Privacy Policy for Examulator

Effective date: August 8, 2026 Last updated: August 16, 2026

Examulator is developed and published by Certification Tool and Die, Ltd. ("Certification Tool and Die," "we," "us," or "our"). This Privacy Policy explains what information the Examulator application handles, how it is handled, and what choices you have.

This policy covers:

• The Examulator Android application distributed through Google Play and as a side-loadable .apk file on our website

• The Examulator desktop/web application distributed as a downloadable package from our website

• The website certificationtoolanddie.com and any related distribution pages we operate

By installing or using Examulator, you agree to the practices described in this policy. If you do not agree, please do not install or use the application.

1. Summary

Examulator is a free, offline-first certification exam practice simulator. It is designed so that your study activity stays on your own device. In plain terms:

• We do not require an account. There is no sign-up, no login, no username, and no password.

• We do not collect your name, email address, phone number, or any other contact information unless you voluntarily send it to us (for example, by emailing us feedback).

• We do not sell, rent, or trade any information about you to anyone.

• We do not display advertising, and we do not use advertising identifiers or advertising networks.

• Your quiz history, scores, ability estimates, and preferences are stored locally on your device, not on our servers.

• The application connects to the internet only to check for updates and to download the practice question database. Optionally, if you have specifically requested access and pasted your assigned API URL into the application, you may choose to contribute individual exam results to help us calibrate question parameters. This is off by default and requires your explicit action for every submission unless you enable automatic contribution. See Section 5.

The remainder of this policy explains these points in detail.

2. Information We Do Not Collect

We want to be explicit about this, because it is unusual. Examulator does not collect:

• Your name, email address, postal address, or telephone number

• Account credentials of any kind (there are no accounts)

• Your contacts, calendar, photos, camera, microphone, or files outside the application

• Your precise or approximate location

• Advertising identifiers (Google Advertising ID or equivalent)

• Contents of other applications on your device

• Payment or financial information (Examulator is free and contains no purchases. Donations are accepted through ko-fi.)

• Health, biometric, racial, ethnic, political, religious, or other special-category personal data

3. Information Stored Locally on Your Device

Examulator creates and maintains data on your own device so that the application can function and so that your study progress persists between sessions. This data is stored in the application's private storage area (on Android) or in your browser's local storage and application data directory (on desktop). It is not transmitted to us unless you explicitly opt in to result contribution as described in Section 5.

This locally stored data includes:

• Practice question database: The bank of practice questions, answers, and explanations used by the application

• Quiz and exam session results: Scores, per-question responses, and timing so you can review past attempts

• Ability and difficulty estimates: Statistical estimates used to adapt question selection to your demonstrated level

• Quiz preferences: Your saved choices such as certification exam code, question count, domain selection, and timer settings

• Application settings and state: Version, update channel, installation status, and similar operational values

• Contribution settings (optional): if you have configured the Contribute Results feature, the application stores the API URL you pasted (which contains your assigned API key), your automatic-contribution preference, and a timestamp on each result you have already contributed (used solely to inform you if you attempt to contribute the same result twice)

You control this data. See Section 10, Data Retention and Deletion, for how to remove it.

4. Information Processed When Examulator Connects to the Internet

Examulator connects to the internet for these purposes only:

1. Update checks. The application retrieves a small version manifest file to determine whether a newer version of Examulator or of the question database is available.

2. Question database download. When you choose to install or update the question database, the application downloads a compressed database file containing the question pool for the exam you selected.

3. Result contribution (optional, off by default). If --- and only if --- you have obtained an API URL from us and pasted it into the Contribute Setup screen, the application can transmit an individual exam result to our calibration API when you press the "Contribute Results" button. See Section 5.

