--- title: "Privacy Policy | Cred Farmer" url: https://credfarmer.com/privacy description: "How Cred Farmer collects, uses and protects your data on its Claude certification exam prep platform, what is stored, and how to export or delete your account." last_updated: 2026-10-22 publisher: "Cred Farmer, an independent study platform, not affiliated with or endorsed by Anthropic or Pearson VUE" --- Legal Hub # Privacy Policy Last updated: 22 October 2026 This Privacy Policy explains how Cred Farmer ("we", "us", or "our") collects, uses, shares, and protects your personal data when you use the Service. For the purposes of India's Digital Personal Data Protection Act, 2023 (the "DPDP Act"), Cred Farmer is the **Data Fiduciary** and you are the **Data Principal**. ## 1. Data we collect We practise data minimisation and collect only what we need to run the Service: - **Account data:** name, email address, and avatar received from your OAuth provider (Google or GitHub) when you sign in. We never receive or store your provider password. - **Study data:** your progress, practice and mock-test answers, streaks, and calculated readiness scores. - **Usage and technical data:** feature-usage events collected server-side via PostHog, plus limited technical data (such as IP address and request metadata) processed to operate and secure the Service. - **Sign-up attribution.** When you create an account we record the page on Cred Farmer you first arrived at and the website that linked you to it, if any, so we can tell which of our pages are useful. We read that website from your browser's referrer or, when your browser sends none, from a website name in the link itself (for example utm_source=chatgpt.com). This is stored with your account, is never used for advertising, and is deleted with your account. We do not store it in your browser. We do not knowingly collect special-category or financial data, and we do not use third-party advertising or cross-site tracking cookies. ## 2. Purposes and legal basis We process your personal data on the basis of your consent, given when you create an account, and where applicable for the performance of our agreement with you and our legitimate interest in securing and improving the Service. We use your data to: - create and authenticate your account; - power your dashboard: compute readiness scores, track streaks, and remember your place in the study guides; - understand feature usage in aggregate to improve the platform; - read the feedback you choose to send us, so we can fix and improve things; - send you occasional email about the Service: new study content, features, and tips relevant to the certifications you are studying for; - publish a review or testimonial you have explicitly asked us to publish, together with any reply from us (see section 4); - share the readiness data described in section 4a with an organisation you have explicitly joined, so it can decide whether to sponsor your exam; and - maintain security, prevent abuse, and meet legal obligations. We do not sell your personal data, and we do not use it for automated decision-making that produces legal or similarly significant effects. ## 2a. Email we send you We send two kinds of email, and you control them differently. - **Service email:** messages you cannot switch off because they are part of running your account, such as confirming that you deleted it or replying to something you sent us. We keep these to a minimum. - **Marketing email:** occasional messages about new content, features, and study guidance for the certifications you enrolled in. We send these on the basis of our legitimate interest in telling existing users about a service they signed up for, and we send at most one a week. Every marketing email carries an unsubscribe link that works in one click, without signing in, and takes effect immediately and permanently. You can also switch marketing email off at any time under Settings, or by writing to us at the address in section 10. Unsubscribing never affects your access to the Service. We record an unsubscribe against your *email address* rather than your account, and we keep that record even if you later delete your account. We do this so that the request continues to be honoured. Without it, deleting your account would make your address contactable again, which is the opposite of what you asked for. That record contains nothing but the address and the fact that it must not be contacted. ## 3. Sharing and processors We share personal data only with service providers who process it on our behalf under contract, including our authentication providers (Google, GitHub), analytics provider (PostHog), and cloud hosting infrastructure. We may also disclose data where required by law or to protect our rights. Apart from the public reviews and testimonials described in section 4 or an organisation you have explicitly joined (section 4a), we do not otherwise share your data with third parties. ## 4. Public reviews and testimonials Feedback you send through the “Share feedback” form from 28 September 2026 onwards is private unless you tick the box on that form to post it as a public review. If you tick that box, or submit a testimonial and tick the publication box, and we then approve it, the following becomes publicly visible on Cred Farmer, on our [public reviews page](https://credfarmer.com/reviews) and possibly among the reviews on our home page: the text you wrote, the rating you gave, any context line you wrote, the certification it relates to, the date you wrote it, the date it was published, and (only if you separately tick the name box) the display name you typed. If you do not tick the name box, it appears as “Verified learner”. **Feedback sent before 28 September 2026.** That feedback was sent under a clear promise: the feedback form, our Terms and this policy all said it would never be published, quoted, or attributed to you. On 28 September 2026 we published some of it on our public reviews page and our home page, with the author’s first name and last initial. That broke the promise, and we have withdrawn all of it. We no longer publish any of that feedback, and we will not publish it again unless its author asks us to by ticking the publication box on the feedback or testimonial form. We still read it privately, as originally promised. **Replies.