This privacy policy explains what data CivicsPath collects, why we collect it, who we share it with, and how you can control or delete it. We try to keep this short and honest. If something here is unclear, email us at hello@civicspath.app and we'll explain or fix it.
What we collect
When you visit the marketing website
- No analytics run by default. Until you make a choice in the cookie banner, we collect nothing about your visit.
- If you accept the cookie banner: Google Analytics 4 (GA4), loaded through Google Tag Manager, used to understand which pages people read and which channels bring visitors. GA4 drops browser cookies. You can decline on first visit and we honor it.
When you sign up for a study account
- Email address (or Google account identifier if you sign in with Google). used for authentication and to send essential service emails
- Study activity, flashcard reviews, mock interview transcripts, readiness scores, used to personalize your study sessions and compute your readiness
- Optional N-400 biographical answers, when you start a mock interview, we ask permission to capture your answers from your N-400. This data is encrypted at rest with a passphrase you control. We cannot read it without your passphrase.
When you subscribe
- Stripe handles all payment processing. We never see your full card number. We do receive: your email, the last 4 digits of your card, your billing country, and your subscription status.
- When your subscription starts or ends, our server sends a record of that event to Google Analytics 4 (GA4) using the GA4 Measurement Protocol. This sends your hashed email (one-way SHA-256, not reversible), an internal user identifier, the subscription amount, and the currency. This is a first-party financial signal and runs regardless of your cookie banner choice, you can decline GA4 browser cookies and the server-side record still fires. We do this so we can measure paid conversions reliably (cookie-based tracking misses ~30% of paid conversions due to ad blockers).
How we use it
- To provide the study app: scheduling your flashcards, generating your readiness score, running your mock interviews
- To support you: replying to emails, fixing bugs you report
- To run the business: collecting payments via Stripe, sending essential service emails (subscription receipts, password resets, account deletion confirmations)
- To improve CivicsPath: if you accept the cookie banner, GA4 analytics (page views, drop-off points, conversion analysis). If you decline, no browser analytics run at all.
How we don't use it
- We do not sell user data. Ever.
- We do not share your N-400 biographical answers with anyone, including ourselves (we cannot read them, they're encrypted with your passphrase).
- We do not run targeted advertising inside the study app. Your study activity is not used to show you ads.
Cookies and tracking
The marketing website at www.civicspath.app uses these cookies and tracking technologies:
- Essential: your cookie-banner choice, stored in your browser's localStorage (
cp:consent-v1). It never leaves your device. - Optional (only if you accept the cookie banner): Google Analytics 4, loaded through Google Tag Manager, drops
_gaand related cookies for traffic and conversion measurement
The study app at study.civicspath.app uses:
- Essential: an authentication session cookie (HTTP-only, signed)
- An anonymous-user identification cookie (
civicspath-guest-id) issued before signup so we can sync your study state if you create an account later
You can decline non-essential cookies on first visit, change your choice anytime via the cookie banner, or block them with browser settings.
Your rights
You can:
- Access your data: sign in to study.civicspath.app and view your account
- Export your data: contact hello@civicspath.app for a JSON export of your study history
- Delete your account: email hello@civicspath.app from the address on your account. Deletion is permanent and removes all your data within 7 days.
- Opt out of marketing emails: email hello@civicspath.app and we will remove you within a few days
- Withdraw cookie consent: change your selection in the cookie banner anytime
If you live in California (CCPA), the EU (GDPR), or another jurisdiction with privacy rights, you have all the rights above plus any additional rights granted by local law. Email us to exercise them.
Data retention
- Active accounts: retained as long as your account is active
- Cancelled subscriptions: retained for 90 days after cancellation in case you reactivate, then automatically anonymized
- Deleted accounts: removed within 7 days
- Marketing analytics: aggregated indefinitely; individual cookie identifiers expire per the cookie's set lifetime
Third-party services
We use these vendors who may receive your data:
- Railway (application hosting and database)
- Stripe (payment processing)
- Anthropic (mock interview LLM. N-400 capture passes through here but is sent encrypted)
- ElevenLabs (audio playback for question pronunciation)
- Google: OAuth sign-in (only if you sign in with Google), Gmail SMTP for transactional email, and Google Analytics 4 via Google Tag Manager (only if you accept the cookie banner; subscription conversion events may also be sent server-side, as described above)
- Browser push services (Apple, Google, or Mozilla, only if you turn on push notifications)
We've reviewed each vendor's privacy practices. Email us if you'd like specific details on any of them.
Changes to this policy
If we make material changes, we'll email active subscribers and post a banner on the marketing site for 30 days. Routine clarifications and typo fixes don't trigger notification.
Contact
hello@civicspath.app , replies usually within 1 business day.
CivicsPath is a Grain of Salt company.