Privacy Policy

ISTQB Pass (Android and iOS app, com.rori.istqbexam) · Effective 5 November 2026

ISTQB Pass helps you prepare for the ISTQB® Certified Tester exams (Foundation, Advanced and Specialist levels). This policy explains what the app stores on your phone, what it sends to us and to the services it uses, and the choices you have. In short: there is no account, no ads in the app, and the app does not ask for your name, email address or any other personal details.

1. What stays on your phone

Your study data is stored only on your device: your progress, reading time, notes and highlights, favorite terms, flash card progress, test attempts and scores, the certifications you study, goals and settings. If you record the result of your real exam, its score, date and how it felt are stored here too, together with an optional photo of your certificate in the app's private storage. The app also creates a random guest ID the first time it starts. It is not linked to your name, email or phone number. If you uninstall the app, this data is deleted from your phone. We cannot read it and cannot restore it.

The app also contains the previous version of the app, for the CTFL 2018 syllabus (offered as certification CTFL 3.1). It keeps its own study data in its own database on your phone, in the same way, and it is covered by this policy and by the same choices.

2. What the app sends (usage data)

To learn which parts of the app are useful and where people get stuck, the app uses Firebase Analytics (Google). It reports events such as:

• which screens are opened (for example "glossary" or "quick test");
• starting and finishing a practice test: which exam, the number of questions, time used and the score;
• leaving a practice test before finishing it and coming back to it later (how many questions were answered and the time used), and, when a test is finished, the share of right answers per chapter and per knowledge level;
• with a recorded exam result, a few counts about how you prepared: the number of practice tests finished, your average score on the last three, the minutes spent reading the syllabus and how many days before the exam the goal was set;
• reading the syllabus: which chapter or section is opened, pinning or highlighting a paragraph, that you changed how the text is displayed (not the settings themselves), and that you showed the English original of a translated page or paragraph;
• the glossary: which term is opened and whether a term is favorited;
• searching (in the glossary or in the whole app): the length of the search and how many results it found in each part (never the words you typed);
• flash cards: the mode, the number of cards and how many you knew;
• recording an exam result: whether it was a pass, the score in percent, how it felt (easy to very hard) and whether a photo was added, replaced or removed. The photo itself, and the exact score and date, are never sent;
• daily questions: switching them on or off, how many a day and the length of the time window, whether the questions are answered in the notification or in the app, whether the answer was right, and opening a lesson to revise (never the question text or the answer you picked);
• opening one of the suggested next steps of the insights screen (which kind of suggestion), and whether you finished or skipped the app tour and how many steps you saw;
• changing the language or theme, setting, changing or removing an exam goal (days to the exam, reminders on or off), choosing a certification, tapping rate, share or report a problem.
• downloading study material: which certification and language, what started it (choosing a certification, changing the language or an update), its size, how long it took and whether it worked; whether you accepted an offered update; and whether you allowed notifications when the app asked (for exam reminders or daily questions).
• how long a syllabus section was read and how far down; which search result was opened (its place in the list, never the words searched); flash card sessions left before the end; and which suggested next steps were shown.

Each event also carries a few facts about how the app is set up, so that the reports can be split by them: the certification you study, the app language, how many certifications you study, whether an exam goal is set and whether daily questions are on.

The app never sends the text you type (searches, notes, bug reports), your individual answers, or your guest ID to Firebase Analytics. Firebase itself automatically collects technical information such as an app-instance identifier, device model, operating system version, app version, language, approximate location derived from the IP address, and session information.

Ad measurement. We advertise the app (for example with Google Ads). If you allow it, Firebase also sends the advertising ID of your phone (the Android advertising ID, or the IDFA on iOS) with the usage data above to our ad partners, so that they can tell us which ad brought you to the app. It is never used to show you ads in the app, which has none. In the European Economic Area, the United Kingdom and Switzerland the app asks you first, after the tour of the home screen; elsewhere it is on. On iOS it also needs your yes to Apple's tracking question. You can turn it off at any time (see section 7).

3. Crash reports

The app uses Firebase Crashlytics (Google) to receive reports when it crashes. A report contains the technical details of the crash, the device model, operating system and app version, and the guest ID, so that we can tell how many users a problem affects. Crash reports are not collected in development builds. The previous version of the app (CTFL 3.1) reports its crashes and screens in the same way and follows the same switch (see section 7).

4. Notifications and photos

Exam reminders are notifications scheduled on your phone, with no server or push service involved. The app asks for the notification permission only when you save an exam goal with reminders on. You can turn reminders off when you edit the goal, or in your phone's settings. After your phone restarts or the app is updated, the app sets the reminders up again; this is why it asks Android to be told when the phone has started.

Daily questions (if you switch them on) are also notifications scheduled on your phone: a short question from the study material at the times you choose, which you can answer with a button in the notification. The questions, your answers and which questions you got wrong are stored only on your phone and are used to choose what to ask next. Answers given on a notification while the app is closed are written to a small file in the app's private storage and read when the app opens. You can switch daily questions off at any time on their screen.

