Privacy Policy

Effective date: March 16, 2026  ·  Last updated: October 27, 2026 (rev. 31)  ·  gcprep.app

1. Who We Are

GC Prep is a contractor exam study application available at gcprep.app. The application is operated by MasonByte LLC, a Maryland-based technology company. You can reach us at .

2. Information We Collect

We collect the following categories of information when you use GC Prep:

• Account information: When you sign in with Google or Facebook, we receive your email address and display name from that provider. We do not receive your password from either provider. You may also sign in with an email and password, which is stored securely in our authentication system (Supabase) and never transmitted in plain text.
• State-required course records (Virginia prelicense education): If you enroll in our Virginia prelicense education course and claim a completion certificate, we collect your legal name (including middle name and generation, if you have one), your mailing address, your date of birth, and your Virginia DMV control number if you have a Virginia driver’s license or ID card. If you do not have one, we record the state that issued your ID (not its number), and we ask for your Social Security number instead, and only then. The Virginia Department of Professional and Occupational Regulation (DPOR) has told us that a completion roster must give each student’s Virginia DMV control number or Social Security number, and accepts no other state’s ID. Giving it is your choice, but without one of the two DPOR cannot credit your completion. If you would rather not give us your Social Security number, you can get a Virginia DMV ID card and give us its control number instead. We never ask for a Social Security number from a student who has a Virginia DMV control number, and never for any other purpose. Virginia regulation 18VAC50-22-310 B requires an approved education provider to keep a record for each student that includes the student’s name and address and, if applicable, Virginia DMV control number, and to report course completions to the Board. We ask for this information only at the point you claim a certificate for that course, we use it only to identify you on that record and on the completion roster we provide to the Board, and we do not use it for marketing or disclose it to anyone else. If you do not take that course, we never ask for any of it. See Section 5 for how long these records are kept.
• Purchase information: When you purchase access, Stripe processes your payment. We receive a session ID and the product purchased from Stripe to confirm your entitlement. We do not store your credit card number, billing address, or any payment card data.
• Quiz activity: We store your quiz section scores, session history, and individual question results (correct or incorrect) in your account. This data is used to display your progress on the transcript page.
• Optional contact information: If you choose to add a backup email address or phone number on the Security page, we store this to help you recover account access. This information is never shared with third parties or used for marketing.
• Gamification and progress: If you participate in the leaderboard (Honor Roll) or points system, we store your total points, current streak, and study time. Your display name on the leaderboard is the name you enter when you join it; we suggest the name on your sign-in account, and you can change it later on the Preferences page. You may opt out of gamification on the Preferences page, which removes your data from the leaderboard.
• Compliance newsletter subscription: If you subscribe to our compliance digest, we store your email address and the states you selected. You may unsubscribe at any time via the link in any digest email or in your profile settings.
• Peer referral codes: If you share a referral link with another user or use one shared with you, we store the referral code, the referrer’s account ID, and the referee’s account ID for the purpose of attributing rewards. Referral metadata is removed if either party deletes their account.
• Company roster records (people an employer tracks): If your employer uses the GC Prep Renew Company console, a manager at that company may enter you on its roster. For each person on a roster we store the name, work email, work phone, and trade role the manager enters, and for each credential they track: the credential name, issuing state or issuer, credential number, issue and expiration dates, a link to any proof document the manager provides, and the manager’s own notes. We use these records only to show the company its roster and to send that company’s managers renewal reminders; we do not use them for marketing and we do not sell them. The company that entered the record controls it — it decides who is on the roster, what is tracked, and when a record is removed, and its managers can see everything on it. A roster entry is separate from your own GC Prep account: being listed does not give the company access to your personal account, quiz activity, or progress unless you separately occupy a seat that company purchased. If you are on a roster and want to know what is held about you, or have it corrected or removed, contact your company’s manager; you may also contact us and we will refer the request to that company.
• Company profile (what a company says about itself): A company’s managers may fill in a company profile in the Company console: the company’s legal name, the name it does business as, its city and state, its trades, and a short description. The profile holds no street address, phone number, email address or website, and those fields are refused if typed in. We show the profile to people the company invites, so they can see who is asking before they accept, and to that company’s own members. It is the company’s own statement: GC Prep does not verify it. The company’s managers can change it at any time, and it is deleted with the company’s account. A company may also list its own credentials (licenses, insurance, bonds and business certifications: a name, the issuer, the number, the dates and a link to the issuing agency’s own lookup page). Each one is private to the company’s managers until they choose to show it on the company card; the lookup link can only point to a government site or an issuer we have reviewed, never to the company’s own site. GC Prep does not verify these either.
• Sharing credentials with a company you work for: A company you work for or with (for example, a general contractor) may ask you, or your company, to share credentials with it. Nothing is shared unless you accept. Once you do, that company can see, for each credential you share, its name, state, expiration date and status, and its number and proof link only if you choose to show them. It sees your record as it stands, and its view through GC Prep ends the moment either side ends the connection, when the sharing records are deleted. It may also export what it sees for its own proposals, bids, solicitations and compliance needs. GC Prep cannot recall a copy it has saved or exported, and does not log what it exports or does with shared records; returning or deleting a copy is between your company and theirs (Terms, Section 9a). It cannot forward your records to another company through GC Prep. You can hide any single credential, keep your name from that company, and stop sharing at any time. Sharing is confirmed once a year; if it is not renewed within 30 days of its anniversary, it pauses until it is. We keep a record of each yearly agreement: its date, its version and a fingerprint of the wording agreed to. A company can also see which companies have viewed its company profile. GC Prep does not verify shared credentials, does not sell them and does not use them for advertising. A general contractor your company is linked with may also send your company a copy of the license and insurance details it has on file about you (Send a copy). Nothing sent this way becomes your company’s record until one of your managers keeps it; a kept copy is private to your company’s managers unless they choose to share it.
• Usage data: We may collect general usage information such as which sections you access and how often, for the purpose of improving the application.