Update checks and database downloads are hosted using Google Sites and Google Drive, which are services operated by Google LLC. When your device requests a file from these services, Google necessarily receives standard internet request information, including:

• Your device's IP address

• The date and time of the request

• Basic technical information sent by the network stack, such as user-agent and requested file

This is inherent to how the internet works, and it happens for any download from any web server. We do not receive, request, store, or have access to this information. It is handled by Google under Google's own privacy policy, available at https://policies.google.com/privacy.

Examulator does not transmit your quiz answers, scores, history, preferences, or any identifier to us or to any third party during update checks or database downloads.

5. Information You Choose to Send Us

Some information reaches us only if you deliberately send it.

Feedback and support correspondence

If you contact us at an [@certificationtoolanddie.com]{.citation cites="certificationtoolanddie.com"} email address, we receive your email address, the content of your message, and anything you attach to it. We use this only to read, respond to, and act on your message, and to keep a record of reported defects so that we can verify they stay fixed in later releases.

Our email is hosted by a third-party email service provider, which stores and processes messages sent to us on our behalf. You can view their privacy policy at https://forwardemail.net/en/privacy.

We retain support correspondence until the issue it concerns is closed, after which we delete it. We do not add your address to any mailing list, and we never share it for marketing.

Diagnostic and trace exports

Our website provides optional diagnostic and trace tools, and there is a user-selectable diagnostic export function built-in to the application on the result history screen. These tools produce a file describing the application's configuration and other pertinent information about the exam you are exporting. These tools are provided so that you can optionally help us reproduce a problem you have encountered.

The diagnostic files generated by these utilities and by the in-app feature are stored on your device, saved to your device, and are never uploaded automatically. Examulator has no capability to transmit them. They reach us only if you deliberately attach one to an email.

A diagnostic export may contain:

• The Examulator version, update channel, and installation details

• The question database version and summary counts of its contents

• Your operating system version, device or machine model, language, and time zone

• Application configuration values and the status of recent update checks

• Recent error records, exception details, and trace entries

• File system paths used by the application. On desktop installations these paths may include your computer's user account name and, in some configurations, your computer's name.

• Summary information about recent quiz or exam sessions, such as exam code, question counts, and timing, where that is relevant to the fault being diagnosed

Please review a diagnostic file before you send it. It is a plain text file and you may open, inspect, and edit it first. You are free to remove anything you would rather not share; we will simply ask for more detail if we need it.

If you do send one, we treat it as support correspondence: we use it only to diagnose the fault you reported, we never share it, and we delete it within 7 days of the issue being closed.

Contribute Results (opt-in IRT calibration data)

Examulator includes an optional feature named Contribute Results that allows you to help us refine the statistical parameters of individual questions. These parameters --- discrimination, difficulty, and guessing (the three parameters of the "3PL" model used by our adaptive engine) --- determine how each question behaves in Computerized Adaptive Testing mode and how scores are scaled. Better real-world response data produces a more accurate simulator for everyone.

This feature is disabled by default. To use it you must:

1. Request an API URL by emailing us at contribute@certificationtoolanddie.com. We will issue you a URL of the form https://api.certificationtoolanddie.com/exam-results?key=<uuid>. The embedded UUID is your API key. Note that we do not associate this UUID with any personal information --- we do not retain your email address, name, or any other identifier alongside it. We keep only a random UUID and a count of how many results have been submitted with it.

2. Paste that URL into the Contribute Setup screen inside the application.

3. Open a completed exam result and tap or click the "📤 Contribute Results" button. A confirmation screen shows exactly what will be transmitted; you may either proceed with the upload or cancel. Optionally you may enable "Automatically contribute all future results," which causes the application to transmit each new completed result without further prompting until you turn this option off.

What is transmitted. Each contribution consists of the following fields for one exam session. Nothing else is included.

Session-level fields:

• sessionGuid --- a random identifier generated on your device when the session started, used only by our server to reject duplicate submissions of the same session. It is not linked to any user identity.

