Privacy Policy

This Privacy Policy describes how Aba Quizy ("we", "us", "our") collects, uses, and protects information when you use our exam-preparation platform for the Registered Behavior Technician (RBT), Board Certified Assistant Behavior Analyst (BCaBA), and Board Certified Behavior Analyst (BCBA) credentials issued by the Behavior Analyst Certification Board (BACB®). Aba Quizy is an independent study tool and is not affiliated with, endorsed by, or sponsored by the BACB.

By creating an account or using the service, you agree to the practices described here.

1. Information we collect

a. Account information

When you sign up we collect your email address, display name, and a Firebase Authentication identifier. Passwords are managed by Google Firebase Authentication; we never see or store them in plain text.

b. Profile and study data

We store the certification you are preparing for, your progress through tasks and flashcards, the questions you have attempted, the answers you submitted, your scores, and timing data. This is what powers your dashboard, analytics, and personalized question selection.

c. Integrity and anti-cheat signals

During quizzes and mock exams we record signals such as answer changes, tab-focus events, paste events, and other suspicious activity. We use these only to detect misuse of the platform (for example, account sharing or automated scraping) and to keep the practice environment fair for everyone.

d. Purchase data

When you buy a package, the payment itself is handled by Stripe. Aba Quizy never receives or stores your card number, CVC, or full bank details. We store the purchase identifier, the package you bought, the date, and the expiration date of your access.

e. Technical data

We log standard server data such as IP address, user agent, timestamps, and the API endpoints you call. This is used for security, abuse prevention, rate limiting, and debugging.

2. How we use your information

• Provide the exam-prep service, score your quizzes, and show your analytics.
• Personalize the questions and flashcards we surface based on your weak areas.
• Process your purchases through Stripe and grant you access to the packages you bought.
• Detect and prevent fraud, account sharing, scraping, and other misuse.
• Improve question quality, fix bugs, and design new study features.
• Send you transactional emails (account, purchase receipts, password resets). We do not send marketing emails without your consent.

3. Service providers we share with

We rely on a small set of trusted processors to operate the service. We share only the data each provider needs to do its job:

• Google Firebase — authentication, identity tokens, and authorized-domain enforcement.
• Stripe — payment processing for one-time package purchases. Stripe is PCI-DSS Level 1 certified.
• Amazon Web Services (AWS) — hosting of our application and database in the United States (us-east-1 region).
• AI providers — when our administrators generate new questions, flashcards, or tips, we may send anonymized prompts to AI model providers (such as OpenAI or Anthropic). We never send your personal study data or your individual answers to these providers.

We do not sell your data, and we do not share it with advertisers.

4. How long we keep your data

We keep your account and study data for as long as your account is active. If you delete your account, we remove your personal data within 30 days, except for limited records we are legally required to retain (such as invoices and tax records related to purchases) or that are essential to prevent abuse (such as anonymized fraud-detection signals).

5. Your rights

Depending on where you live (for example, the European Economic Area, the United Kingdom, California, or Brazil), you may have the right to:

• Access the personal data we hold about you.
• Correct inaccurate data.
• Delete your data (subject to the retention exceptions above).
• Export your data in a portable format.
• Object to certain types of processing.
• Withdraw consent at any time.

To exercise any of these rights, email us at abaquizy@gmail.com from the email address associated with your account.

6. Cookies and local storage

We use cookies and browser local storage only for what the service needs to run: keeping you signed in (Firebase Auth tokens), remembering your theme preference, and tracking quiz state inside an attempt. We do not use third-party advertising cookies or cross-site trackers.

7. Children

Aba Quizy is intended for adult learners pursuing professional BACB certifications. The service is not directed to children under 16, and we do not knowingly collect data from anyone under 16. If you believe a child has created an account, contact us and we will delete it.

8. International data transfers

Our servers are located in the United States. If you use the service from outside the US, your data will be transferred to and processed in the US. By using the service you consent to this transfer.

9. Security

We use HTTPS for all traffic, hash passwords through Firebase, store database credentials encrypted at rest, and restrict administrative access with role-based authorization. Correct answers and detailed explanations are never exposed to the client during a live quiz — all grading happens server-side. No system is perfectly secure, but we work to minimize risk.

10. Changes to this policy

We may update this Privacy Policy as the service evolves. When we make material changes, we will notify you by email and update the effective date at the top of this page. Continued use after the changes take effect means you accept the updated policy.

11. Contact

Questions about this Privacy Policy or about the data we hold? Reach us at abaquizy@gmail.com.