Privacy Policy

At Roadexa ("we", "us", "our"), we take your privacy seriously. This Privacy Policy explains what information we collect when you use roadexa.com, how we use it, who we share it with, and the choices you have. By using Roadexa, you agree to the practices described below.

1. Information we collect

• Account data — name, email address, hashed password (we never store plain-text passwords), preferred language, and the date your account was created.
• Payment data — for paid lifetime access, payment details are collected and processed by our payment partner, Stripe, Inc. We receive only a transaction ID, payment status, and the last 4 digits of the card from Stripe — we never see or store your full card number, CVV, or expiry date.
• Usage data — which questions you attempted, your scores, and your selected U.S. state. This is used to power the progress indicators on your account page and to improve question quality.
• Technical data — your IP address, browser type, and device type, captured by our servers for security (e.g. blocking brute-force login attempts) and basic analytics.
• Translation feedback — if you submit a report about a translation, we store the language, question reference, and your comment. This is anonymous unless you are signed in, in which case we link it to your account.

2. How we use your information

• To create and operate your Roadexa account and grant access to the practice tests.
• To process payments for lifetime access and email you a receipt.
• To send transactional emails — account welcome, password reset, purchase confirmation. We do not send marketing emails.
• To improve question quality, fix translation issues, and prioritise the languages and states we invest in.
• To detect and prevent abuse, fraud, and security incidents.
• To comply with legal obligations and respond to lawful requests from authorities.

3. Payment security

All payments are processed by Stripe, Inc., a PCI-DSS Level 1 certified payment provider. Card details are entered directly on Stripe's servers — they never touch Roadexa's servers. Stripe's privacy practices are described at stripe.com/privacy.

4. Third parties

We share only the minimum information needed with these trusted service providers:

• Stripe — for processing payments (see section 3).
• Resend — for sending the transactional emails described in section 2. They see your email address, name, and the email body.
• Cloud hosting — our servers and databases are hosted on standard managed cloud infrastructure protected by industry-standard access controls and encryption at rest.

We do not sell, rent, or share your personal data with any third-party advertisers, data brokers, or marketing networks. Roadexa is funded entirely by the one-time $9.99 lifetime-access fee — we have no incentive to monetise your data.

5. Cookies & local storage

Roadexa uses two strictly necessary cookies for authentication (a secure, HTTP-only access cookie and a refresh cookie). We also store small amounts of non-sensitive data in your browser's localStorage — your selected state, language preference, and progress for guest users. We do not use third-party tracking cookies, advertising pixels, or cross-site fingerprinting.

6. Your rights

Depending on where you live, you may have the right to:

• Access the personal data we hold about you.
• Correct any inaccurate information in your account.
• Request deletion of your account and the personal data associated with it (note: anonymised aggregate usage statistics and required transaction records may be retained as required by law).
• Export a copy of the personal data we hold about you.
• Withdraw consent to processing where applicable.

To exercise any of these rights, email admin@roadexa.com from the address associated with your account. We respond within 30 days.

7. Data retention

We keep your account data for as long as your account is active. If you request deletion, your personal data is removed within 30 days, except for transaction records which we retain for 7 years to satisfy tax and accounting requirements.

8. Children

Roadexa is intended for users who are at least the minimum age to obtain a learner's permit in their U.S. state (typically 14–16). If you believe a child under 13 has provided personal data to us, email admin@roadexa.com and we will delete it.

9. International users

Roadexa is operated from the United States. If you access Roadexa from outside the U.S., you understand that your information may be transferred to, processed, and stored in the United States, which may have different data-protection laws than your home country.

10. Changes to this policy

If we make material changes, we will update the "Last updated" date at the top of this page and, where appropriate, notify you by email. Continued use of Roadexa after a change indicates acceptance of the revised policy.

11. Contact

Questions about this Privacy Policy? Email admin@roadexa.com. We respond within 1–2 business days.