Privacy Policy
Last updated: 1 October 2026
MockRoom is a set of study tools for cloud certification exams, published at mockroom.dev and its per-exam subdomains such as aif-c01.mockroom.dev. This policy explains what happens to your data when you use them.
The short version. Every study tool works without an account, and while you are signed out your progress is stored in your own browser and is never sent to us. There is an optional account whose only purpose is to back that progress up and move it between devices; creating one is a deliberate choice, it signs in through Google, and it is the one thing that puts a copy of your progress on a server. The only other thing that reaches us is feedback you choose to write and send, described in section 5, which never includes your progress or answers. We do not sell, share, or profile your data, and there is no advertising or third-party tracking on the site.
1. Who we are
MockRoom is operated by Studio Tansy. For any privacy question or request, contact us at [email protected].
2. What we do not collect
We want to be specific, because "we value your privacy" means very little on its own. MockRoom does not:
- require an account to study. Every question, drill, mock exam, and review tool works signed out, and nothing is withheld from a learner who never signs in;
- ask you for a password, or hold one. The optional account signs in through Google, so no password ever reaches us;
- upload your answers, scores, confidence ratings, or review history while you are signed out. The one thing you can send us from the study tools is feedback you write yourself, described in section 5, and the app adds nothing from your progress to it;
- use advertising cookies, tracking pixels, fingerprinting, or cross-site identifiers;
- sell or share personal information with data brokers or advertisers;
- load third-party scripts into the study tools. The only third-party script anywhere in the product is the Cloudflare Turnstile check on the sign-in step, described in section 4, and it never loads while you are studying.
3. Study data stored in your browser
Everything the study application remembers is kept in your browser's local storage on the device you are using, and is readable only by the site that wrote it. While you are signed out it stays on that device and is never transmitted to us. The optional account in section 4 is the only thing that sends a copy anywhere, and only once you have signed in. The application stores or reads:
| Stored item | What it holds |
|---|---|
aifc01.v2 | Current practice attempts and completed attempt history, including your answers and any notes you add to results. |
aifc01.v1 | Practice data from an earlier version, retained so existing progress is not lost. |
aifc01.recall.v1 | Spaced review progress and your self-graded recall confidence. |
aifc01.ui.v1 | Display preferences such as reading size and light or dark appearance. |
Because this data is local, a few consequences follow. Clearing your browser data, using private browsing, or switching device or browser will lose your progress. Anyone with access to your device and browser profile can see it. If you have not signed in, we cannot recover it for you, because we hold no copy of it. Recovering progress across devices is the entire reason the optional account exists.
The application provides an export function that writes this data to a backup file you control, and an import function to restore it elsewhere. That file is produced and read entirely in your browser.
4. The optional account
Availability. The optional account is rolled out one exam room at a time. If the room you are using shows no Sign in control, no account can be created there and nothing in this section applies to you: your studying is local-only, exactly as sections 2 and 3 describe.
The account has one purpose: to keep a backup of your study progress so you can carry it to another browser or device. It is optional in the ordinary sense of the word. Studying, drills, mock exams, spaced review, export, and import all work without it, and nothing is held back from a learner who never signs in.
Signing in
Sign-in uses Google. You are sent to Google, you approve the request there, and Google returns a signed identity to us. We never see your Google password. From that identity we store your Google account identifier, your email address, and your display name, and we generate our own random account identifier that is not derived from any of them. We request only the openid, email, and profile scopes, so we cannot read your Gmail, Drive, contacts, or anything else in your Google account. Google's own handling of the sign-in is covered by the Google Privacy Policy.
The sign-in step is protected by Cloudflare Turnstile, a privacy-preserving alternative to a CAPTCHA that checks the request comes from a real browser rather than a script. It is the only third-party script in the product, it loads only on that step, and it sets a cookie and uses browser storage to remember the result of its check. It is there because account creation is the one action that writes a permanent record; it is deliberately absent from the study pages, which need no such protection.
What is stored on the server, once you sign in
- an account record: our random account identifier, your Google account identifier, your email address, your display name, and the times the record was created and last changed;
- one progress snapshot: your practice attempts and history, and your spaced-review progress, keyed by stable question and card identifiers, together with the times it was saved. It deliberately excludes question text, reference material, your display preferences, and the legacy practice store;
- a small amount of bookkeeping used to detect two devices saving at once and to refuse a client stuck in a loop.
The snapshot is written only at checkpoints you cause: signing in, signing out, submitting an attempt, finishing a review session, importing a backup, and leaving the tab when nothing is open. It is never written on a timer and never per answer. Your browser stays authoritative: what is on your device is merged with what is on the server, and a network response never replaces an attempt you have in progress.
The database is Cloudflare D1, operated by Cloudflare as part of the same platform that serves this site, and our server code runs on Cloudflare Workers. The database is reachable only by our server, never by your browser. Cloudflare holds the data on its own network rather than in a region we pin, so if you are outside the country it is held in, signing in transfers this data there. Cloudflare acts as our processor, and its data-processing terms govern where it is held.