3. How We Use Your Information

• To authenticate your identity and maintain your session
• To verify your purchase and unlock the content you paid for
• To display your quiz history and progress across sections
• To send transactional emails related to your account (purchase confirmation, password reset)
• To create and keep the student record that Virginia requires of an approved prelicense education provider, and to report your completion to DPOR on the roster its rules require. For a student with no Virginia DMV control number, that roster row carries the student’s Social Security number.
• To improve the app and fix bugs
• To occasionally invite you to a brief in-app satisfaction micro-survey (NPS, less than 10 seconds). Survey responses are stored anonymously by user-bucket and are not linked back to your identity in analytics. You may dismiss without responding and may opt out of future surveys at any time in your Profile settings.
• To bucket your account into A/B test cohorts for in-app feature flags (e.g., interface variants under evaluation). Cohort assignment uses a deterministic hash of your account ID and is not personally identifying. Feature-flag exposure data is aggregated for product decisions only and is never shared with third parties.
• Issue completion certificates for study milestones, including certificates for the DPOR-approved six-hour Virginia pre-license education course for eligible Virginia users.
• Provide organizational managers with roster data (employee seat status, study hours, completion status) as authorized by your organization’s account agreement.
• Send optional study reminders, expiry alerts, and completion notifications (you may disable these in Profile settings).
• Send an automated welcome email sequence upon sign-up (Days 0, 3, and 7) with study tips, pricing details, and product information. You may opt out via the unsubscribe link in each email or in your Profile settings.

We do not use your information for advertising profiling, and we do not sell or rent your personal data to any third party.

4. How We Store Your Information

Your account data is stored in Supabase, a cloud database service with servers located in the United States (us-east-1 region). Supabase is SOC 2 compliant and encrypts data at rest and in transit. You can review Supabase's privacy practices at supabase.com/privacy.

Payment processing is handled entirely by Stripe, Inc. GC Prep never stores payment card data on its own servers. Stripe's privacy policy is available at stripe.com/privacy.

Authentication is handled by Google OAuth. Google's privacy policy is available at policies.google.com/privacy.

Facebook login is provided via Meta Platforms, Inc. Meta's privacy policy is available at facebook.com/privacy/policy.

Automated and transactional emails are delivered by Resend, Inc. Resend processes only your email address and message content for delivery purposes. Resend's privacy policy is available at resend.com/legal/privacy-policy.

