Privacy Policy

Last updated 29 October 2026.

This policy explains how Citizenship Test Questions ("we", "us") handles personal information when you use citizenshiptestquestions.com (the "site"), buy an unlock code or email us. "Personal information" means information about you as an identifiable person; in the UK and the EEA it is called "personal data".

The short version

There are no accounts. Your saved progress, settings, unlock codes and privacy choices stay in your browser.
Payments are taken by Stripe. Your email address and purchase are kept in our Stripe account; we never see your full card number.
Google Analytics and our private Rex Media activity report run only if you agree to analytics.
We don't show ads at the moment.
We do not send marketing emails, we do not sell your personal information for money, and we make no automated decisions about you.

Who we are

Citizenship Test Questions runs this site and decides how your personal information is used (in UK and EU law, we are the "controller"). The site is run from the United Kingdom. For any question or request about your personal information, email support@citizenshiptestquestions.com.

What stays in your browser

To remember your work, the site saves the following in your browser's local storage, on your device:

the mock tests and chapter practice sets you finished, with your scores, the questions you got wrong, and the dates you practised;
the US practice interviews and English test practice you finished, and the US study cards you chose to see again;
your settings: the 2025 or 2008 civics test, the 65/20 questions only, read aloud, and Spanish first;
unlock codes you have entered or bought;
your analytics choices.

Your individual answers, settings and privacy choices are not sent to us. Aggregate test activity is sent to our private Rex Media report and Google only if you accept analytics. Your browser checks unlock codes and passes a code to our unlock service when needed to verify it or load a paid test. To delete saved information, clear this site's data in your browser settings. Keep a copy of any unlock code first, because there is no account to recover it from.

What we collect and why

When you buy an unlock code

Payments are made on Stripe's checkout page. Stripe collects your email address, your card or wallet details and billing details such as your name, country and postcode (what it asks for depends on how you pay). In our Stripe account we can see your email address, your name and country if you gave them, what you bought, the amount, the date and whether the payment went through. We see only the card type and its last four digits, never the full card number.

After you pay, Stripe sends you back to our unlock page with a payment reference. The page sends only that reference to our unlock service, which asks Stripe whether the payment went through and returns your code. The service stores nothing. The site has no database of buyers: purchase records are kept in our Stripe account.

We use this information to deliver your code, help you if you lose it, handle refunds, prevent fraud and keep the records that tax law requires. When we refund a payment, we add a random identifier for that code to a public list of cancelled codes so the code stops working. The list contains no names, emails or payment details. Lost your code? Email us with the email address you paid with, and we'll find your payment and reply with your code.

Stripe also uses some of this information for its own purposes, such as preventing fraud and meeting its legal duties, under the Stripe privacy policy.

When you email us

If you email us, for example to report a mistake in a question, ask about a code or ask for a refund, we receive your email address, your message and anything you include. We use them to reply, to fix the problem and to keep a record of what we agreed. The "Report a mistake in this question" link opens your email app with the question filled in; nothing is sent until you send the email.

Emails about your purchase are sent because you bought something. We do not send marketing emails.

When you visit the site

The site and our unlock service are hosted by Vercel. Like every web server, theirs record technical information about each request: your IP address, browser type, the page requested, the referring page and the time. This is used to deliver pages, keep the site secure and find faults. Our unlock service also uses your IP address, held briefly in memory, to limit repeated requests.

Site analytics

If you accept analytics, our private Rex Media report counts page views, test starts and test completions and stores daily totals by page and approximate visitor country. It also stores aggregate question counts, scores, pass results and elapsed time so we can see whether tests are useful and where they need improvement. The server works out the country from the request IP address and does not store the raw IP address. It sets no cookie and does not store names, email addresses, payment references, individual answers or browser and device details. Random delivery and test-attempt identifiers are converted into private hashes used only to prevent duplicate counting, then deleted within 96 hours. We use this information only to understand and improve the site, never for advertising, profiling or tracking people across websites. You can turn it off at any time using "Cookie choices".

If you accept analytics, Google Analytics 4 also records which pages are visited, how you arrived, your device and browser type and your approximate location (country or city, worked out from your IP address), using a cookie that recognises your browser on later visits. We also measure scroll depth, navigation, outbound link domains and clicks towards checkout, plus test starts, progress milestones, restarts and completions, the start and end of an N-400 practice or a deck of study cards (with how many you marked as understood), and when an unlock code is issued or saved (which test it unlocks, never the code). Test events include the country, the kind of test, the test number and chapter, Practice or Exam mode, free or full access, the page language, the US question list, question counts, score, pass result, whether the timer ran out and elapsed time. A random identifier links events from the same test attempt. We do not send individual answers, unlock codes, payment references, email addresses or form contents in these events. We use the reports to understand which pages and tests are used, where people stop and how to improve the site. Google processes this data for us. Google event-level data is kept for at most 14 months.

Cookies and browser storage

Cookies and browser storage (also called local storage) are small pieces of information that a website saves in your browser. This site uses:

Our own browser storage (what stays in your browser, above): needed for the features you use, so we do not ask before saving it. It stays until you clear it.
Google Analytics cookies (_ga, _ga_…): measure visits; set only if you accept analytics; last up to 2 years.

Stripe sets its own cookies on its checkout pages, under Stripe's cookie policy. We do not use social media buttons, session recording or tracking pixels in emails.

Your choices

Analytics: use "Cookie choices" at the bottom of any page. Google Analytics and the private Rex Media report stay off until you accept analytics, and you can turn both off again at any time. Turning analytics off removes the Google Analytics cookies as far as the browser allows and stops new analytics events from this site.
Your browser: you can block or delete cookies and site data in your browser settings. Blocking our own storage means the site cannot remember your progress or unlock codes.
Do Not Track: the site does not respond to Do Not Track signals; use the choices above instead.

