RNpractice NCLEX practice

Privacy Policy

Last updated 15 October 2026. RNpractice (rnpractice.com).

A short version

We collect what we need to run accounts, practice, payments, and the Sofia voice. We do not run Google Analytics or advertising pixels. We do not sell your information. Card numbers stay with Stripe.

Questions: [email protected] or [email protected]. Mailing address: [ADDRESS]

Information we store

If you create an account, we store:

  • Your email address and a hash of your password (not the password itself)
  • Whether the email is verified, and when you last changed your password
  • Whether you have an exam-year pass, when it started, and when it ends
  • Stripe customer and checkout identifiers (not card numbers)
  • Quiz progress: which items you answered, whether you were correct, timestamps, input mode (tap or voice), and related practice-session data
  • A running count of graded practice questions on your account
  • Sofia voice preferences (for example, whether voice is on) and monthly voice-usage counts
  • Signed-in session records (a hashed session token, a CSRF token, last-seen time, IP, and browser user agent)
  • Recent IP addresses used with the account, to limit sharing across too many networks

If you apply for the free beta, we also store the answers you submit: name, email, NCLEX timing, first-time or retake, school, where you are in the program, weakest areas, how you study now, why you want to try the site, how you heard about us, and whether we may quote feedback using your first name.

Guests may have a random guest cookie and browser-only settings (for example voice toggles in local storage). Those settings are not an account.

If you share a practice “win,” we store that you claimed that milestone so we do not show it twice.

Information we do not collect

We do not collect Social Security numbers, license numbers, or health records. We do not ask for payment card numbers — Stripe Checkout collects those on Stripe's site.

We do not use Google Analytics, Facebook Pixel, or similar advertising analytics.

How we use it

We use this information to run your account, score practice, enforce the free daily limit and exam-year pass, send verification and password-reset email, detect abuse (rate limits, honeypot, and Cloudflare Turnstile when those are enabled), synthesize Sofia audio, and review beta applications by hand.

Complimentary access is decided by the site owner using an email allowlist. That list is configured by the owner; it is not a separate form you submit.

Services that process data for us

  • Stripe — checkout and payment confirmation. Card details are handled by Stripe, not stored in our database.
  • Cloudflare — the public site sits behind Cloudflare. When bot-checks are on, Cloudflare Turnstile receives a token to confirm you are not a bot. Cloudflare also sees the IP used to reach the site.
  • Cartesia — when Sofia speaks, our server sends the question or teaching text (not your password) to Cartesia's text-to-speech API and may cache the resulting audio on the server so the same line is not billed twice.
  • Email — verification and password-reset messages are sent through SMTP or Resend, from an address such as [email protected].

Cookies

We set a signed-in session cookie, a CSRF cookie used with that session, and a guest cookie for visitors who are not logged in. These are first-party cookies needed to keep you signed in and to protect forms. We do not set third-party advertising cookies.

TikTok

Students and visitors are not asked to log in with TikTok. If the site owner connects a TikTok account, this app uses TikTok's user.info.basic and video.upload scopes only to upload the owner's own videos as drafts. Access tokens, refresh tokens, expiry, and the owner's TikTok open_id are stored on the server in a restricted file. We do not sell TikTok user data and we do not share it with advertisers or other sites.

How long we keep data

[RETENTION: Rob to decide]

Hashed email-verification links expire after 48 hours. Hashed password-reset links expire after 1 hour. Session cookies last for the configured session lifetime.

Your choices

You can change your password on the Account page. To correct your email or delete your account, email [email protected] or [email protected].