Privacy policy
Last updated 17 October 2026.
CertCrafter is operated by an India-based limited-liability business. This policy explains the limited information used to provide online practice-test access and support.
Information we receive
Dodo Payments notifies us of your purchase and provides your email address, the product bought, the payment status and transaction identifiers. CertCrafter stores that purchase record, together with the email address for your account and, if you choose to set one, a password hash, in order to verify entitlement, provide support, prevent abuse, process refunds and maintain service security. Passwords are stored only as salted PBKDF2 hashes, never in a readable form. We do not receive or store payment-card numbers.
Accounts and sessions
When you sign in, the server places a random session identifier in an HTTP-only cookie. The cookie holds no personal information and no entitlement data. Your access is looked up from your purchase record on each request, so a refund removes access immediately. Sessions expire after 30 days of inactivity and can be ended at any time by signing out, which revokes that session on the server. Password-reset links are single-use and expire after two hours.
Sign-in links
You can sign in by asking us to email you a link instead of using a password. We use your email address for this for one purpose only: signing you in. If no account exists for the address, asking for a link creates one, with no password, so that a purchase made with that address can be matched to it. Buying from us does the same, and the purchase receipt contains a sign-in link.
For each link we store a one-way hash of it (never the link itself), the email address it was sent to, when it was requested, when it expires, when it was used, the page to return you to afterwards, and a one-way hash of a short-lived browser cookie. Sign-in links expire after 15 minutes; the link in a purchase receipt expires after 7 days. Each works once.
The cookie, named certcrafter_link, is set on the browser that asked for the link and lasts about 20 minutes. It holds a random value and nothing about you. Its only job is to recognise that browser when the link is opened: from the same browser you are signed in straight away; from anywhere else — or from a purchase receipt — we ask you to confirm first, so a forwarded link cannot sign someone in without them knowing. It is strictly necessary for that and is not used for anything else.
Using a link records that your email address has been confirmed, and the date. We keep a security log of every link sent and used, with the time and the requesting IP address, to investigate misuse. Link records are deleted 30 days after they expire. An account created by asking for a link that is never used, and with no purchase, is deleted after 7 days.
Signing in with Google, Microsoft, LinkedIn or Facebook
If you choose "Sign in with Google", "Sign in with Microsoft", "Sign in with LinkedIn" or "Continue with Facebook", that provider asks your permission and then tells us who you are. We ask only for the basic sign-in scopes (openid, email and profile; for Facebook, email and public_profile) — never access to your mail, files, contacts, connections, posts or calendar, and we never post on your behalf.
What we receive. From Google: a permanent identifier for your Google account, your email address and whether Google has verified it, your name, and the web address of your profile picture. From Microsoft: a permanent identifier for your Microsoft account, the identifier of the organisation it belongs to, your name and username, and — if Microsoft provides one — your email address with an indication of whether its domain owner has verified it. From LinkedIn: a permanent identifier for your LinkedIn account, your name, the web address of your profile picture, and — if LinkedIn provides them — your email address and whether LinkedIn has verified it. From Facebook: an identifier for your Facebook account that is specific to CertCrafter, your name, and your email address if your Facebook account has one and you allow it; Facebook does not tell us whether that address has been verified, so we always treat it as unverified.
What we keep, and why. Only four things: which provider it was, its identifier for you (so we recognise you next time, even if your email address changes), the email address it gave when you connected it, and when you connected it and last used it. We use the email address only to find or create your CertCrafter account. Your name and profile picture are not stored — they arrive with the sign-in and are discarded. We do not keep the provider's access tokens, so we cannot act on your account with that provider.
We only match a sign-in to an existing account when the provider confirms the email address is verified. When it does not — which includes most Microsoft accounts — we email a sign-in link to finish, and connect the provider only once that link is used in the same browser. Whenever a provider is connected to an existing account we email that account's address, with a link to disconnect it and sign out everywhere. You can see and disconnect providers on your account page. Google, Microsoft, LinkedIn and Facebook process your sign-in under their own privacy policies. If you remove CertCrafter from your Facebook settings and ask Facebook to delete your data, Facebook tells us and we delete the link between your Facebook account and your CertCrafter account; you get a confirmation code to check on our data deletion status page.
