Privacy Policy

Effective date: March 16, 2026  ·  Last updated: September 11, 2026 (rev. 19)  ·  gcprep.app

1. Who We Are

GC Prep is a contractor exam study application available at gcprep.app. The application is operated by MasonByte LLC, a Maryland-based technology company. You can reach us at .

2. Information We Collect

We collect the following categories of information when you use GC Prep:

• Account information: When you sign in with Google or Facebook, we receive your email address and display name from that provider. We do not receive your password from either provider. You may also sign in with an email and password, which is stored securely in our authentication system (Supabase) and never transmitted in plain text.
• State-required course records (Virginia prelicense education): If you enroll in our Virginia prelicense education course and claim a completion certificate, we collect your legal name (including middle name and generation, if you have one), your mailing address, your date of birth, and your Virginia DMV control number. Virginia regulation 18VAC50-22-310 B requires an approved education provider to keep a record for each student that includes the student’s name and address and Virginia DMV control number, and to report course completions to the Board. We ask for this information only at the point you claim a certificate for that course, we use it only to identify you on that record and on the completion roster we provide to the Board, and we do not use it for marketing or disclose it to anyone else. If you do not take that course, we never ask for any of it. See Section 5 for how long these records are kept.
• Purchase information: When you purchase access, Stripe processes your payment. We receive a session ID and the product purchased from Stripe to confirm your entitlement. We do not store your credit card number, billing address, or any payment card data.
• Quiz activity: We store your quiz section scores, session history, and individual question results (correct or incorrect) in your account. This data is used to display your progress on the transcript page.
• Optional contact information: If you choose to add a backup email address or phone number in your profile settings, we store this to help you recover account access. This information is never shared with third parties or used for marketing.
• Gamification and progress: If you participate in the leaderboard (Honor Roll) or points system, we store your total points, current streak, and study time. Your display name on the leaderboard is derived from your sign-in account. You may opt out of gamification in your profile settings, which removes your data from the leaderboard.
• Compliance newsletter subscription: If you subscribe to our compliance digest, we store your email address and the states you selected. You may unsubscribe at any time via the link in any digest email or in your profile settings.
• Peer referral codes: If you share a referral link with another user or use one shared with you, we store the referral code, the referrer’s account ID, and the referee’s account ID for the purpose of attributing rewards. Referral metadata is removed if either party deletes their account.
• Usage data: We may collect general usage information such as which sections you access and how often, for the purpose of improving the application.

3. How We Use Your Information

• To authenticate your identity and maintain your session
• To verify your purchase and unlock the content you paid for
• To display your quiz history and progress across sections
• To send transactional emails related to your account (purchase confirmation, password reset)
• To create and keep the student record that Virginia requires of an approved prelicense education provider, and to report your course completion to the Board
• To improve the app and fix bugs
• To occasionally invite you to a brief in-app satisfaction micro-survey (NPS, less than 10 seconds). Survey responses are stored anonymously by user-bucket and are not linked back to your identity in analytics. You may dismiss without responding and may opt out of future surveys at any time in your Profile settings.
• To bucket your account into A/B test cohorts for in-app feature flags (e.g., interface variants under evaluation). Cohort assignment uses a deterministic hash of your account ID and is not personally identifying. Feature-flag exposure data is aggregated for product decisions only and is never shared with third parties.
• Issue completion certificates for study milestones, including certificates for the DPOR-approved six-hour Virginia pre-license education course for eligible Virginia users.
• Provide organizational managers with roster data (employee seat status, study hours, completion status) as authorized by your organization’s account agreement.
• Send optional study reminders, expiry alerts, and completion notifications (you may disable these in Profile settings).
• Send an automated welcome email sequence upon sign-up (Days 0, 3, and 7) with study tips, pricing details, and product information. You may opt out via the unsubscribe link in each email or in your Profile settings.

We do not use your information for advertising profiling, and we do not sell or rent your personal data to any third party.

4. How We Store Your Information

Your account data is stored in Supabase, a cloud database service with servers located in the United States (us-east-1 region). Supabase is SOC 2 compliant and encrypts data at rest and in transit. You can review Supabase's privacy practices at supabase.com/privacy.

Payment processing is handled entirely by Stripe, Inc. GC Prep never stores payment card data on its own servers. Stripe's privacy policy is available at stripe.com/privacy.

Authentication is handled by Google OAuth. Google's privacy policy is available at policies.google.com/privacy.

Facebook login is provided via Meta Platforms, Inc. Meta's privacy policy is available at facebook.com/privacy/policy.

Automated and transactional emails are delivered by Resend, Inc. Resend processes only your email address and message content for delivery purposes. Resend's privacy policy is available at resend.com/legal/privacy-policy.

Error monitoring and crash reporting is provided by Sentry. Sentry receives anonymized error stack traces, browser type, and the URL where an error occurred. Sentry does not receive your email address, name, or any personal identifiers — only technical diagnostic data needed to fix bugs. Sentry's privacy policy is available at sentry.io/privacy/.

Usage analytics are provided by Google Analytics 4. It receives page views and in-app events tied to a random identifier for your browser, never your name or email address; we configure it with ad personalization and Google signals switched off and restricted data processing switched on, and we use it only to understand how the app is used in aggregate. Google’s privacy policy is available at policies.google.com/privacy.

Our pages are hosted and served by Netlify, Inc., which keeps standard server logs (request URL, time, IP address) for a short period to operate the service. Netlify’s privacy policy is available at netlify.com/privacy. Cloudflare, Inc. provides a bot check on our partner form (Turnstile) and hides email addresses on our pages from scrapers; it receives the request needed to do that and nothing about your account. Cloudflare’s privacy policy is available at cloudflare.com/privacypolicy.

