Privacy Policy

1. Who we are

RadTechPrepper (the "Service") is operated by CuratedCurriculum LLC, a California limited liability company ("we," "us," or "our"). This Privacy Policy describes how we collect, use, and share information about you when you visit radtechprepper.com, create an account, or use the ARRT Radiography Prep app.

For questions, email [email protected].

2. Information we collect

We collect these categories of information:

2.1 Account data (you give us)

• Name and email address when you create an account. If you use Continue with Google, these and your profile picture come from Google, and we store a record linking your Google account, including the sign-in tokens Google issues.
• Password, which we never store in plain text. Passwords are hashed using industry-standard algorithms before storage.
• Profile information you optionally provide during onboarding: your study persona (first-timer / retaker / refresher), your planned ARRT exam date, and your daily study time budget.
• Two-factor sign-in data: the secret and backup codes, if you turn two-factor sign-in on.
• Referral payout details, if you save them: the method you choose (PayPal, Venmo or gift card) and your handle for it.
• Bug reports, if you send one: your description, the page address, your browser's user agent, and your account email or the email you typed.

2.2 Usage data (collected automatically)

• Study activity: which chapters you view, your answers to practice questions and mock exams, your accuracy by category, your lab and formula practice, your XP and streak history, and your achievement progress. Your study activity, including whether you got each question right and when, is stored on our servers against your account and mirrored in your browser's local storage.
• Forum activity: threads you create, replies you post, reactions you toggle, images you upload, and reports you submit. Threads, replies, reactions and images are visible to other signed-in users, and the Premium Study Group only to Premium members. Reports go to our moderation queue, not to other users.
• Technical data: IP address (used for rate-limiting and abuse detection, stored with your browser's user agent in your sign-in session records, and written to our security logs), browser type, device type, timestamps, and pages viewed. Cloudflare collects basic edge-level metadata to operate and protect the Service.

2.3 Payment data (you give to Stripe, not us)

Billing is handled by Stripe, Inc. Paid plans aren't on sale yet. When they open, you will provide your payment details directly to Stripe. We never see, store, or process your full credit card number. When you start a checkout we send Stripe your email, your user ID and the plan you chose. From Stripe we read your customer identifier, plan, subscription status, billing period end, cancellation setting and any pass expiry date.

When our Stripe connection is on, our servers look up a signed-in user's email at Stripe on app pages and some other requests, to check for a paid plan. This includes users who have never bought anything.

Stripe's privacy practices are governed by Stripe's Privacy Policy .

2.4 School rosters

A school that buys seats for a class can give us a list of student email addresses, which we may load before those students have accounts. See "School programs" in section 3.

3. How we use your information

• To create and manage your account, authenticate logins, and recover access (password reset, email verification).
• To deliver the ARRT prep content, personalized study plan, and progress tracking that the Service provides.
• To process subscription payments (via Stripe), send email (via Resend), and provide customer support.
• To operate the community forum, including rate limiting, moderation, and reporting.
• To detect, prevent, and respond to abuse, fraud, and security incidents.
• To improve the Service: analyzing aggregated usage to identify weak content areas, broken UX, and feature opportunities.
• To comply with legal obligations and enforce our Terms of Service.

We do not sell your personal information. We do not share your information with advertisers. We use your study activity to deliver the Service to you, to improve the Service as described above, and, if you join a school program, for the faculty reporting described below.

School programs

Schools can buy seats for a class. Student seats are planned to start in 2027. If you enter your school's program code and accept the notice on that screen, faculty of that program can see, and export to a CSV file, your name and email, when you enrolled and last studied, your readiness score and band, your mock exam count, your latest mock score and date, your weakest ARRT content category and your accuracy in it, how many questions you have answered, any extended access date, and any flag that you need attention. Your mock results also count toward a class report by ARRT content category. Faculty do not see your individual answers, your notes, or what you post in the community. These reports are built so a school can use them as program-effectiveness evidence, including for accreditation review.

Email

Account email (verification and password reset) is always sent. We also have three optional kinds, each with its own switch under Email notifications in Settings: the Daily 5 questions (Premium only, chosen partly from your weak areas), study reminders when you fall behind, and product announcements. All three are on by default, and the Daily 5 goes only to Premium members, every day. The automatic schedule for study reminders is off today.

4. Service providers we use

We share limited information with the following third parties strictly to operate the Service.