• examCode --- the certification exam code (for example, CISSP)

• mode --- the delivery mode (CAT, Linear, or Quiz)

• startedAt, completedAt --- session start and end timestamps

• totalTimeSeconds, timeLimitMinutes --- duration and configured limit

• totalQuestions, scoredQuestions --- question counts

• scaledScore --- your final scaled score (if applicable to the mode)

• passed --- pass/fail result (if applicable)

• terminationReason --- how the session ended (for example, confidence-interval, maximum-length, or time expiry)

• thetaFinal, seFinal --- your final ability estimate and its standard error (adaptive modes only)

Per-question fields, for each scored question in the session:

• sequenceNumber --- order the question was presented

• questionGuid --- identifier of the question in our bank

• discrimination, difficulty, guessing --- the item parameters the engine used at the time

• isCorrect --- whether your answer was correct

• isBeta --- whether the question was an unscored pretest item

• thetaAtPresentation --- the ability estimate at the moment the question was chosen (adaptive modes only)

• domainGuid, domainNumber --- which exam domain the question belongs to

• timeSpentSeconds --- how long you spent on the question

• selectedAnswerGuid --- identifier of the answer choice you selected

• answerDisplayOrder --- the order in which the four choices were presented to you

What is NOT transmitted:

• Your username, computer name, device identifier, or any other identifier of you personally

• Your IP address (transmitted as an unavoidable part of any internet request, but not retained or used by us)

• The text of any question, answer choice, or explanation

• Any key reference, citation, notes, or feedback you may have left

• Any content from other sessions you did not choose to contribute

• Anything else stored on your device

How we use it. The data is used solely to update the 3PL item parameters (discrimination, difficulty, and guessing) for the individual questions you answered, using standard psychometric calibration techniques (marginal-maximum-likelihood estimation and expected-a-posteriori updating). Aggregate response statistics may inform decisions about which questions to retain, revise, or retire.

We do not:

• Attempt to link contributed sessions to any individual user

• Publish, sell, share, or trade contributed data with any third party

• Use contributed data to profile you or make automated decisions about you

• Combine contributed data with any other data source

Turning it off. You may:

• Cancel any individual contribution before pressing the Contribute button on the confirmation screen

• Disable automatic contribution by unchecking that box on the confirmation screen

• Remove your API URL entirely by opening Contribute Setup and clearing the field, which restores the pre-feature state (no future contributions can occur until you paste a URL again)

• Request that we deactivate your API key by writing to privacy@certificationtoolanddie.com. Once deactivated, any further attempts to contribute using that key will be rejected by our server and no data will be stored.

Retention. Once received, a contributed submission is retained in our calibration database until it is superseded by a subsequent recalibration cycle or until you request its deletion by referencing your API key. Because contributions are not linked to your identity, we can only identify and delete data associated with an API key you provide to us; we cannot locate submissions by any other criterion.

Public feedback

If you post a review on Google Play or contact us on a public forum, that content is governed by the privacy policy of the platform where you posted it, not by this policy.

6. Information Google Play Provides to Us

Because the Android version of Examulator is distributed through Google Play, Google provides developers with certain information about the application's performance. We may receive:

• Aggregated, anonymized statistics such as installation counts, uninstall counts, country-level breakdowns, device model and Android version distributions, and ratings

• Crash reports and stability diagnostics ("Android vitals"), which may include stack traces, device model, and operating system version for sessions in which the application crashed or misbehaved

This information is collected and provided by Google, not by code we wrote. We use it only to identify and repair defects and to decide which devices and Android versions to support. Google's collection of this data is governed by Google's privacy policy and by the choices available to you in your Google account and device settings.

7. Android Permissions

The Examulator Android application requests only the permissions it needs to operate:

• Internet access and network state. Required to check for updates and to download the question database, and --- only when you explicitly configure and initiate it --- to contribute exam results. Without network access, Examulator still functions fully once the question database has been installed; result contribution simply becomes unavailable.

Examulator does not request access to your location, camera, microphone, contacts, call logs, SMS messages, photos, or files outside its own application directory.

