Who is responsible
CertiBlank at certiblank.com is operated by Wael Demeri in Jordan, who is responsible for the personal data described here. Contact waeldemeri@gmail.com for privacy, deletion, or support requests. This policy covers the hosted service; independently hosted copies of the open-source project have their own operators.
Information we collect
- Account details: your name, email, account identifiers, and profile image if supplied. Email sign-up stores a password hash, not your readable password.
- Google or GitHub sign-in: the provider supplies identity information such as your name, email, image, and provider account ID. Authentication records may include provider tokens and their expiry details. We do not receive your Google or GitHub password.
- Practice activity: certification, practice mode, questions, answers, checked and flagged questions, current position, and attempt timestamps. Guest attempts use a browser identifier; signed-in attempts can belong to your account. Eligible guest attempts can carry over when you sign in on the same browser.
- Security and technical information: session identifiers, IP addresses, browser/user-agent information, authentication timestamps, rate-limit records, and operational error logs.
- Certification requests and messages: requested platform, certification name, and request time; plus anything you send by email. The request form does not ask for an account or email. Please do not put personal or sensitive information in certification names.
How we use information
We use this information to create and secure accounts, authenticate users, save and resume practice, show results and history, prevent abuse, investigate errors, respond to messages, and decide which certifications to add. Account information is optional for guest practice, but technical identifiers and saved attempts are still processed.
CertiBlank is currently free, with no advertising or third-party behavioral analytics. We do not sell personal data or use it for targeted advertising. This notice explains processing; it is not a request for blanket consent. Where applicable law requires consent, that consent must be obtained separately and can be withdrawn.
Cookies and browser storage
Authentication cookies keep you signed in. The guest ownership cookie associates this browser with its attempts and is configured for 30 days. Signed-in sessions are configured for seven days and may renew while you use the service. Temporary authentication state is also used during provider sign-in.
Local storage remembers your theme, keyboard-shortcut preference, and a cosmetic account-navigation hint. Session storage holds attempt pointers, pending progress, and temporary notices. These are functional features, not advertising trackers. You can clear them in browser settings; doing so can sign you out or remove access to guest progress. Clearing browser storage does not delete server records.
Providers and international processing
We use AWS to host the application and Supabase to host its PostgreSQL database. The current application server is in Sweden and the database is in Germany. The operator accesses the service from Jordan. Provider support, security operations, and any providers you choose for sign-in can involve other countries.
Google and GitHub process information when you choose their sign-in services, under their own privacy notices. Support email sent to our Gmail address is processed by Google. We share information with service providers as needed to operate these features, and may disclose it to meet lawful obligations or protect users and the service. Your private account and practice records are not part of the public source repository.
Retention and security
Account details and linked practice history are stored to support your account. Guest attempts, certification requests, and security records are also stored. There is currently no automatic age-based cleanup schedule for these database records; an expired session or exam timer does not mean its record has been deleted. You can request deletion using the contact below.
We use HTTPS, password hashing, and access controls to protect information. No system is completely secure. Deletion from active systems may not immediately remove provider backups; backup retention depends on the provider configuration. Records needed for a legal obligation or a specific security investigation may need to be retained, with the reason explained when applicable.
Your privacy choices
Email waeldemeri@gmail.com to request access or a copy of your data, correction, deletion, restriction, or to raise an objection or withdraw consent where applicable. These requests are handled manually. Tell us the account email or enough information to identify the relevant guest attempt; never send a password, session token, or provider token. We may need proportionate verification before releasing or deleting information.
Available rights and response deadlines depend on the law that applies to you. You can also raise a concern with the appropriate data-protection authority, including Jordan’s Personal Data Protection Unit. Contacting us first is not a requirement for making a complaint.
Younger users
CertiBlank is intended for people aged 13 and older, not children under 13. If you are under the age at which you can legally consent or agree to the service in your country, involve a parent or guardian and obtain any permission required by law before providing personal information. We do not currently verify age or parental permission. If you believe a child has provided information without the required permission, contact us so we can investigate and arrange appropriate removal.
Policy updates
We will update this page when our practices change and revise its date. Material changes will be highlighted on the service or communicated through an appropriate account notice; additional consent will be sought where required. Please contact us if any part of this policy is unclear.