** We may publish a short reply from Cred Farmer beneath a review, saying that we have noted the point it raises or that we have fixed it. A reply marked as fixed is added only once the fix is live. **We never publish your email address, your profile photo, your account identifier, or any private note you send with a testimonial.** Feedback is published only if you tick the box to post it. The consent choices are recorded separately, with a timestamp and the version of the wording you agreed to. Public pages are indexed by search engines and may be copied, cached, or archived by services we do not control. Please treat anything you publish here as permanently public, even after removal. **Hiding your name or withdrawing.** You can hide your name (the review then shows as “Verified learner”) or withdraw a review or testimonial at any time from your account settings, with no need to contact us. Either takes effect on our live pages immediately. Because our public pages are also pre-built, we then rebuild the site (we aim to do so within 7 days of a withdrawal or a hidden name), and copies may persist in third-party caches and search indexes beyond that. Neither choice affects your account or anything else about your use of the Service. ## 4a. Sharing with an organisation you join Employers and sponsors can use Cred Farmer to fund certification exams for people who are ready to sit them. An organisation can only invite you; it can never add you. Nothing about you reaches an organisation until you open its invitation, read what would be shared, and explicitly agree. **What is shared, with the owner and admins of that organisation only:** the name, email address and sign-in provider of the account you accept with; which certifications you are enrolled in now or enrol in later, and whether you have recorded earning each one; for each certification, your readiness score, gate state, mock attempt count, study progress percent and last active date; and the pass or fail result of any real exam you record. **What is never shared:** your individual questions and answers, your confidence ratings, your drill results, and your scaled exam score. An organisation never receives these, and no organisation-facing page or export can contain them. **Stopping it.** You can leave the organisation at any time from your account settings, and sharing stops immediately. It also stops immediately if the organisation removes you, or if the organisation is deleted. Your own study data is unaffected either way. Your agreement is recorded with a timestamp and the version of the wording you were shown. If we ever change what is shared, we will ask you again, and the organisation will see nothing beyond your name and contact details until you agree to the new wording. ## 5. International transfers Cred Farmer is operated from India. Where a processor is located outside India, we transfer personal data only in accordance with the DPDP Act and subject to appropriate contractual safeguards. ## 6. Retention and deletion We retain your personal data for as long as your account is active and as needed to provide the Service. When you delete your account, we delete or irreversibly anonymise your personal data within a reasonable period, except where retention is required by law. You can export your own study data at any time from the settings page, and you can request deletion by contacting us (see section 7). ## 7. Your rights As a Data Principal under the DPDP Act, you have the right to: - access a summary of the personal data we process and the processing activities; - request correction, completion, or updating of inaccurate or incomplete data; - request erasure of your personal data; - withdraw consent at any time (which does not affect processing already carried out); and - nominate another individual to exercise your rights in the event of death or incapacity, and to grievance redressal. If you are located in a region with additional data-protection laws (such as the EEA/UK or California), you may have further rights, including the right to lodge a complaint with your local supervisory authority. ## 8. Grievance redressal and contact Under the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, we have appointed the following Grievance Officer: **Grievance Officer: Tarun Dagar** Cred Farmer, Gurugram, Haryana, India [privacy@credfarmer.com](mailto:privacy@credfarmer.com) Organisation access remains subject to completion of the required privacy, contact-notice and legal-review checks. To exercise your rights under the DPDP Act or raise any other grievance, write to the Grievance Officer at the address above. We will acknowledge your complaint promptly and resolve it within 15 days (or such other period prescribed by applicable law). For general support, contact [hello@credfarmer.com](mailto:hello@credfarmer.com). ## 9. Children The Service is not directed to children below 16 years of age, and we do not knowingly create accounts for them. Where a user is a child under applicable law, we process their data only with verifiable parental or guardian consent, and we do not undertake tracking, behavioural monitoring, or targeted advertising directed at children. If you believe a child has provided us data without proper consent, contact us and we will delete it. ## 10. Security All traffic to our servers is encrypted over HTTPS. We do not handle or store passwords, relying on secure third-party OAuth providers, and your session is maintained through a secure, HttpOnly cookie (see the [Cookie Policy](https://credfarmer.com/cookies)). We apply reasonable technical and organisational safeguards and will notify you and the Data Protection Board of India of a personal-data breach as required by law. ## 11. Changes to this policy We may update this Privacy Policy from time to time. Material changes will be reflected in the "Last updated" date above and, where appropriate, notified within the Service.