This is a small site that sells one thing. The data story is correspondingly small, and this page describes it accurately rather than defensively. If something here is unclear, email help@escheat-sheet.com and a person will answer.
We collect your email address, your answers to practice questions, and — if you buy — a payment record that Stripe holds on our behalf. We run advertising pixels from Google and Reddit on every page. We do not sell your data. Email us and we will delete your account and everything attached to it.
Everything below is the same statement with the details filled in.
Collected in three places: when you create an account, when you finish the free 20-question diagnostic and ask to see your results, and when you pay (Stripe collects it at the card form and passes it back to us).
We use it to identify your account, to send you a sign-in link, and — honestly — to email you about the product. If you gave us your address at the diagnostic and never came back, you are on a list we may email. Every such email has an unsubscribe, and asking us directly works just as well.
When you complete the free diagnostic and enter an email, we store the email along with your score and the number of questions, so we know how you did and do not create a duplicate record if you retake it. That is the whole record.
If you have an account, we store which questions you have answered, how many times you got each one right or wrong, and a history of your recent practice sessions (content area, score, total, timestamp). This is what makes progress follow you between devices.
If you do not have an account, that same progress is kept in your browser's local storage and never leaves your device. Clearing your browser data deletes it, and we cannot recover it because we never had it. If you later sign in, the local progress is folded into your account.
We never see your card. Payment runs entirely through Stripe Checkout on Stripe's own pages. What comes back to us is a session identifier, whether the payment succeeded, the amount and currency, and the email address you paid with. We store the fact that your account has paid access. Stripe stores the payment details under its own privacy policy.
Our host records standard server logs (IP address, user agent, requested URL) as part of serving the site. The Google and Reddit tags described below set their own identifiers and report page views and conversions back to those companies.
No card numbers. No name, phone number, employer, or postal address — we never ask. No location beyond whatever an IP address implies. No third-party data purchased about you. No session recording or heatmapping.
Two advertising tags load on every page of this site, including this one, and they fire on page load before you do anything:
Both set cookies and both send data to their respective companies, who use it for their own purposes under their own policies: Google and Reddit. We use them because advertising is how anyone finds this site, and without conversion data the advertising cannot be made to work.
There is currently no cookie banner and no consent toggle on this site. If you do not want these tags running, a content blocker stops them — the site is built to work normally when they are blocked, and blocking them costs you nothing. We also skip both tags entirely on localhost during development.
Beyond those two, we use browser local storage for your own settings and anonymous progress, and Supabase sets a session cookie/token so you stay signed in. Those are functional, not advertising.
Five companies, each doing one job. We do not sell data to anyone, and we do not share it with anyone outside this list.
| Who | What they get | Why |
|---|---|---|
| Supabase | Email address, account record, practice progress, diagnostic score | Database and sign-in. This is where your account actually lives. |
| Stripe | Email address, card details you enter on Stripe's page, payment record | Processing the $39 payment and issuing refunds. |
| Vercel | Server logs: IP address, user agent, requested URL | Hosting and serving the site. |
| Page views, conversion events, advertising identifiers | Measuring whether ads work. | |
| Page views, sign-up and purchase events, advertising identifiers | Measuring whether ads work. |
We may also disclose data if we are legally required to, or in the unlikely event this small product is sold to someone else — in which case this policy travels with it and we would say so on the site.
Email help@escheat-sheet.com from the address you used, and say what you want.
That is the whole process. There is no form, no portal, and no account-settings page you have to find. We will:
We aim to do it within a few days and will not take longer than 30 days. Deleting your account removes your access to the question bank — we will say so before we do it, so nobody deletes a purchase by accident. Stripe's own payment records are outside what we can erase; you would need to contact Stripe about those.
You have the right to know what personal information we collect, to get a copy of it, to have it deleted, to correct it, and not to be discriminated against for exercising any of those rights. We do not sell personal information, and we do not share it for cross-context behavioural advertising in the sense the statute means — but note that the Google and Reddit advertising tags described above are exactly the sort of thing that some readings of “share” cover, which is why they are documented here in detail rather than buried. If you want them off your visit, block them or email us and we will delete what we hold.
You have the right to access, correct, delete, restrict, port, and object to our processing of your data, and to withdraw consent at any time. Our legal bases are: contract for your account, progress, and purchase; legitimate interests for basic security and for product email to people who gave us an address; and consent where consent is required. You may complain to your national supervisory authority.
In practical terms: this is a US-based site with US-based vendors, so your data is processed in the United States. If that is not acceptable to you, do not create an account — and the free practice questions work without one.
Ask us for the same things. We do not run a two-tier system based on where you live.
Security. Data lives in Supabase behind row-level security, which is what actually gates who can read the paid question bank. Payments never touch our servers. We use reasonable measures; nobody can promise perfect security and we are not going to.
Children. This is a professional certification study aid. It is not directed at children under 13 and we do not knowingly collect their data. If you believe we have, email us and we will delete it.
Changes. If we change this policy we will update the date at the top. If the change is material — a new vendor getting your data, a new category collected — we will say so on the site rather than quietly editing this page.
LAST UPDATED: AUGUST 2026 · CONTACT: help@escheat-sheet.com