Privacy policy
Effective November 10, 2026
PBQ Lab is the Security+ practice site at pbqlab.com and the PBQ Lab apps for iPhone and Android. It is run by JR Digital Works (“we”). This page explains what information PBQ Lab collects, why, who handles it for us, and how to delete it. Questions go to [email protected].
The short version
- You can practice the free questions without an account. Your progress stays on your device.
- If you make an account, we keep your sign-in details and which plan you have, so your plan works on every device.
- If you sign in and solve PBQs, your solve times can show on the public leaderboard under a name you pick, or an anonymous one. You can hide yourself at any time.
- Payments go through Stripe on the website, and through Apple or Google in the apps. We never see your card number.
- There are no ads. We don’t sell your information, and we don’t track you across other companies’ apps or websites.
- You can delete your account at any time, in the app or by email.
Information that stays on your device
The questions you finish, your answers, a timed exam in progress, your quiz progress and your list filters are saved in your browser’s local storage, or in the app’s own storage on your phone. They are not sent to us. Clearing your browser’s site data, or deleting the app, removes them.
In the app, we also keep on your phone a sign-in token for your account and a copy of the questions your plan unlocks, so they work offline. Signing out removes the token.
Your account
An account is optional. You need one to buy a plan and to use it on more than one device. Accounts are run by Clerk, our sign-in provider. When you sign up, Clerk keeps:
- your email address, and if you sign in with Google, the name and profile picture your Google account shares;
- an account ID, and the date you joined and last signed in;
- basic details about the device and browser you sign in from, used to keep your account secure.
On the website, Clerk sets cookies that keep you signed in. Its sign-in pages may run a Cloudflare check that you’re a person, not a bot. The app signs you in through your phone’s browser on pbqlab.com, then returns you to the app with a one-time code that expires after five minutes.
Our own records
Our server, run on Cloudflare, keeps one record per account: your account ID, which plan you have, when it started or ends, and the reference numbers of the purchases behind it. It does not keep your email address or payment details. We use these records only to unlock the questions you paid for and to answer you if something goes wrong. Leaderboard records are described in the next section.
The leaderboard
When you’re signed in and open a PBQ on the practice page, our server notes the time. When you check it right, your answer is sent to our server so it can confirm it and record how long the solve took. We keep, for each PBQ you solve, the time it took and the date, plus your leaderboard settings and a random player ID. Practice while signed out is never sent.
The leaderboard is public. It shows your solve times and the display name you pick, or until you pick one, an anonymous name like “Analyst K3F9”. It never shows your email address or the name on your account. You can change your display name, go back to anonymous, or hide yourself from the leaderboard on the leaderboard page.
Display names must be respectful. Other players can report a name; we keep who reported which name so each player counts once. A name with three reports is hidden until we review it, and we may reset a name or turn off a player’s leaderboard name if it breaks the rules.
Purchases
On the website, checkout is run by Stripe. Stripe collects your payment details and email address. Stripe sends us a reference for the purchase, the plan, and the email address used at checkout, which we compare with the emails on your account so the purchase lands on the right account.
In the iPhone app, purchases go through Apple’s App Store, and in the Android app through Google Play. Apple or Google takes the payment. We receive the purchase’s transaction ID or purchase token, the product, its dates and whether it is still active or was refunded. To tie a purchase to your account, the app attaches a random ID made from your account ID; it contains no personal details.
Stripe, Apple and Google keep their own records of your purchases under their own privacy policies.
Visit statistics
The website may count visits with Cloudflare Web Analytics. It records which pages are viewed, the referring site, the browser and device type and the country, without cookies and without building a profile of you. We use it only to see which pages people use. The apps don’t use it.
Who handles your information
We share information only with the companies that run PBQ Lab for us, and only what each one needs:
- Clerk: accounts and sign-in.
- Cloudflare: hosts the website and our server and stores our account records. Like any web host, it sees your IP address and browser details when you visit, and uses them to deliver pages and block attacks.
- Google Fonts: serves the site’s typefaces, so Google receives your IP address and browser details when a page loads its fonts.
- Stripe: website payments.
- Apple and Google: app downloads and in-app purchases.
We may also share information if the law requires it. We don’t sell or rent your information, we don’t show ads, and we don’t use your information to track you across other companies’ apps or websites.
How long we keep it
We keep your account and our record of your plan for as long as you have an account. When you delete your account, we delete your Clerk account, our record of your plan and purchases, and your leaderboard times, name and reports. We keep only your account ID, for up to 31 days, so that copies of the app that were signed in to it stop working. One-time app sign-in codes are deleted after five minutes.
Delete your account
In the app: open Account and tap Delete account. It deletes your account right away.
Without the app: email [email protected] from the email address on your account, and ask us to delete your PBQ Lab account. We’ll delete your account and the records above, and reply when it’s done.
Deleting your account doesn’t cancel a monthly plan, because Stripe, Apple or Google bills it. Cancel it first: on iPhone in Settings under Subscriptions, on Android in Google Play under Payments and subscriptions, and for a plan bought on the website, email us and we’ll cancel it. The progress saved on your device stays there until you clear it.
Your choices
You can ask us for a copy of the information we hold about you, to correct it, or to delete it, by emailing [email protected]. You can change your email address and sign-in methods yourself from your account page.
Children
PBQ Lab is meant for people studying for a professional certification. It isn’t directed at children under 13, and we don’t knowingly collect information from them. If you think a child has made an account, email us and we’ll delete it.
Security
Every connection to PBQ Lab is encrypted. Passwords aren’t used: you sign in with an emailed code or your Google account. Card details go only to Stripe, Apple or Google.
Changes to this policy
If we change what PBQ Lab collects or how it uses it, we’ll update this page and the date at the top before the change takes effect.