PMP Complete Exam Kit: sign-in and device logging
If you hold the PMP Complete Exam Kit (including through an earlier PMP purchase), we record more about your sessions than for our other products. When you sign in we store your IP address, your browser and device type and the time against that session. While you study we record which questions and pages you open, when, and how quickly one follows another. We use this only to enforce the one-person licence in our Terms (limit of two active sessions, spotting shared accounts) and to detect automated copying of the question bank. An account used on more than four devices in 30 days is flagged for us to review by hand; nothing is closed automatically. Our basis is our legitimate interest in protecting licensed content. Session and access logs are kept for up to 90 days, then deleted; the device list for your account is kept while your account is open. We do not sell this data. If you hold only our other products, none of this is recorded.
Test progress and activity
When you are signed in and working through a purchased test, we record your progress on our servers: which certification and test you are on, when you started and finished, how many questions you answered, your score, whether you passed, and how long you spent. We also record, per question, its identifier, the option you chose, whether it was correct, and whether you flagged it for review. This is what lets your progress survive a cleared browser or a change of device, and it is what we use — in aggregate — to see which questions are too hard, too easy or too often skipped, so the banks can be improved.
We never store the wording of a question, an answer option or an explanation against your account — only identifiers. Your email address is the only personal information attached to this record. We do not track you across other websites, we do not build advertising profiles from it, and it is never sold or shared. Aggregate figures — how many people started a test, average scores, pass rates — are visible to CertCrafter's administrator, as is the list of accounts and their progress, for support and for improving the product. Ask us at support@certcrafter.com to delete your progress record at any time; doing so does not affect your purchase or your access.
We also record when someone clicks a Buy button, with the certification and, if you are signed in at the time, your email address. This tells us how many people start a purchase and do not finish it. Payment itself happens on Dodo Payments' own checkout, which we cannot see into.
How we count visits
Each public page tells our own server that it was viewed: the page's address, any campaign tags in the link (utm_source, utm_medium, utm_campaign), and the site you came from. From that request we also note the country (as reported by our host, Vercel) and whether the device is a phone, tablet or computer. We add these to daily counters — "this page, from this source, in this country, on this kind of device, today: one more" — and keep nothing else about the visit. No cookie is set and nothing is stored in your browser.
To count each person once per day rather than once per page, we make a one-way hash of your IP address and browser identification together with the date and a secret that changes every day. The hashes are kept for two days only to recognise a second page view the same day, and each day's secret is deleted after two days, so neither we nor anyone else can later turn a stored value back into an address or connect your visits across days. Automated traffic — search engine crawlers, link previews, monitoring and headless browsers — is not counted. The free sample quiz also reports, without anything about you, that it was started or finished for a given certification.
This counting is separate from Google Analytics, described next.
Google Analytics
We use Google Analytics 4 to understand which pages are read and where visitors come from. Google Analytics sets cookies in your browser and sends Google the address of the page you are on (without anything after the "?" in it), the page you came from, your approximate location and device type, and how you move around the site. Your IP address is truncated before it is stored.
In the European Economic Area, the United Kingdom and Switzerland, Google Analytics does not set cookies or send identifiers: only anonymous, cookieless pings are sent under Google's Consent Mode. Elsewhere it runs by default, and you can opt out at any time with Google's opt-out add-on. Google Analytics never runs on the admin area or on any page whose address contains a sign-in, reset or disconnect link. Google processes this data under its own privacy policy.
Article feedback and comments
If you answer "Was this helpful?" under a blog post or guide, we store your yes or no, any note you add, the post, and the time. We do not ask who you are. To stop the same person voting twice in a day we keep the same kind of daily, one-way hash described above, deleted with its secret after two days. Notes are read by us and never published.
Comments on blog posts and guides require an account. We store the comment, the name you choose to show with it, your account and email address (never shown), the time, and our moderation decision. Comments are published only after a person has read them, and we email you when yours is published or, if it is not, which of the reasons in our review policy applied. Product reviews work the same way, with the details the review form asks for, including — only if you choose to give them — when you sat the real exam and how it went.
Emails we send, and marketing
Service emails — receipts, sign-in and password links, and messages about a practice test you own (for example that it has been updated) — are sent because they are part of the service you bought. They are not marketing and come whatever your preferences.
Marketing emails — new questions, exam-date reminders and offers — go only to people who ticked "Email me new questions, exam-date reminders and offers (unsubscribe anytime)", or to customers, about our similar certification practice tests, until they say no ("soft opt-in"). The box is never ticked for you. When you tick it we store the exact words, where you ticked it and when; if we cannot yet be sure the address is yours, we first email you a button to confirm and send nothing until you press it.