Error monitoring and crash reporting is provided by Sentry. Sentry receives anonymized error stack traces, browser type, and the URL where an error occurred. Sentry does not receive your email address, name, or any personal identifiers — only technical diagnostic data needed to fix bugs. Sentry's privacy policy is available at sentry.io/privacy/.

Usage analytics are provided by Google Analytics 4. It receives page views and in-app events tied to a random identifier for your browser, never your name or email address; we configure it with ad personalization and Google signals switched off and restricted data processing switched on, and we use it only to understand how the app is used in aggregate. Google’s privacy policy is available at policies.google.com/privacy.

Our pages are hosted and served by Netlify, Inc., which keeps standard server logs (request URL, time, IP address) for a short period to operate the service. Netlify’s privacy policy is available at netlify.com/privacy. Cloudflare, Inc. provides a bot check on our partner form (Turnstile) and hides email addresses on our pages from scrapers; it receives the request needed to do that and nothing about your account. Cloudflare’s privacy policy is available at cloudflare.com/privacypolicy.

Your data of record — your account, purchases, activity and certificates — is stored in the United States. A feature that would share your information with a new company will be described here before it ships.

Social Security numbers. If you give us your Social Security number for the Virginia course roster, our server encrypts it the moment it arrives, with a key kept apart from our database. It is never stored readable, and it is never written into logs, error reports, emails, receipts or anything shown on a screen, including our own administrators’ screens. Our server decrypts it only to build your row of the roster, which it sends to DPOR over an encrypted file transfer (SFTP). We do not send it to anyone else.

4a. GC Points and Virtual Game Currency

GC Points are an in-app gamification feature representing study progress, streak engagement, and section mastery. They are NOT real currency, are NOT tradeable for cash or goods, are NOT redeemable outside the app, and have NO monetary value. Earning, spending, or losing GC Points has no real-world financial consequence. The points system is a learning aid only.

GC Prep does not contain any gambling mechanics, loot boxes, or chance-based purchases. GC Points are awarded server-side based on verifiable user actions (correct answers, completed sections, daily streaks).

5. Data Retention

We retain your account data for as long as your account is active. If you request deletion of your account, we begin a 7-day soft-delete grace period during which you may reactivate. After 7 days, your personal data is permanently removed within 30 days, except where we are required to retain it for legal or business purposes (such as records of a completed purchase).

Gamification data (points, streaks, leaderboard scores) is retained as long as your account is active or until you request deletion.

Records a company keeps about a person are kept for 12 months after the person leaves that company’s roster or their seat ends, for compliance audit purposes, and then deleted. That covers the roster entry, the credentials tracked for that person, and the seats and seat grants they held. The log of reminders sent to a company’s managers (each entry holds a name and a partly hidden email address) is kept for 24 months, and then deleted.

Quiz session data is retained for the life of your account so that your progress history is available to you at any time.

We keep data for as long as the laws of the United States require, and otherwise no longer than the periods stated here. We are not obliged to keep anything beyond them. These periods may change when our policies or the way we run the service need them to; when they do, this page changes first, with a new date at the top. Course completion and continuing-education records that a state licensing board requires us to keep are kept for as long as that board’s rules require, even after your account is deleted. Your certificates are not: deleting your account deletes them.

For our Virginia prelicense education course, 18VAC50-22-310 B requires an approved provider to keep each student’s record — name and address, Virginia DMV control number, the course name and clock hours attended, the instructor, and the date of successful completion — for a minimum of five years from the date you complete the course. We cannot shorten that period, and we cannot remove your name from those records during it, because the regulation requires the record to identify the student. If we later offer North Carolina continuing education, 21 NCAC 12B .0206(a) sets a four-year period on the same basis. Deleting your account removes your personal data as described above; it does not reach these specific records until their period ends.

Your full Social Security number is deleted 7 days after you give it, whether or not the roster has been sent. If it has not been sent in that time, we will ask you for it again. We do not keep its last four digits either. We keep only a fingerprint of them: a one-way code made with a secret key, which nobody, including our staff, can read back. If DPOR asks about a roster row and quotes the last four digits, we can check whether they match; every check is recorded. The fingerprint is kept with your course record for the same five years.

When we report a completion to a licensing board, the board receives its own copy of that record. From then on the board controls its copy under its own rules and the public-records laws that apply to it. Deleting your GC Prep account, or a request you make to us, does not change or remove what the board holds; contact the board directly about its records.

