PRIVACY POLICY
Last updated: August 22, 2026
This privacy policy explains how Zyra Labs LLC (“we,” “us,” or “our”) collects, uses, and protects your information when you use our Insurance Test Prep mobile application, website, and related services (collectively, the “Services”).
Questions? Contact us at contact@zyralabs.net
SUMMARY
| What We Collect | Why | Shared With |
|---|---|---|
| Email address | Account creation, magic link login | Firebase, Resend |
| Exam preferences | Personalize content | Firebase |
| Practice performance | Track your progress | Firebase, PostHog |
| Diagnostic responses and result | Score the free diagnostic locally, show topic insights, and present the web offer | Not shared; stays in your browser |
| Device push token | Send notifications you request | Firebase Cloud Messaging |
| Usage events | Improve the Services | PostHog |
| Subscription status | Unlock premium features | RevenueCat |
| Advertising and conversion data | Measure advertising, optimize campaigns, and show ads to previous visitors | Google Ads |
| Contact and support requests | Respond to your message | Airtable |
1. INFORMATION WE COLLECT
Information You Provide
Account Information:
- Email address (for registered accounts)
- Selected exam type and state/jurisdiction
- Planned exam date (optional)
Preferences:
- Daily reminder settings (time, enabled/disabled)
- Streak protection preference
- Theme preference (light/dark/system)
Web Funnel Information: If you visit our website or complete our onboarding quiz, we collect:
- Email address
- Quiz responses (exam selection, study preferences, goals)
Free Diagnostic Information: If you take a free exam diagnostic, we process:
- Your selected answers for scoring in your browser
- Your diagnostic score, knowledge-snapshot band, and broad topic strengths or gaps, which remain in the current page
- If you continue to account creation, a simple marker that enables the advertised web offer
Your diagnostic result is separate from the Knowledge Check and Readiness estimate created during signup. We do not use diagnostic answers to prefill or overwrite those onboarding answers.
Contact and Support Information: If you contact us through our website, we collect:
- Name
- Email address
- The contents of your message
Information Collected Automatically
Practice Data:
- Questions viewed, answered, skipped, or flagged
- Answer correctness and confidence level
- Learning state progression (new to mastered)
- Session duration and completion
Device Information:
- Device platform (iOS or Android)
- Operating system version
- Timezone (for scheduling reminders)
- Push notification token (if you enable notifications)
Usage Analytics:
- App screens and web pages viewed
- Feature interactions
- Onboarding completion
- Subscription events (paywall viewed, purchase completed)
Technical Data (Web):
- IP address (for rate limiting and security)
- Browser type and user agent
- Referring URL
Advertising and Attribution Data (Web): When you use our website or web application, we may collect:
- Google advertising cookies or similar online identifiers
- Google click identifiers, including GCLID, GBRAID, and WBRAID
- Advertising campaign, referral, and landing-page information
- Website, onboarding, checkout, and purchase events used to measure conversions or create remarketing audiences
- Conversion information, such as purchase time, value, currency, and transaction ID
- A normalized SHA-256 hash of your email address when Enhanced Conversions is enabled; we do not send your plaintext email address through that feature
Information We Do NOT Collect
- Precise location
- Contacts or calendar
- Photos, camera, or microphone
- Health or fitness data
- Browsing history outside our Services
- Payment card details (handled by Apple/Google/Stripe)
2. HOW WE USE YOUR INFORMATION
| Purpose | Data Used |
|---|---|
| Provide the Services | Email, exam preferences, practice data |
| Send magic link emails | Email address |
| Personalize your study plan | Exam selection, performance data |
| Score the free diagnostic and show its web offer | Locally stored diagnostic answers and result, browser offer marker |
| Send push notifications (if enabled) | Push token, preferences |
| Improve the Services | Usage analytics, practice patterns |
| Process subscriptions | User ID (shared with RevenueCat) |
| Prevent fraud and abuse | Account activity, IP address |
| Respond to contact and support requests | Name, email, message, account data |
| Send transactional emails | Email address |
| Measure advertising performance | Google click IDs, campaign data, conversion events, transaction information |
| Optimize advertising campaigns | Advertising attribution and conversion data |
| Show ads to previous website or web-app visitors | Advertising cookies or identifiers and website activity |
3. HOW WE SHARE YOUR INFORMATION
We disclose information to the following service providers and advertising providers for the purposes described below:
| Service | Purpose | Data Shared | Privacy Policy |
|---|---|---|---|
| Firebase (Google) | Authentication, database, push notifications, analytics | Email, profile, practice data, push tokens | Google Privacy Policy |
| PostHog | Product analytics | User ID, email, usage events, user properties | PostHog Privacy Policy |
| RevenueCat | Subscription management and diagnostic discount redemption | User ID, subscription status, offer identifier, discount code, purchase metadata | RevenueCat Privacy Policy |
| Resend | Email delivery | Email address | Resend Privacy Policy |
| Airtable | Contact and waitlist form storage | Name, email, message, form context | Airtable Privacy Policy |
| Apple/Google | Payment processing (mobile) | Payment handled by platform (we don’t receive payment details) | Platform privacy policies |
| Stripe | Payment processing (web) | Payment handled by Stripe via RevenueCat | Stripe Privacy Policy |
| Google Ads | Advertising measurement, campaign optimization, and remarketing | Advertising cookies or identifiers, Google click IDs, campaign and referral data, website and conversion events, transaction details, and, when enabled, hashed email | Google Privacy Policy |
Our advertising-data practices:
- We do not sell personal information for monetary payment.
- We do not share personal information with data brokers.
- We do not provide personal information to unaffiliated businesses for their own independent marketing.