Every marketing email says why you are getting it, carries our company name and postal address, and has a one-click unsubscribe that needs no sign-in. You can also turn it off on your account page, or on the thank-you page after a purchase. Once you unsubscribe, or if an email to you bounces or you mark one as spam, we stop all marketing to that address and keep a record so it is never restarted by mistake. If you ask us to delete your marketing record, we delete your preferences and email history and keep only a one-way hash of the address on a do-not-email list. Emails are sent through Resend, which tells us whether each was delivered, bounced or reported as spam.
Free sample sign-up
To open a free sample quiz we ask for your first name, last name and email address, and we store them with the certification you tried, the page you were on, the exact notice shown beside the form, the time, and your result if you finish: the score, and for each question its exam domain and whether you got it right, so we can tell you which domains to work on first. If you choose to tell us the month of your exam, we store that too.
Beside the form, and again on the result screen, is a box that is never ticked for you: "Email me my score, study tips and offers for [the certification]. Unsubscribe anytime." If you do not tick it, we send you one email with your result and what to do next, with a button to ask for study tips, and nothing else. If you tick it, we first email you a link to confirm, and only after you confirm do we send a short series for that exam: your result the next morning, then emails on days 2, 5, 9 and 14. We store the exact words you agreed to, the certification, the page and the time. Customers also get a study check-in a week after buying and, two weeks later, a note about a closely related certification. Every one of these emails says why you are receiving it, carries our company name and postal address, and has a one-click unsubscribe that needs no sign-in. We send you at most one such email every three days, and they stop as soon as you buy that certification's practice material, unsubscribe, or an email to you bounces or is reported as spam.
These study emails record whether they were opened and which link was clicked (through our email provider, Resend), so we can see which emails help and which to change. Receipts, sign-in links and password emails are sent from a different address and are not tracked.
New-article emails
If you sign up with one of our newsletter forms (beside an article, in the box at the end of it, or in the small pop-up that appears once while you read), we store your first and last name, your email address, the words you agreed to ("Email me when CertCrafter publishes a new article or adds a new certification. At most one email a day; unsubscribe anytime."), the page you signed up on, and when. We send a welcome email straight away which says how to unsubscribe if it was not you who signed up. The pop-up is never shown again for 14 days once you close it, and never once you have subscribed. This list is separate from marketing: these emails list new articles and new certifications, never offers or discount codes, and at most one a day. Every one has a one-click unsubscribe that needs no sign-in. We never email an address that bounced or reported us as spam, and deleting your data removes you from this list too.
Refer a friend
Signed-in members can share a personal link to CertCrafter. The link carries a short code that stands for the member, not their name or email. When someone arrives through it, the code is kept in the same first-party cookie as an affiliate code (described below). If that person creates an account within 60 days, we record which member referred them, so the member can see how many friends joined. Members see only a number, never who joined or anything about their account.
Local progress data
Your browser may store test answers, timer progress, marked questions, scores, dates, and attempt history in local storage so you can resume on that browser. This data is not uploaded as part of the normal test flow. Clearing browser storage removes that local progress; it does not affect your account or your purchase.
Affiliate referral cookie
Some people reach CertCrafter through a link shared by an affiliate — a trainer, writer or community that recommends us and earns a commission on what they refer. When you arrive on a link carrying a ?ref= code, we store that code in a first-party cookie for 60 days so the right person is credited if you buy. The cookie contains only the affiliate's code. It is not used to advertise to you, it is not read by any other website, and it is not shared with the affiliate.
We also record that the click happened, together with the page you landed on, your browser's user-agent string, and a salted one-way hash of your IP address — never the address itself. The hash exists so that obvious click fraud (one machine clicking the same link hundreds of times) can be spotted; it cannot be reversed to identify you, and we do not use it for any other purpose. Affiliates never see it. What an affiliate can see about a sale they referred is the date, the product, the amount and the commission — not your email address, your name, or anything about your account or test results.
If you would rather not be counted, decline or delete cookies for this site before you buy, or remove the ?ref= part of the link before opening it. Nothing about the price you pay or the product you receive changes either way.
Advertising
CertCrafter shows no advertising and loads no advertising scripts or advertising cookies on any page.
Retention, providers, and choices
We retain purchase and support records only as needed for service operation, accounting, fraud prevention, dispute handling, and legal obligations. Dodo Payments (payments), Neon (database hosting), Resend (transactional email, including sign-in links), Google and Microsoft (only if you choose to sign in with them), Vercel (site hosting) and Google (analytics) may process information under their own policies. We do not sell personal information. Contact support@certcrafter.com for access, correction, deletion, or privacy questions, subject to applicable law and records we must retain.