Privacy Policy

Last updated: November 13, 2026

This policy describes how Disengage, LLC (“we”) handles information when you use CBLE Practice (the “Service”). It matches the way the site actually works, including the cookie choice in the banner.

Information we collect

  • Account. Your email address and a hash of your password. We do not store the password itself.
  • Study data. The questions you answer, whether you were right, exam sessions, and flashcard progress, tied to your account.
  • Billing. Stripe processes the payment and tells us whether a subscription is active, when the period ends, and a customer id. We do not receive or store your card number.
  • Password reset. If you ask for a reset, we store a hash of a single-use token and when it expires. The email is sent through SendGrid. The page you see afterward is the same whether or not that email has an account.
  • Cookie choice. Described below. The audit log stores the choice, the time, the policy version, a salted hash of a random visitor id kept in your browser’s local storage, a truncated IP address, and the browser’s user-agent string. It does not store the raw visitor id.

How we use it

We use this information to run the Service: to sign you in, score practice, keep your flashcards, bill a subscription, send a password reset you asked for, and remember your cookie choice. We do not sell your personal information.

Cookies

The Service uses one necessary login cookie. When you log in, the site sets a session cookie named cp_session (on the production site, __Host-cp_session). It is HttpOnly and SameSite=Lax. In production it is Secure and is limited to this host. It keeps you signed in for 30 days. It is not an advertising cookie. Reject and Accept do not turn it off, and a subscriber has the same login cookie as anyone else.

A separate first-party cookie, cblepractice-cookie-consent, stores the choice you make in the banner (Accept or Reject) and the version of this policy that was in effect. It exists so we can remember that choice. It is not sent to Google.

Google advertising cookies are optional. The site asks Google to set them only when all of the following are true:

  • You click Accept. Reject and Accept are equal buttons, and nothing is selected for you.
  • Your browser is not sending a Global Privacy Control signal. That signal counts as Reject.
  • Advertising is configured for the site.
  • You are on a free content page. Practice, exams, flashcards, and the dashboard do not show ads.
  • You are not a subscriber. Subscribers never see ads, and they are not shown the banner.

No request is made to Google before Accept. If you reject, or if you accept and later reject, the site deletes Google advertising and analytics storage it can see in this browser (names beginning with _gcl, __gads, __gpi, __eoi, or _ga). Google’s consent mode stays denied until you accept.

How to change your choice. When advertising is configured, the footer has a Cookie preferences link. It opens the same banner so you can Accept or Reject again. A choice saved under an older version of this cookie section is discarded and the banner asks again. You can also clear the cblepractice-cookie-consent cookie in your browser. If your browser sends Global Privacy Control, advertising cookies stay off and the banner does not ask you to override that signal.

Who we share information with

  • Stripe, to take payment and run the billing portal. Stripe’s privacy policy.
  • SendGrid, to deliver a password reset email when one is requested.
  • The host (Railway) that runs the site and the database.
  • Google AdSense, only after Accept, only on free content pages, and never for a subscriber.
  • A government or a court, when the law requires it.
  • A buyer, if we sell or reorganize the business that operates the Service.

How long we keep it

We keep your account, study history, and subscription record while the account exists. Password-reset tokens expire after 60 minutes and cannot be used twice. Cookie-choice log entries are kept so we can show what was chosen. Email james@disengage.com if you want your account deleted. We will delete the account and the study data tied to it, and we will keep a record only where we have to (for example a payment record Stripe already holds).

Children

The Service is not directed to children under 18. The exam itself requires a person to be 18 to sit for it. We do not knowingly collect personal information from children.

Changes

If we change the cookie section, we change the policy date on this page and we ask for your cookie choice again. Other changes will show a new date at the top.

Contact

Questions about this policy: james@disengage.com. Disengage, LLC.