Privacy Policy — nawid.io
Effective date: September 15, 2026 Who we are: Nawid Royaee, doing business as nawid.io, based in New York, USA. Contact: support@nawid.io.
This policy explains what personal data nawid.io collects, why, where it lives, who sees it, and what control you have. We have tried to keep it short and honest.
1. What we collect and why
| What | Why we need it |
|---|---|
| First name, last name | To greet you and, later, to put on certificates. |
| Email address (plus whether it is verified and when) | Login, password recovery, email verification, and the Sunday reminder if you keep it on. |
| Password — stored only as a one-way hash | Login. We never store or see the actual password. |
| Google account ID, name, email, profile picture URL (only if you sign in with Google) | To create and link your account. We take nothing else from your Google account. |
| Time zone and reminder preference | To send the reminder at the right time, or not at all. |
| Quiz attempts — which quiz, when submitted, score | Your dashboard, history, and streak. |
| Your answer to each question | To score per content area and show explanations. |
| Login times and IP address, last 30 days only | To stop password-guessing attacks and investigate abuse. |
| Time you accepted the Terms and confirmed you are 18+ | Legal record. |
We do not collect: date of birth, phone number, payment cards (none exist today), precise location, advertising identifiers, or your browsing outside our site.
We collect this data directly from you (sign-up form, quiz answers) or from Google (if you choose Google sign-in). We do not buy data about you from anyone.
2. Google sign-in
If you use "Sign in with Google", Google tells us your name, email, and profile picture URL and confirms the email is verified. If that email already has a password account with us, the two are linked into one account. Google's own handling of your data is covered by Google's privacy policy, not this one.
3. Cookies and sessions
We use one cookie: a secure, HTTP-only session cookie that keeps you logged in for up to 30 days of inactivity on that device. It is strictly necessary for the site to work. We use no third-party cookies, no advertising cookies, and no tracking pixels. See the Cookie Notice for details.
4. Emails we send
| Can you turn it off? | |
|---|---|
| Verify your email address | No — required to use the site. |
| Password reset link, "your password was changed", email-change notice, account deleted | No — these are security notices about your account. |
| Saturday reminder ("Tomorrow's quiz opens") | Yes — every reminder has an unsubscribe link, and there is a switch in Settings. |
We do not send advertising and we never share your email with marketers.
5. Where your data is stored
Your data is stored in Google Firebase / Google Cloud data centres located in the United States. If you use the site from outside the US, your data is transferred to and processed in the US.
6. Who we share data with
We do not sell or rent your personal data. We share it only with:
- Google (Firebase / Google Cloud) — hosts our database and authentication as our processor. Google may only use the data to provide those services to us.
- Our email delivery provider — to send the emails listed above.
- Stripe — in the future only, if we add paid features. Stripe would handle card details; we would keep only a Stripe customer ID. We will update this policy before that happens.
- Authorities — if the law requires it, or to protect the site, our users, or the public from harm.
7. How long we keep data
- While your account is open: we keep the data above so your dashboard and history work.
- Login IP records: deleted after 30 days.
- Unverified accounts: deleted automatically after 7 days.
- When you delete your account: your account is deactivated immediately and your personal data (profile, answers, attempts, login record, Google link) is permanently purged within 30 days. Encrypted backups that still contain the row expire on their normal schedule shortly afterwards. We keep only anonymous statistics that cannot identify you (for example "62% of users missed question 3").
8. Your rights
Whoever you are and wherever you live, we give you the same rights that laws such as the EU GDPR and the California CCPA/CPRA provide:
- Access — ask for a copy of the personal data we hold about you.
- Correction — fix your name or email yourself in Settings, or ask us.
- Deletion — delete your account yourself in Settings, or ask us.
- Portability — receive your quiz history in a common file format.
- Object / restrict — ask us to stop or limit certain processing.
- Opt out of marketing — unsubscribe from the reminder at any time.
- No sale of data — we do not sell or "share" personal data for advertising, so there is nothing to opt out of.
- No discrimination — exercising your rights never affects your access to the site.
To use any of these, email support@nawid.io from the address on your account. We will answer within 30 days. If you are in the EU/UK you may also complain to your local data-protection authority.
9. How we protect your data (New York SHIELD Act)
We maintain reasonable administrative, technical, and physical safeguards appropriate to the size of our service and the data we hold, as required by the New York SHIELD Act. In practice this means: passwords are hashed and never stored in plain text; all traffic is encrypted (HTTPS); the session cookie is secure and HTTP-only; login attempts are rate-limited; quiz answers are checked on the server so the answer key is never sent to your browser; access to production data is limited to the operator; and our hosting provider (Google Cloud) holds independent security certifications.
No system is perfectly secure. If a breach affects your data we will notify you and any required authorities as the law requires.
10. Children
nawid.io is for adults preparing for a professional licensing exam. We do not knowingly allow anyone under 18 to create an account. If you believe a minor has an account, email support@nawid.io and we will delete it.
11. Changes to this policy
We may update this policy. For significant changes we will email you or post a notice on the site before the change takes effect. The current version is always at nawid.io/privacy.
12. Contact
Email: support@nawid.io Mail: [nawid.io], [MAILING ADDRESS — PO box pending]