8. How We Use Information

We use the limited information described above only to:

• Provide, operate, and maintain the Examulator application

• Diagnose and repair defects and crashes

• Respond to your support requests and feedback

• Calibrate item parameters and improve the accuracy of the question bank, using data received solely through the opt-in Contribute Results feature

• Decide which platforms, devices, and features to support in future releases

• Comply with applicable law

We do not use information for advertising, profiling, automated decision-making with legal or similarly significant effects, or any form of behavioral targeting.

9. Data Sharing and Disclosure

We do not sell, rent, trade, or otherwise share information about you with third parties for their own purposes. We do not use data brokers, analytics vendors, advertising networks, or third-party tracking software development kits.

The only third parties involved in the operation of Examulator are:

• Google LLC (Google Play): Application distribution, crash reporting, install statistics --- https://policies.google.com/privacy

• Google LLC (Google Sites, Google Drive): Hosting of the version manifest and question database files --- https://policies.google.com/privacy

• ForwardEmail (Our email hosting provider): Storage and delivery of support correspondence you send us --- https://forwardemail.net/en/privacy

• ko-fi (Digital 'tip jar'): Donations voluntarily made by users --- https://more.ko-fi.com/privacy

Contributed result data is received directly by servers we operate. It is not shared with any of the third parties above, and it is not shared with any other party.

We may disclose information if we are legally required to do so --- for example, in response to a valid subpoena, court order, or other lawful request --- or where necessary to protect our legal rights or the safety of others. Because we hold so little information, there is in practice very little that could be disclosed.

If Certification Tool and Die, Ltd. is ever involved in a merger, acquisition, or sale of assets, we will provide notice before any information we hold becomes subject to a different privacy policy.

10. Data Retention and Deletion

Data on your device: You can delete all locally stored Examulator data at any time:

• Android: Open your device's Settings → Apps → Examulator → Storage, then choose Clear storage or Clear data. Uninstalling the application also removes all of its data.

• Desktop/web: Clear the site data for the Examulator application in your browser, and delete the Examulator application folder and its data directory from your computer.

Once removed, this data cannot be recovered by you or by us. We hold no backup copy, because we never receive it in the first place (with the exception of any results you may have separately contributed through the Contribute Results feature; see below).

Data we hold:

• Email correspondence and diagnostic attachments are deleted within 60 days of the issue being closed. You may ask us to delete either sooner by writing to privacy@certificationtoolanddie.com. We will honor the request within 30 days unless we are legally required to retain the message.

• Contributed exam results are retained in our calibration database. Because these submissions are not linked to your identity, we can locate and delete a specific user's contributions only if you provide us with the API key that was used to submit them. Write to privacy@certificationtoolanddie.com with your API key to request deletion; we will delete matching records within 30 days.

Data held by Google: Requests concerning data held by Google Play or other Google services must be directed to Google. You can review and manage much of it through your Google account at https://myaccount.google.com.

11. Data Security

We protect your information primarily by not collecting it. Beyond that:

• Examulator stores its data in the operating system's private, per-application storage area, which is protected by the platform's own sandboxing and, on most modern devices, by full-disk encryption.

• Downloads of the application and question database are performed over encrypted HTTPS connections.

• Contributed result submissions are transmitted over encrypted HTTPS to our API. The API key travels as an HTTP header rather than in the URL, so it is not written to web-server access logs.

• On our servers, API keys are stored as SHA-256 hashes; the raw key value is not retained after issuance.

• We keep no user database, so there is no central store of user information to breach. The calibration database that receives contributed results contains no personally identifying information.

No method of electronic storage or transmission is completely secure. The security of data on your device also depends on your own device security --- screen lock, operating system updates, and the other applications you install.

12. Children's Privacy

Examulator is a professional certification study tool intended for adults and older students preparing for information security certifications. It is not directed to children.