Legal bases (UK, EEA and Switzerland)

UK, EU and Swiss data protection law requires a legal basis for each use of personal data. Ours are:

Selling and delivering an unlock code, and refunds: to perform our contract with you.
Keeping purchase records: to meet our legal obligations (tax and accounting).
Answering emails and error reports: our legitimate interest in helping you and correcting our questions (or our contract with you, if it is about a purchase).
Hosting logs, security, limiting repeated requests and preventing fraud: our legitimate interest in keeping the site and payments working and safe.
Google Analytics and our private Rex Media report: your consent, which you can withdraw at any time.

We do not use personal information for profiling or for automated decisions that have legal or similarly significant effects on you.

How long we keep it

Browser storage: until you clear it. We never hold a copy.
Purchase records in Stripe: for as long as tax and accounting law requires, usually six years after the end of the financial year of the purchase. Stripe keeps its own records as its privacy policy describes.
Cancelled-code list: for as long as the site runs, so a refunded code stays cancelled. It holds no personal details.
Emails and error reports: up to two years after the conversation ends, or longer if we need them for a refund, a dispute or the law.
Hosting logs: a short time, as set by Vercel's retention rules.
Analytics: Google event-level data for at most 14 months and its cookie for up to 2 years unless you clear it or withdraw consent; private delivery and attempt hashes for no more than 96 hours and daily aggregate activity totals while we operate the service.

International transfers

We are in the UK, and Stripe, Vercel, Google and Neon may process data in the United States and other countries. Each offers recognised safeguards under UK and EU law for these transfers: certification under the EU-US Data Privacy Framework and its UK Extension, and/or the standard contractual clauses approved by the European Commission with the UK's International Data Transfer Addendum. Email us for more information about the safeguard used for a transfer.

Your rights

If you are in the UK, the EEA or Switzerland, you have the right to:

ask for a copy of your personal information;
have it corrected if it is wrong;
have it deleted, unless we must keep it (for example, purchase records for tax);
restrict how we use it, or object to a use based on our legitimate interests;
receive information you gave us in a machine-readable form;
withdraw consent at any time, without affecting what happened before.

Email support@citizenshiptestquestions.com. For a purchase, write from (or tell us) the email address you used at checkout, so we can find your records and check the request is yours. We reply within one month, or tell you within that month if the law allows us more time.

If you are unhappy with how we handle your information, please tell us first. You can also complain to the UK Information Commissioner's Office (ico.org.uk, 0303 123 1113) or, in the EEA or Switzerland, to the data protection authority where you live (list of EEA authorities).

US state privacy notice

This section applies to residents of US states with consumer privacy laws, such as California, Colorado, Connecticut, Texas and Virginia, to the extent those laws apply to us.

What we collected in the last 12 months: identifiers (email address, name if given at checkout, IP address, cookie identifiers); commercial information (what you bought and when); internet activity (page visits, site interactions and test activity, including summary results) and approximate location worked out from your IP address. We do not collect sensitive personal information: card details go straight to Stripe. We collect it from you, from your browser and from Stripe, for the purposes described in "What we collect and why", and we disclose it for business purposes only to our service providers (Stripe, Vercel, Google Analytics, Neon, our email provider).

Sale and sharing: we do not sell personal information for money, and we do not ourselves share it for targeted advertising: we have no list of visitors to give anyone. We have no actual knowledge of selling or sharing the personal information of anyone under 16.

Your rights: depending on your state, you can ask to know what personal information we have about you and get a copy, have it corrected or deleted, and opt out of targeted advertising, sale or profiling. Email support@citizenshiptestquestions.com. We will check your request against our records (for purchases, the email address you used at checkout). An authorised agent may make a request for you with your signed permission. If we refuse a request, you can appeal by replying with "Appeal" in the subject; if you are unhappy with the result, you can contact your state attorney general. We will not treat you differently for using these rights.

California: we do not disclose personal information to third parties for their own direct marketing.

Canada

If you are in Canada, we handle your personal information in line with the Personal Information Protection and Electronic Documents Act (PIPEDA). It may be stored and processed in the United States, the UK and other countries by the providers named above, where courts and authorities there may be able to access it under their laws. You can ask to see or correct your personal information, or withdraw consent, by emailing support@citizenshiptestquestions.com. If you are not satisfied with our answer, you can complain to the Office of the Privacy Commissioner of Canada.

Australia

If you are in Australia, we handle your personal information in line with the Australian Privacy Principles where the Privacy Act 1988 applies to us. It may be disclosed to the providers named above in the United States, the UK and other countries. You can ask to see or correct your personal information by emailing support@citizenshiptestquestions.com. If you have a complaint, email us first; if you are not satisfied with our answer within 30 days, you can complain to the Office of the Australian Information Commissioner.

People under 18

The citizenship tests on this site are taken by adults, but anyone can practise. You can use every free practice test without giving us any personal information. The site is not meant for children under 13, and we do not knowingly collect personal information from them. If you are under 18, ask a parent or guardian before buying an unlock code (they can buy it for you). If you think a child under 13 has sent us personal information, email us and we will delete it.

Security

The site is served only over HTTPS, keeps no database of buyers and never handles card details. No system is perfectly secure, so we cannot guarantee the security of information sent over the internet.

Other websites and changes

Other websites we link to, such as the official test pages, Stripe and Google, have their own privacy policies. We will update this policy when what we do changes. The date at the top shows the current version. If a change affects how we use information we already hold, we will say so on this page before it takes effect.

Contact

Questions or requests about your personal information: support@citizenshiptestquestions.com. See also our terms of use and contact page.

Privacy policy