DecipherU
Sign inStart practicing

What we keep

Bespoke Intermedia LLC, the data controller. Effective September 1, 2026.

When you practice here we keep your answers, how sure you were, how long each one took, the exam date you set and how the exam went. We use that to learn which practice predicts passing and we publish what we learn only as aggregates. Nothing is sold and nothing is published by name. If you would rather we kept nothing, you can opt out and keep practicing.

What we record

The practice tool records events as you use it. In the order you meet them, it records which answer you chose on each question, whether it was right, how long it took, and whether you changed your mind before submitting; how sure you said you were (sure, think so, guess); when you open the source document shown after a question; when you flag a question and the note you type; when a practice session starts and ends; the exam date you set; the exam outcome you report (passed or not, the score band if you give it, which domains felt weak, which attempt it was); your answers to the follow-up questions we send about 90 and 180 days after the exam; profile answers you give voluntarily (prior experience, current and target role, hours per week, country, exam language, materials used, how you heard about us); and the channel that brought you here (search, a link, direct) and the type of device you use (phone, tablet, desktop). Every event is tagged with the exam and exam version, the language you used, and the channel you arrived by. A free account is required after your first practice question. At sign-up, through Clerk, we hold your first name, last name, and email address, and a phone number if you choose to give one. We do not sell this information. We use it to keep your progress attached to you across devices and to contact you about your own exam prep.

What it is used for

We use the events to show you your own readiness by domain, to pick the next question, to send you the reminder and follow-up emails you asked for, and to work out which kinds of practice predict passing. Findings are published as aggregates: pass rates by domain, by hours of study, by exam language, and so on. We do not sell the data, share it with advertisers, or publish anything that identifies a person.

Cookies

The practice tool sets four first-party cookies. None of them is shared with another site. dcu_a: A random id so we can tell that two practice sessions came from the same browser. It holds no name, email or device detail. Lasts 365 days. dcu_s: A session id so answers given in one sitting are grouped together. Lasts 30 minutes after your last action. dcu_ch: Which channel brought you here the first time (search, a link, direct). Set once per anonymous id. Lasts 365 days. dcu_optout: Set to 1 when you opt out. While it is present we record nothing about your practice except the fact that you opted out. Lasts 365 days.

Signing in sets Clerk's session cookies. Analytics and marketing tools listed below set their own cookies, and only after you accept that category in the cookie banner. The cookies page lists all of them in one place.

How to opt out

Go to /privacy/opt-out and press the button. It sets dcu_optout=1 in your browser, and from then on we record nothing about your practice except that you opted out. Practice still works; you just lose the readiness reading, because we have nothing to compute it from. Clearing your cookies removes the opt-out, so come back to the same page if you change browsers or devices.

Who else processes it

These companies process data on our behalf. Those marked as needing consent run only after you accept that category in the cookie banner.

  • Vercel: Hosting, edge compute, and page-level traffic analytics. United States. Required to run the site. Privacy policy.
  • Supabase: Postgres database hosting. United States (eu-central available on request). Required to run the site. Privacy policy.
  • Clerk: Authentication and identity. United States. Required to run the site. Privacy policy.
  • Stripe: Payment processing. United States with EU sub-processing. Required to run the site. Privacy policy.
  • Resend: Transactional email delivery. United States. Required to run the site. Privacy policy.
  • Anthropic: AI inference for scenario explanations and coaching. United States. Required to run the site. Privacy policy.
  • Sentry: Error monitoring. United States. Required to run the site. Privacy policy.
  • PostHog: Product analytics. United States with EU hosting available. Only with analytics consent. Privacy policy.
  • Microsoft Clarity: Session replay and heatmaps. United States. Only with analytics consent. Privacy policy.
  • Google Analytics: Web analytics. United States. Only with analytics consent. Privacy policy.
  • Meta (Facebook): Advertising pixel and Conversions API. United States. Only with marketing consent. Privacy policy.
  • LinkedIn: Advertising insight tag. United States. Only with marketing consent. Privacy policy.

Legal bases

Where the GDPR or UK GDPR applies, we rely on performance of a contract to run the tool and your account, on our legitimate interest in understanding what predicts passing and in keeping the site secure, and on your consent for analytics and marketing cookies and for the follow-up emails. You can withdraw consent at any time through the cookie banner, the unsubscribe link in any email, or the opt-out page. Where you volunteer profile answers, giving them is the consent.

Automated decisions

The readiness reading is computed automatically from your answers. It is informational: it does not decide anything about you, it is not shared with employers or certification bodies, and it has no legal or similarly significant effect. If you want a person to look at it or explain it, write to privacy@decipheru.com.

Where the data lives

Our servers and database are in the United States, so if you are outside the US your data is transferred there. For people in the EEA, UK and Switzerland the transfer relies on the standard contractual clauses in our processors' data processing agreements and, where the processor is certified, the EU-US Data Privacy Framework. Data is encrypted in transit and at rest.

How long we keep it

Practice events are kept for research for as long as the tool exists, because forgetting curves and pass rates only make sense over years. Account details are kept while the account exists. If you ask us to delete your data, we delete your account and every event tied to it within 30 days. Aggregates already published stay published, because nobody can be identified from them.

Your rights

Wherever you live, you can ask to see the data we hold on you, correct it, delete it, receive a copy, restrict or object to how we use it, and opt out of anything that counts as a sale or share under your local law. We do not sell or share personal information as those words are used in the California Consumer Privacy Act, and we do not use it for targeted advertising. File a request at /data-request or email privacy@decipheru.com; we answer within the deadline your law sets, and within 30 days in any case. You can also complain to your data protection authority. The GDPR and California pages say the same things with the article numbers.

Under 18

The site is for adults. We do not knowingly collect anything from anyone under 18, and the age gate at sign-in asks. If you believe a minor has an account, tell us at privacy@decipheru.com and we will delete it.

Changes and contact

When this page changes, the date at the top changes; for material changes we tell you by email or on the site first. Questions and requests: privacy@decipheru.com, or by post to Bespoke Intermedia LLC, Florida, United States.