What we collect, why, and how to delete it.

We’re a small Hawaii pre-license course. We collect the minimum information needed to run your enrollment, and we don’t sell your data. This page explains the specifics.

1. What we collect

When you sign up or use the platform, we collect:

• Account info: first name, last name, email, optional phone number, hashed password (bcrypt — we never see your plaintext password).
• Study activity: chapters read, quizzes attempted, individual question answers, time spent per page, your study planner goal date.
• Payment data: Stripe Customer ID and a record of each successful charge (amount, currency, tier, timestamp, Stripe session ID). We do not see or store your card number or CVC — that all lives at Stripe.
• Communications: emails we send you (verify, password reset, welcome, support replies) and emails you send into our support inbox.
• Optional ‘app PIN’: a SHA-256 hash of your 4-digit PIN, stored locally on your device only. Not sent to our servers.

We do not run third-party trackers (Google Analytics, Meta Pixel, etc.). The only telemetry on the platform is our own server-side aggregation of study hours and quiz attempts, used to power your profile dashboard and the admin analytics view.

2. Why we collect it

• To run your enrollment: track the state-required 60 study hours, save your quiz scores, render your composite grade.
• To process payments: identify you to Stripe so receipts land in your inbox and refunds return to your card.
• To communicate: verify your email so password resets are possible, answer support tickets, send your course-completion certificate.
• To improve the course: per-question analytics tell us which exam concepts trip students up — we use that to revise question wording. The analytics are aggregated; we don’t single out an individual student’s wrong answer in product decisions.

3. Who we share it with

We share strictly the minimum needed to operate:

• Stripe — payment processing. Stripe is PCI-DSS compliant. Their privacy policy: stripe.com/privacy.
• Resend — transactional email delivery (verify links, receipts, password resets). Their privacy policy: resend.com/legal/privacy-policy.
• Anthropic — powers the AI Real Estate Tutor. Your tutor conversation is sent to Anthropic for response generation. Anthropic does not train on API data by default. Their policy: anthropic.com/legal/privacy.
• Railway — our hosting provider. Stores our database and serves the application. Their policy: railway.com/legal/privacy.

We don’t sell your data. We don’t share it with advertisers or data brokers. We disclose only when legally compelled by a valid subpoena, and we’ll notify you if we’re permitted to.

4. How long we keep it

• Active accounts: indefinitely while you’re enrolled.
• After deletion: study records, plan, quiz history, support messages, in-app email logs are removed within 24 hours. Stripe receipts are retained on Stripe’s side per our financial-records obligation but are no longer linked to your account in our system.

5. How to delete your data

Open your profile page → scroll to the “Delete my account” card → re-enter your password and type delete to confirm. The deletion is immediate and complete; we don’t hold accounts in a “soft-deleted” bucket.

If you can’t log in but want your account removed, email support@ralphfoulger.com from the address on file with a description of the account; we’ll verify and process the deletion manually.

6. Children

The Academy is for adults pursuing a Hawaii real estate license. We do not knowingly collect information from anyone under 18. If you believe a minor has signed up, email us and we’ll remove the account.

7. Your rights

You can request a copy of the data we hold about you, ask us to correct anything inaccurate, or ask us to delete it (see Section 5). Email support@ralphfoulger.com for any of these.

8. Security

Passwords are bcrypt-hashed with 12 rounds. Sessions use httpOnly, secure, sameSite=“lax” cookies. All data in transit is HTTPS. We don’t store payment card data; Stripe handles that. We audit dependencies regularly and rotate secrets when needed.