6. Your Rights

You have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your account and associated data — with one exception: records a state licensing authority requires us to keep are held for the period that authority sets (see Section 5). Deleting your account never makes us keep your full Social Security number longer: it is deleted 7 days after you give it, and an account deletion itself takes 7 days to complete, so the number is gone by then. The fingerprint of its last four digits stays with your course record for that record’s five years, like your name and address, because it cannot be read back.
• Export your data: from the Account & Data page you can download a copy of your profile, quiz sessions, study time, certificates, purchases and GC Points ledger (one export every 24 hours)

In addition, GC Prep provides the following specific data controls directly in the application:

• Gamification data deletion: Email to delete your points history, streak records, and leaderboard entries. We will complete deletion within 30 days.
• Backup contact removal: Update or delete your backup email and phone number at any time on the Security page. To remove one, clear the box and press Save.
• Notification opt-out: Study reminders and non-transactional alerts can be disabled on the Preferences page.
• Leaderboard (Honor Roll) opt-out: Disable Honor Roll and leaderboard visibility at any time from your Profile page. Your score is removed from public display immediately upon opt-out.
• Facebook data deletion: If you signed in with Facebook, you may request data deletion through Facebook's Apps and Websites settings. Our data deletion callback will process the request and remove your account data within 30 days.

To exercise any of these rights, email us at . We will respond within 30 days.

7. Cookies and Local Storage

GC Prep itself uses your browser's local storage rather than cookies to store the following data locally on your device. Two services we use do set cookies: Google Analytics sets cookies whose names begin with _ga to tell returning browsers apart (see Section 4), and Stripe sets its own cookies on its checkout and billing-portal pages, which are Stripe’s pages, not gcprep.app.

• Quiz progress: Your scores, streak, and section progress are stored under keys prefixed gcprep_. This data stays on your device and is not transmitted to our servers.
• Authenticated session (auth tokens): Supabase stores your login session under a key prefixed sb-. This contains a JWT access token + refresh token used to keep you signed in. The token is cleared when you sign out and is automatically refreshed in the background while you are active.
• Study timer: Active study session data is stored locally to resume if you navigate away.
• Tour preferences: Whether you have completed the in-app guided tour is stored locally.
• Offline question cache (IndexedDB): When you opt-in to offline mode for a state module, the question bank for that module is downloaded to your device and stored in your browser’s IndexedDB. This lets you study without an internet connection. The cached content stays on your device and is not transmitted back to our servers. You may clear it at any time from your Profile page or by clearing your browser’s site data for gcprep.app.

None of this local storage data is sold or shared with third parties. We do not use advertising cookies, tracking pixels, or behavioral tracking cookies of any kind.

Google Analytics (GA4) sets standard cookies (_ga, _gid) to count aggregate page visits anonymously. These do not identify you personally. You can opt out at tools.google.com/dlpage/gaoptout. If your browser sends the Global Privacy Control signal, we treat it as an opt-out: we do not send any analytics from that browser.

You can turn Analytics, and Marketing (remembering which link or ad brought you to GC Prep), on or off at any time. Essential storage, which keeps you signed in and saves your progress, purchases and this choice, is always on. Your choice is kept in this browser. Your privacy choices

8. Children's Privacy

GC Prep is intended for adults preparing for professional contractor licensing examinations. We do not knowingly collect personal information from anyone under the age of 18. The one exception is a person under 18 whom a school or employer enrolls in seats it has purchased, under its own agreement with us and its own authority (Terms of Service, Sections 3 and 9); that person’s information is handled as described in this policy and is visible to the organization’s manager. If you believe a minor has created an account on their own, please contact us and we will promptly delete it.

9. Changes to This Privacy Policy

We may update this Privacy Policy periodically to reflect changes in our practices, technology, legal requirements, or other operational reasons. When we do, we will update the effective date at the top of this page. For material changes that meaningfully affect how we collect, use, or share your personal information, we will notify you by email or by displaying a notice in the app at least 7 days before the changes take effect.

Your continued use of GC Prep after changes take effect constitutes your acceptance of the updated Privacy Policy. If you do not agree to the revised Privacy Policy, you may delete your account at any time via your Profile settings or by emailing support@gcprep.app.

10. Contact Us