Certificate photo: you choose it with the system camera or photo picker, so the app sees only the picture you pick, not your gallery. It is stored in the app's private storage on your phone and is never uploaded. "Share" and "Save" hand the picture to the share sheet or your gallery at your request.

Recent searches: the app remembers your last five searches (the words you typed in the search) on your phone so you can run them again. They are never sent anywhere, and you can remove them one by one or all at once in the search screen.

Sharing a result or a glossary term: when you press "Share my result" or the share button of a term, the app draws a picture on your phone (your score and the exam name, or the term and the start of its definition) and opens your phone's share sheet with it and a link to the app. The app sends nothing itself; what you share, and with whom, is your choice, and is then governed by the app you share it with.

Permissions the app asks for: internet (content updates, translation reports and the services of section 8); notifications (exam reminders and daily questions, asked for only when you use them); being told when the phone has started (to set the reminders up again); and, only on Android 9 and older, storage (to save a certificate photo to your gallery). The app does not ask for access to your location, contacts, microphone, camera or photo library.

5. Content updates

The syllabus, glossary and sample exams are bundled with the app. The app also checks for updates to this content on a server hosted on Cloudflare. Like any web request, this exposes your IP address to the server and to Cloudflare, which may keep standard request logs. No identifier from the app is included in the request.

6. Reporting a problem

"Report a problem" opens your own email app with a message filled in. Nothing is sent until you press send there. If you choose to include technical details, the message lists the app version, device model, Android version, language and the certification you are studying. It does not include the guest ID. The message you write and your email address are then visible to us, and we use them only to answer you and fix the problem.

"Report a translation error" (in the syllabus and the glossary, when you read a translation) works differently: it sends the report from the app to our server on Cloudflare, with no email app involved. The report contains the English text and the translation you saw, the wording you propose, your note, the app version and language, and your email address only if you type it (it is optional, and we use it only to ask you about the report). It does not include the guest ID or any device information. To limit abuse we count the reports sent from one network address in an hour, using a scrambled value of the address and the day that we cannot turn back into the address. If you are offline, the report waits on your phone and is sent later. We use reports to correct translations and may keep them as long as they are useful.

7. Your choices

• Share usage data (Settings → Privacy): turn it off to stop both usage data and crash reports. It is on by default.
• Ad measurement (Settings → Privacy): turn it off to stop sharing the advertising ID with our ad partners. On iOS you can also refuse tracking in the system settings (Privacy & Security → Tracking).
• You can delete all local data by clearing the app's storage or uninstalling it.

8. Services we use

We do not sell your data and do not use it to show you ads; with your consent it is used to measure our own ads (section 2). Analytics data is kept for the limited period configured in Firebase (14 months at most) and crash reports for the period Crashlytics keeps them.

9. Children

The app is intended for people preparing for a professional certification and is not directed to children under 13 (or 16 where local law requires). We do not knowingly collect personal information from children.

10. Your rights

Because the data above is not linked to your name or email, we usually cannot tell which data belongs to you. If you live where data protection law (such as the GDPR) applies and want to ask about, correct or delete data, contact us at the address below and we will do what we reasonably can.

11. Audio lessons and purchases

To unlock and play the audio lessons the app uses a few services, in addition to those above:

• Anonymous sign-in. The app signs you in with Firebase Authentication (Google) without asking for any detail: you get a random ID that is not linked to your name, email or phone number. It is used as your ID for purchases and to prove to the audio server that you may listen. It is separate from the guest ID of section 1.
• Purchases. Payments are made in Google Play or the App Store; we never see your card or payment details. We use RevenueCat to know which audio packs you have bought. RevenueCat receives your anonymous ID, your purchase and its store receipt, and technical details such as the app version, country and device type, and uses them to confirm the purchase and to let you restore it. It is not used to show you ads.
• Audio. The audio files come from a server on Cloudflare (audio.istqb-pass.fyi). To play a chapter, the app sends your Firebase sign-in token; the server asks RevenueCat which packs you own and answers with a temporary access code. Like any web request, it exposes your IP address to the server and Cloudflare, which may keep standard request logs.
• Usage data (if sharing is on, see section 7): opening or closing the purchase screen, a purchase or a restore and its result (success, cancelled, error), which pack, starting or finishing an audio chapter, the voice and speed you choose. Never what you typed.

What you listened to, and where you stopped, is stored on your phone. Uninstalling the app deletes it, but your purchases remain with your store account and can be restored. To ask about or delete the data tied to your anonymous ID, contact us at the address below and tell us the version of the app; we will do what we reasonably can.

12. Changes

If this policy changes, the new version is published on this page with a new effective date. Material changes will also be mentioned in the app's release notes.

13. Contact

Questions about this policy: theanhvo0903@gmail.com

ISTQB® is a registered trademark of the International Software Testing Qualifications Board. This app is independent and is not affiliated with or endorsed by ISTQB.