- We may disclose identifiers and activity to Google to measure and optimize our advertising and to show our ads to people who previously visited our website or web application. Some US privacy laws may define this activity as “sharing” or “targeted advertising.”
We may disclose information if required by law or to protect our rights, safety, or property.
4. DATA STORAGE AND SECURITY
Where data is stored:
- Firebase servers in the United States
- PostHog servers in the United States
- Contact and waitlist submissions in Airtable
Security measures:
- Data encrypted in transit (HTTPS/TLS)
- Firebase security rules restrict access
- Authentication required for data access
- Rate limiting on authentication endpoints
- No sensitive payment data stored in our systems
Data retention:
- Account data: Retained while your account is active and for 30 days after deletion request
- Practice data: Retained while your account is active
- Push tokens: Removed when you disable notifications or delete your account
- Web funnel leads: Retained for 2 years or until you request deletion
- In-progress diagnostic answers: Kept only in the current browser tab and removed after completion, restart, or session expiration
- Completed diagnostic answers and result: Removed when you complete, restart, close, or refresh the page
- Diagnostic offer marker: Kept only in browser storage until purchase or until you clear site data
- Analytics data: Retained per PostHog’s standard retention (typically up to 7 years)
5. YOUR RIGHTS AND CHOICES
All Users
Notification preferences: Control daily reminders and streak alerts in App Settings.
Reset progress: Available in App Settings. This clears all your practice history, question statistics, and learning states while keeping your account.
Sign out: Removes local data from your device.
Advertising Choices
Third-party vendors, including Google, may show our ads on websites and services across the Internet. Google may use cookies or device identifiers to serve ads based on your previous visits to or use of our website or web application.
You can control or opt out of personalized advertising from Google through Google Ads Settings.
We recognize and honor the Global Privacy Control (GPC) opt-out preference signal when detected on the web. When GPC is enabled, we disable Google advertising storage, advertising user-data, and personalized-advertising signals for that browser so it is not used for our Google remarketing audiences. Browser-based choices generally apply only to the browser or device from which they are sent.
Account Deletion
You can delete your account and all associated data directly from within the app in Settings. Account deletion removes:
- Your profile and email from our systems
- All practice history and statistics
- Push notification tokens
- Web funnel lead data (if applicable)
Note: Your subscription (if any) is managed through Apple or Google. Deleting your account does not automatically cancel your subscription. Please cancel your subscription through your device’s settings before requesting account deletion.
For California Residents (CCPA/CPRA)
If you are a California resident, you have the right to:
- Know what personal information we collect, use, and disclose
- Delete your personal information
- Opt out of the sale or sharing of personal information, including processing for cross-context behavioral advertising
- Non-discrimination for exercising your privacy rights
- Correct inaccurate personal information
- Limit use of sensitive personal information (we do not collect sensitive personal information as defined by CPRA)
We do not sell personal information for monetary payment. Our use of Google Ads remarketing may be considered “sharing” under California law. We respond to and abide by the Global Privacy Control (GPC) opt-out preference signal as described above.
To exercise these rights, email us at contact@zyralabs.net. We will verify your identity before processing your request.
For Other US Residents
Several US states have enacted privacy laws granting similar rights (Virginia, Colorado, Connecticut, Utah, and others). If you are a resident of one of these states, you may have rights to access, delete, correct, and opt out of certain processing. Contact us at contact@zyralabs.net to exercise these rights.
6. PUSH NOTIFICATIONS
If you enable notifications, we collect your device’s push token and use Firebase Cloud Messaging to send:
- Daily study reminders
- Streak protection alerts
- Important account notifications
We also subscribe you to notification topics based on your profile (exam type, subscription status) to enable relevant communications.
To disable notifications:
- Turn off in App Settings, or
- Disable notifications for the app in your device’s system settings
7. CHILDREN’S PRIVACY
The Services are intended for users 18 years of age or older. We do not knowingly collect information from anyone under 18. If you believe someone under 18 has provided us personal information, contact us at contact@zyralabs.net and we will delete it promptly.
8. CHANGES TO THIS POLICY
We may update this policy from time to time. We will notify you of material changes by:
- Updating the “Last updated” date at the top
- Sending an in-app or email notification for significant changes
Your continued use of the Services after changes constitutes acceptance of the updated policy.
9. CONTACT US
Zyra Labs LLC 131 Continental Dr Suite 305 Newark, DE 19713 United States
Email: contact@zyralabs.net
10. APP STORE PRIVACY DISCLOSURES
The disclosures in this section apply specifically to our native mobile applications. The web advertising practices described above are separate unless expressly stated otherwise.
Apple App Privacy Details
| Data Type | Collected | Linked to Identity | Used for Tracking |
|---|---|---|---|
| Contact Info (Email) | Yes | Yes | No |
| Identifiers (User ID) | Yes | Yes | No |
| Usage Data (Product Interaction) | Yes | Yes | No |
| Identifiers (Device ID - push token only) | Yes | Yes | No |
| Diagnostics (Crash Data) | Yes | No | No |
| Diagnostics (Performance Data) | Yes | No | No |
Data used for: App Functionality, Analytics
Data NOT used for: Third-Party Advertising, Developer’s Advertising or Marketing, Tracking
Google Play Data Safety
| Question | Answer |
|---|---|
| Data collected | Email, User ID, App interactions, Crash logs, Performance diagnostics |
| Data shared | With service providers only (see Section 3) |
| Data encrypted in transit | Yes |
| Users can request data deletion | Yes (email contact@zyralabs.net) |
| Committed to Play Families Policy | No (app is for users 18+) |