Privacy Policy
The short version: this site collects as little as it possibly can. There is no analytics script, no advertising pixel, no tracking cookie and no mailing list. What follows is the long version, because you are entitled to it.
Who runs this site
AZ900Prep is run by one independent person, not a company. If you have a privacy question, want to know what is held about you, or want it deleted, email [email protected] and you will be dealing with that person directly.
What is collected when you just read the site
Nothing you type, and nothing that identifies you personally. Like every website, the server and the CDN in front of it record ordinary request logs — your IP address, the page requested, the time, your browser's user-agent string and the referring page. These are used to keep the site running and to spot abuse. They are not used to build a profile of you, and they are not sold or shared with anyone.
What is collected when you buy
The purchase itself does not happen here. Checkout runs entirely on Gumroad, which is the seller of record for the transaction. Your card details, billing address and email are handled by Gumroad under their privacy policy. They never pass through az900prep.com, and this site never sees them.
What this site receives from Gumroad, when you unlock your materials, is the purchase record attached to your licence key: whether the key is valid, when the sale happened, and whether it was refunded or disputed. That record is used to decide whether to let you in, and for nothing else.
What is stored when you unlock your materials
- A session cookie named
az900_access. It is signed,HttpOnly, same-site and set only after a successful licence check. It carries no personal data — not your name, not your email, not your licence key, only a short one-way hash of the key and an expiry time. It exists so you do not have to re-enter your key on every page. - A record of the key, as a one-way hash. Your licence key is never written to disk or to any log in a readable form. What is stored is an HMAC of it, which cannot be turned back into a working key.
- A coarse device fingerprint. To stop one key being posted publicly and used by hundreds of people, the server keeps a hashed marker per device — derived from a truncated portion of your IP address and your browser's user-agent string. It is deliberately imprecise, it is stored hashed, and a device that has not been seen for 60 days is forgotten.
- An access log line per unlock attempt, containing the time, the outcome, and the hashed key. It is kept so that a stolen or shared key can be spotted. It lives above the public web root and is not reachable over the internet.
Who else is involved
| Service | What it does | What it can see |
|---|---|---|
| Gumroad | Payments and licence issuing | Your name, email, payment details, purchase history |
| Hostinger | Hosting | Server request logs |
| Cloudflare | CDN and protection in front of the site | Request logs, basic performance measurements |
| Google Fonts | Serves two web fonts | Your IP address when the font is fetched |
There is no fifth party. No data broker, no ad network, no analytics vendor, no email marketing tool.
How long things are kept
- Licence and device records: for the life of the licence, and for a reasonable period afterwards in case of a refund or dispute.
- Forgotten devices: dropped 60 days after they were last seen.
- Server and CDN logs: retained only as long as the host and CDN keep them, typically a few weeks.
- Your session cookie: expires on its own, and clearing your browser data removes it immediately.
Your rights
You can ask what is held about you, ask for it to be corrected, or ask for it to be deleted. Email [email protected] from the address you bought with and it will be handled. Deleting your licence record ends your access, so it is worth being sure.
Because purchases run through Gumroad, requests about your name, email or payment record are best sent to Gumroad as well — they hold that data, not this site.
Children
This is study material for a professional certification exam. It is not directed at children under 13, and no data is knowingly collected from them.
Changes
If this policy changes, the date at the top of the page changes with it. There is no mailing list to notify you through, which is rather the point.