Data minimization
Anonymous practice is available without an account. If an account is created, the planned data is limited to authentication identifiers, username, preferences, study progress, attempts, bookmarks, entitlements, and necessary security records. TestNorth does not need government identification numbers.
Local storage and consent
Guest progress and privacy choices can be stored on the device. Essential storage supports the service; analytics, advertising, and preference categories are controlled separately. Optional scripts must wait for the applicable choice.
Accounts and rights
The architecture includes secure data export, correction, session revocation, and account deletion workflows. Retention periods and lawful exceptions will be documented and configurable.
Service providers
Planned providers include Supabase for database and authentication, Vercel and possibly Render for hosting, and Stripe for hosted payment processing. Final production disclosures will identify configured providers and purposes.