Keeping it, and deleting it
We keep the account record and the snapshot until you delete them. Delete account in the saving panel removes the account record, the progress snapshot, and the bookkeeping, and signs you out. Progress already on your device is kept, and you can carry on studying signed out. Signing out on its own removes nothing from your device and does not delete the account.
5. Feedback you send us
You can tell us about a wrong question, a bug, a privacy concern or an exam you would like added, by email to [email protected] or through a Send feedback button where one is shown. Sending feedback is always your choice, and nothing in the study tools depends on it.
- How it reaches us. Feedback is emailed to us and is not stored by the app. It is kept in our inbox for up to 12 months. To have it deleted sooner, write to [email protected].
- Your name and email. If you give a name, or an email address so that we can reply, we use them only to reply to you. We never share them and never use them for advertising.
- What we include with it. A feedback button adds the page you were on, your browser's user-agent string and window size, whether you were signed in, and, for a report about a question, which question. It never includes your progress or your answers.
- Limiting abuse. To cap volume we keep a count of how many feedback messages were sent per hour and per day. It holds the time of each send and nothing else: no content, no name and no identifier.
6. Study content
When you open a study room, your browser downloads the question catalogue and reference material as static files. These are ordinary web requests for public content. They tell us nothing about your answers or your progress.
7. Hosting and server logs
The site is hosted on Cloudflare Pages. Like any web host, Cloudflare processes technical information needed to deliver the site and protect it from abuse, which may include your IP address, the time of the request, the page requested, and your browser's user-agent string. This processing happens as part of hosting and security, not as analytics we have configured, and we do not use it to build a profile of you.
Cloudflare's handling of that data is described in the Cloudflare Privacy Policy.
8. Links to other sites
The study app lists the official AWS certification and documentation pages it was written against, so you can verify claims at the authoritative source. Those sites have their own privacy policies, and this one does not apply to them.
9. Cookies
While you are signed out, MockRoom sets no cookies of its own. Nothing on the study pages, the landing page, this page, or the terms page sets one.
The optional account uses two, both set only after you choose to sign in. Both are HttpOnly, so no script can read them; both are SameSite=Lax, so another site cannot cause your browser to send them; and both carry the __Host- prefix, which is a browser-enforced rule that no other site under mockroom.dev can set a cookie of that name for us:
| Cookie | Purpose and lifetime |
|---|---|
__Host-mockroom_session_<exam> | Keeps you signed in, for one exam room only - signing in at aif-c01.mockroom.dev sets __Host-mockroom_session_aif-c01 and does not sign you in at any other exam. Expires after 7 days, and is expired immediately when you sign out of that room. Deleting your account expires every exam room's session cookie at once. |
__Host-mockroom_google_txn_<attempt> | Holds the single-use security values that tie one sign-in attempt to the reply Google sends back. Each attempt gets its own, so signing in from two tabs at once does not break either. Expires after 10 minutes, and is expired as soon as the attempt finishes, whether it succeeded or failed. |
Each exam room is a separate sign-in and a separate saved copy of your progress, so studying for one certification never reveals or changes what you have done in another. Neither cookie is an advertising or tracking cookie, and neither is readable by any other site. Cloudflare Turnstile sets a cookie and uses browser storage on the sign-in step, as described in section 4. Cloudflare may also set cookies strictly necessary for security and performance as part of hosting.
10. Children
MockRoom is intended for adults preparing for professional certification exams. It is not directed at children, and we do not knowingly collect personal information from children.
11. Your rights
Depending on where you live, you may have rights to access, correct, delete, or port your personal data, or to object to its processing.
If you have not signed in, we hold no account and no server-side copy of your study data, so most of these rights you exercise directly and immediately: your data is in your browser, you can export it, and you can delete it by clearing site data for the relevant MockRoom domain in your browser settings. There is nothing on our side for us to produce or erase.
If you have signed in, we hold what section 4 lists. Access and portability are built in: Export in the app produces the same study record as a file you keep. Erasure is built in too: Delete account removes the account record, the progress snapshot, and the bookkeeping. You can also correct your email address or display name by changing them in your Google account and signing in again, which refreshes what we hold.
To exercise a right you cannot complete in the app, or to ask what we hold, contact [email protected]. You also have the right to complain to your local data protection authority.
12. Features that are not active yet
We would rather describe planned features honestly than quietly add them later. The following are not active, and this policy will be updated before any of them is switched on. The optional account described in section 4 used to be listed here; it is documented above because the policy has to be correct on the day it is switched on rather than after.
- Advertising. If advertising is introduced, we will name the provider here, describe the consent mechanism, and state what is shared. Your answers, scores, confidence ratings, error labels, and review history will not be shared with an advertising provider.
- Usage analytics. If we add analytics, we will use a privacy-preserving, non-tracking option and disclose it here.
13. Changes to this policy
If this policy changes materially, we will update the date at the top and, where the change affects how your data is handled, describe it on this page. Continuing to use MockRoom after a change means you accept the updated policy.
14. Contact
Questions about this policy: [email protected].