erase-your-history— the service provides an “erase history” feature in Settings → Data & privacy. When you use it, your ability state and full response log are moved to an inactive archive bucket and your learner profile is reset to a fresh state, so your study history is no longer associated with your active profile. Archived responses may be retained indefinitely in anonymised form as part of the engine’s training pool.
• Account deletion — deleting your account removes your identity document, your authentication artefacts, your live learner state, your sessions, your friendships, your invites, and your saved Notebooks; anonymises the archived research bucket; keeps your behavioural responses and any settled matches in an anonymous, scrubbed form; and signs you out everywhere. It takes effect immediately, it is irreversible, and neither you nor we can undo it.
• Flagged items— reports you submit about questions are deliberately not keyed to your erasable pseudonym, because they are about the item’s quality; they may be retained as content-QA input even after you erase your history or delete your account.
• Security audit log — append-only and kept without an automatic expiry, because its value is being able to reconstruct a security incident long after it happened. An entry references an account identifier and may include an IP address; once the identity that identifier pointed to has been deleted, the entry no longer resolves to a person.
• Email suppression list — addresses that hard-bounce or complain are retained on a suppression list for as long as we send email, so that we do not send to them again. This is a deliberate exception to deletion: removing an address from the list would restart mail to someone who asked for it to stop.

Depending on your jurisdiction (including under the GDPR/UK GDPR), you may have the right to:

• Access the personal data we hold about you. Much of it is already on screen: your answers and their marking in History, and your mastery estimates on the dashboard.
• Correct inaccurate or incomplete data (you can update much of your profile in the app).
• Delete / erase your data. Both controls are self-service and immediate, in Settings → Data & privacy: “erase history” resets your study record, and “delete account” removes your identity as described in Section 8. Deleting your account re-authenticates you with your current password first, and asks you to type the word DELETE, because it cannot be undone.
• Port your data — receive certain data in a structured, machine-readable format.
• Object to or restrict certain processing, including processing based on legitimate interests.
• Withdraw consent where processing is based on consent.
• Lodge a complaint with your local data protection authority.

To exercise any of these rights, use the in-app controls above where they exist, or contact us at support@cytross.com. We will respond within one month, and will tell you if we need longer where the law allows it. We may need to verify your identity before acting on a request, and we do not charge for any of this.

The service is intended for adults and nursing students preparing for a professional licensing examination. It is not directed to children and is not intended for anyone under the age of 16 (or under 13 where a lower threshold applies). We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us at support@cytross.com and we will delete it.

The service is an API with a single-page web application, and it uses a minimal set of cookies. Specifically, we set one strictly-necessary authentication cookie — the refresh-token cookie — which is:

• HttpOnly (not readable by page scripts),
• Secure (sent only over HTTPS),
• SameSite=Strict, and
• scoped narrowly to the token-refresh endpoint so it is not sent on ordinary requests.

This cookie is essential to keep you signed in securely and cannot be switched off if you wish to use the service. Because it is strictly necessary, no consent banner is required for it — and there is nothing else to consent to. We do not set advertising cookies, and we do not use third-party analytics or tracking cookies.

We may update this Privacy Policy from time to time. When we make material changes, we will update the “Effective date” above and, where appropriate, notify you through the service or by email. Your continued use of the service after an update takes effect constitutes acceptance of the revised policy.

If you have questions about this policy or how we handle your data, contact us at:

• Data controller: Swipesoft, operator of Cytross Nursing
• Email: support@cytross.com
• Written notice: we do not operate a public office. Write to the email address above; if you need to correspond by post, ask there and we will provide a service address.

If you are in the EEA or the UK and are not satisfied with our response, you may complain to the data protection authority in the country where you live or work.