We do not knowingly collect personal information from children under 13 (or under the applicable age of digital consent in your jurisdiction, which is up to 16 in parts of the European Economic Area and the United Kingdom). Because the application collects no personal information from anyone, we do not believe it is possible for a child to transmit personal information to us through the application itself. The Contribute Results feature transmits no personal information regardless of the user's age.

If you believe a child has sent us personal information --- for example, by emailing us --- please contact privacy@certificationtoolanddie.com and we will delete it promptly.

13. Your Privacy Rights

Depending on where you live, you may have rights over your personal information. These include the right to access, correct, delete, restrict, or object to processing of your data, the right to data portability, and the right not to be discriminated against for exercising these rights.

For most users, these rights have little to act upon, because we do not hold personal information about you. Your study data is on your own device and entirely within your control, and you may delete it at any time as described in Section 10.

Where we do hold information --- that is, email correspondence you have sent us and, if you have used the Contribute Results feature, contributed session data indexed only by an API key --- you may exercise these rights by writing to privacy@certificationtoolanddie.com. We will respond within the time frame required by applicable law, generally within 30 days. We do not charge a fee for reasonable requests and we will not treat you differently for making one.

Residents of the European Economic Area and the United Kingdom

Where we process personal data (essentially, support correspondence), our lawful basis is our legitimate interest in responding to and resolving user-reported issues, and, where you have initiated contact, the performance of steps taken at your request. For contributed result data --- which contains no personally identifying information and is indexed only by a random API key --- we consider it to fall outside the scope of "personal data" under GDPR Article 4(1); to the extent any regulator concludes otherwise, our lawful basis is your explicit consent, given by pasting the API URL and pressing the Contribute button, which you may withdraw at any time by requesting deactivation of your API key.

You have the right to lodge a complaint with your national supervisory authority.

Certification Tool and Die, Ltd. is established in the United States. If you email us or contribute results, your data will be processed in the United States.

Residents of California

We do not sell or share personal information as those terms are defined by the California Consumer Privacy Act, as amended by the California Privacy Rights Act, and we have not done so in the preceding twelve months. We do not collect personal information from users through the application, and therefore we do not use or disclose sensitive personal information for any purpose requiring a right to limit. Contributed result data, which contains no personally identifying information, is not treated as personal information under the CCPA.

14. International Users

Examulator may be downloaded and used anywhere Google Play or our website is available. The application stores your data locally on your device, wherever you are. Any email you send us --- or any result you contribute through the Contribute Results feature --- will be received and stored in the United States, which may have data protection laws different from those of your country. By contacting us or by pressing the Contribute button, you consent to that transfer.

15. Third-Party Links and Content

Examulator and our website may reference or link to third-party resources --- for example, certification body websites, study materials, or reference sources cited in question explanations. We do not control those sites and are not responsible for their content or privacy practices. We encourage you to review the privacy policy of any site you visit.

Examulator is an independent study tool. It is not affiliated with, endorsed by, sponsored by, or otherwise connected to (ISC)², ISACA, or any other certification body, and any certification names or marks used are the property of their respective owners.

16. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes in the application, in our practices, or in applicable law. When we do, we will revise the "Last updated" date at the top of this page and post the new version at the same URL.

If we make a material change --- for example, if a future version of Examulator begins collecting information it does not collect today, or expands what fields are transmitted through the Contribute Results feature --- we will provide prominent notice, such as an in-application notice or a note in the release changelog, before the change takes effect.

We encourage you to review this policy periodically.

17. Contact Us

If you have questions about this privacy policy or about how Examulator handles data, you can reach us through postal mail, phone, our website or via email.

Certification Tool and Die, Ltd.
Attn: Data Protection Officer
351 Smith Street #28003
Providence, RI 02908
1.401.684.0091

www.certificationtoolanddie.com

privacy@CertificationToolAndDie.com

We will do our best to respond promptly to any privacy-related inquiries.