About Microsoft Clarity. Clarity is not switched on today. If we switch it on, it would run on our public pages, including login, signup, password reset and checkout pages, and record session replays so we can see where users get stuck and improve the product. Microsoft's default masking mode treats numbers and email addresses as sensitive and masks them, and Microsoft says input boxes stay masked. Other text on a page, such as a name, may not be masked. See Microsoft's Clarity Terms of Service and Privacy Statement .

5. Cookies and similar technologies

We use a small number of cookies:

• Authentication cookies set by our auth provider so you stay logged in. Marked HttpOnly + Secure + SameSite=Lax.
• Onboarding cookie (arrt-onboarded) to remember you completed the first-time setup wizard.
• Referral cookie (arrt-ref), set when you open a signup link carrying a referral code. It holds the code for up to 90 days so the referral can be credited to the person who shared it.

Today we do not use advertising cookies, third-party tracking pixels, or cross-site behavioral tracking. Plausible Analytics, if switched on, does not use cookies. Microsoft Clarity, if switched on, can set its own cookies, including third-party Microsoft cookies such as MUID, which Microsoft says are used for advertising, site analytics and other operational purposes; see Microsoft's Clarity cookie list for the specific cookies and their lifetimes.

6. How long we keep your data

• Account data: while your account is active. The app has no delete button. To close your account or ask us to delete it, email [email protected], and we handle the request by hand.
• Usage data: study progress is retained while your account is active. Deleting your account record also removes your saved progress, mistake log, practice sessions, lab and formula records, and sign-in sessions. Mock exam attempts and per-answer records are not tied to that deletion and stay unless we remove them separately. Aggregate, deidentified usage statistics may be retained indefinitely.
• School programs: a roster row keeps your email and is not tied to account deletion, so it stays unless we remove it separately. Reports a school has already exported are in the school's hands.
• Sign-in session records, including IP address and browser user agent: we run no scheduled job that clears them. Signing out removes that session's record, and any that remain are removed when your account record is deleted.
• Forum content: deleting your account record also deletes your threads, replies and reactions, and deleting a thread deletes the replies other people made to it. Images you uploaded are stored separately and are not removed by that step.
• Bug reports and forum reports: deleting your account record clears the link to your account. The report stays, along with any email address in a bug report.
• Email records: our record of which announcement went to which email address is not tied to account deletion.
• Payment records: retained by Stripe per their schedule. Our database doesn't store your Stripe customer identifier, though it can appear in our worker logs: we look you up at Stripe by email when needed, and we keep Stripe event IDs and types so that no event is processed twice, and if you joined through a referral, the plan you bought and the reward amount on that referral record. Deleting your account here does not delete your records at Stripe.
• Logs: Cloudflare worker logs are retained per Cloudflare's retention policy (typically days, not months).

7. Your rights

Depending on where you live, you may have the following rights regarding your personal information:

• Access the personal information we hold about you.
• Correct inaccurate information.
• Delete your account and associated personal data.
• Export your data in a portable format.
• Object to certain processing or withdraw consent where we rely on consent.

To exercise any of these rights, email [email protected]. The app has no self-service export or delete, so we handle these requests by hand. We will respond within 30 days.

California residents (CCPA / CPRA)

If you are a California resident, you have the rights described above plus the right to opt out of the "sale" or "sharing" of your personal information. We do not sell or share personal information for cross-context behavioral advertising. You can exercise CCPA rights by emailing the address above.

EU/UK residents (GDPR)

If you are in the EU or UK, our legal bases for processing your information are: (a) contract (to provide the Service you signed up for), (b) legitimate interests (to protect the Service from abuse and improve it), and (c) consent where required (e.g. marketing email). You have the right to lodge a complaint with your local data protection authority.

8. Children

The Service is intended for users aged 18 and over. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided us with personal information, please email [email protected] and we will delete it.

9. Security

We use industry-standard measures to protect your information, including TLS encryption in transit, hashed passwords, HttpOnly + Secure cookies, server-side authorization checks on sensitive endpoints, and rate limiting on authentication and forum write endpoints. No system is perfectly secure; we cannot guarantee absolute security but we work to maintain a strong baseline.

10. International transfers

We are based in the United States. If you access the Service from outside the US, your information will be transferred to and processed in the US, where data protection laws may differ from those in your country. Cloudflare serves requests from data centers in many countries, so request data may also be processed outside the US. By using the Service, you consent to this transfer.

11. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top. For material changes we will notify you by email before the changes take effect.

12. Contact

Questions about this Privacy Policy or your data?

• Email: [email protected]
• General inquiries: [email protected]