Privacy Policy

This policy describes the data handling currently visible in the Castleport Test Prep website and application code. It covers Castleport-operated pages and tools, not the separate websites of exam organizations, retailers, Google, Microsoft, or other external services linked from this site.

Information the site may collect

Diagnostic attempts

When you start or complete a diagnostic, the service may store an attempt identifier, exam and question identifiers, question-bank version, selected answers, scoring information, content-area results, and timestamps. An attempt without your name is not necessarily anonymous if it is later associated with an email or other technical information.

Free diagnostic results do not require an email address. Optional email capture may associate an email address with a diagnostic attempt.

Contact messages

The Contact form collects the name, email address, topic, and message you submit. The current server route validates and stores this information in the Castleport database. It does not establish an email notification or continuously monitored support inbox.

Do not submit passwords, full card numbers, government identification, confidential patient or client information, or secure exam content.

Email-list submissions

When an email-list or diagnostic email form is available, the service may store the email address, list key, exam market, related diagnostic attempt, and submission time. The inspected implementation stores these records but no outbound email delivery or unsubscribe handler was found.

Submitting an email does not purchase a product or reserve an official exam place.

Browser storage

Some tools use localStorage or sessionStorage for settings, progress, or a dismissed promotion. Clearing browser storage can reset those local settings. Clearing browser storage does not delete information already stored on Castleport servers or by third-party providers.

Technical and rate-limit information

The site may process request information needed to deliver the service, prevent abuse, and investigate failures. The rate limiter uses a client IP value from the trusted proxy header in a database bucket; the inspected code does not hash that value before storing the bucket.

Google Analytics and Microsoft Clarity

Production Castleport pages currently load:

• Google Analytics 4, measurement ID G-MGYL963WCE
• Microsoft Clarity, project ID xpqga86ju5

Google Analytics receives configured categorical events such as diagnostic starts, result views, contact topics, list keys, and book-link interactions. The inspected event helper does not send contact names, email addresses, message text, or selected answer values as GA event parameters.

Microsoft Clarity can record eligible webpage interaction patterns, heatmaps, and session reconstructions. Some tools include explicit masking attributes, but the inspected application does not provide a global mask for every diagnostic, result, or contact interface. Do not submit confidential information.

The current site does not provide a cookie popup, separate analytics consent panel, GPC handling, or a sitewide analytics opt-out control. This page describes that current limitation; it does not claim that consent-controlled collection is already implemented.

Google and Microsoft process information under their own terms and privacy policies. A provider's settings, retention configuration, and dashboard records were not inspected.

How information is used

Castleport uses submitted information to deliver requested tools, calculate and display diagnostic results, store contact requests, prevent abuse, troubleshoot the site, maintain content, and assess resource quality.

The site does not require an email to display a free diagnostic score. No evidence was found that Castleport sells or rents diagnostic, contact, or email-list records.

Retention, deletion, and email choices

The inspected code contains no published fixed retention schedule, automated purge job, self-service deletion control, admin deletion workflow, or unsubscribe endpoint. Database records may remain while needed for the feature, troubleshooting, quality review, security, or business records.

To request access, correction, deletion, or removal from an email list, use Contact and begin the message with Privacy request. The form stores the request; it does not guarantee email delivery or an immediate response. Do not send identity documents unless a suitable process has been provided.

Because the current implementation does not show a functioning unsubscribe flow or deletion workflow, Castleport does not claim that either is automated. Any request should be handled against the actual records and provider settings available to Castleport at the time.

Retailer purchases

Amazon and other retailers control information collected through their own checkout and account systems under their own policies. Castleport does not receive full payment-card information merely because a visitor follows a retailer link.

If you send an order reference for support, it becomes part of the information you choose to provide.

Security and changes

Castleport uses access restrictions and other safeguards appropriate to the service, but no website or storage system can be promised completely secure. This policy is not a security certification or healthcare-records compliance claim.

Material changes should be reflected in the page's update date. A policy update does not by itself establish that an unimplemented control or workflow exists.