Your data of record — your account, purchases, activity and certificates — is stored in the United States. A feature that would share your information with a new company will be described here before it ships.

4a. Build Points and Virtual Game Currency

Build Points are an in-app gamification feature representing study progress, streak engagement, and section mastery. They are NOT real currency, are NOT tradeable for cash or goods, are NOT redeemable outside the app, and have NO monetary value. Earning, spending, or losing Build Points has no real-world financial consequence. The points system is a learning aid only.

GC Prep does not contain any gambling mechanics, loot boxes, or chance-based purchases. Build Points are awarded server-side based on verifiable user actions (correct answers, completed sections, daily streaks).

5. Data Retention

We retain your account data for as long as your account is active. If you request deletion of your account, we begin a 7-day soft-delete grace period during which you may reactivate. After 7 days, your personal data is permanently removed within 30 days, except where we are required to retain it for legal or business purposes (such as records of a completed purchase).

Gamification data (points, streaks, leaderboard scores) is retained as long as your account is active or until you request deletion. Organizational seat records are retained for up to 12 months after a seat expires for compliance audit purposes, then automatically purged.

Quiz session data is retained for the life of your account so that your progress history is available to you at any time.

We keep data for as long as the laws of the United States require, and otherwise no longer than the periods stated here. We are not obliged to keep anything beyond them. These periods may change when our policies or the way we run the service need them to; when they do, this page changes first, with a new date at the top. Records we keep for a licensing authority — completion certificates and continuing-education records — are kept for as long as that authority’s rules require, even after your account is deleted.

For our Virginia prelicense education course, 18VAC50-22-310 B requires an approved provider to keep each student’s record — name and address, Virginia DMV control number, the course name and clock hours attended, the instructor, and the date of successful completion — for a minimum of five years from the date you complete the course. We cannot shorten that period, and we cannot remove your name from those records during it, because the regulation requires the record to identify the student. If we later offer North Carolina continuing education, 21 NCAC 12B .0206(a) sets a four-year period on the same basis. Deleting your account removes your personal data as described above; it does not reach these specific records until their period ends.

6. Your Rights

You have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your account and associated data — with one exception: records a state licensing authority requires us to keep are held for the period that authority sets (see Section 5)
• Export your data: from the Account & Data page you can download a copy of your profile, quiz sessions, study time, certificates, purchases and Build Points ledger (one export every 24 hours)

In addition, GC Prep provides the following specific data controls directly in the application:

• Gamification data deletion: Email to delete your points history, streak records, and leaderboard entries. We will complete deletion within 30 days.
• Backup contact removal: Update or delete your backup email and phone number at any time from your Profile page under Account Security.
• Notification opt-out: Study reminders and non-transactional alerts can be disabled from your Profile page under Account Settings.
• Leaderboard (Honor Roll) opt-out: Disable Honor Roll and leaderboard visibility at any time from your Profile page. Your score is removed from public display immediately upon opt-out.
• Facebook data deletion: If you signed in with Facebook, you may request data deletion through Facebook's Apps and Websites settings. Our data deletion callback will process the request and remove your account data within 30 days.

To exercise any of these rights, email us at . We will respond within 30 days.

7. Cookies and Local Storage

GC Prep itself uses your browser's local storage rather than cookies to store the following data locally on your device. Two services we use do set cookies: Google Analytics sets cookies whose names begin with _ga to tell returning browsers apart (see Section 4), and Stripe sets its own cookies on its checkout and billing-portal pages, which are Stripe’s pages, not gcprep.app.

• Quiz progress: Your scores, streak, and section progress are stored under keys prefixed gcprep_. This data stays on your device and is not transmitted to our servers.
• Authenticated session (auth tokens): Supabase stores your login session under a key prefixed sb-. This contains a JWT access token + refresh token used to keep you signed in. The token is cleared when you sign out and is automatically refreshed in the background while you are active.
• Study timer: Active study session data is stored locally to resume if you navigate away.
• Tour preferences: Whether you have completed the in-app guided tour is stored locally.
• Offline question cache (IndexedDB): When you opt-in to offline mode for a state module, the question bank for that module is downloaded to your device and stored in your browser’s IndexedDB. This lets you study without an internet connection. The cached content stays on your device and is not transmitted back to our servers. You may clear it at any time from your Profile page or by clearing your browser’s site data for gcprep.app.

None of this local storage data is sold or shared with third parties. We do not use advertising cookies, tracking pixels, or behavioral tracking cookies of any kind.

Google Analytics (GA4) sets standard cookies (_ga, _gid) to count aggregate page visits anonymously. These do not identify you personally. You can opt out at tools.google.com/dlpage/gaoptout.

8. Children's Privacy

GC Prep is intended for adults preparing for professional contractor licensing examinations. We do not knowingly collect personal information from anyone under the age of 18. The one exception is a person under 18 whom a school or employer enrolls in seats it has purchased, under its own agreement with us and its own authority (Terms of Service, Sections 3 and 9); that person’s information is handled as described in this policy and is visible to the organization’s manager. If you believe a minor has created an account on their own, please contact us and we will promptly delete it.

9. Changes to This Privacy Policy

We may update this Privacy Policy periodically to reflect changes in our practices, technology, legal requirements, or other operational reasons. When we do, we will update the effective date at the top of this page. For material changes that meaningfully affect how we collect, use, or share your personal information, we will notify you by email or by displaying a notice in the app at least 7 days before the changes take effect.

Your continued use of GC Prep after changes take effect constitutes your acceptance of the updated Privacy Policy. If you do not agree to the revised Privacy Policy, you may delete your account at any time via your Profile settings or by emailing support@gcprep.app.

10. Contact Us