Privacy policy

Effective date: November 6, 2026

The web app offers a free account (you can use the free sample without one) and, if you create it, keeps your progress with it, so that it follows you from one browser to another. Purchases on the website are handled by RevenueCat and Stripe, as described below. This website sets no cookies and runs no analytics scripts.

This policy covers the app "A&P Test Prep by the Book" (also called "A&P by the Book"): the web app at app.mechanicbythebook.com and the website mechanicbythebook.com. Both are run by Three Little Geese LLC, a Minnesota limited liability company, called "we", "us" or "our" below. You can reach us at [email protected].

It also covers the Android and iPhone apps, "A&P Test Prep by the Book". They use the same account, the same study progress and the same email choice as the web app, so everything on this page applies to them too, with these differences:

• Signing in. On Android you can sign in with Google, an emailed code or a password. On the iPhone, with an emailed code or a password.
• Purchases. A subscription bought in a phone app is paid to Apple (App Store) or Google (Google Play), never to us directly; we do not see your card. RevenueCat, the service that keeps track of subscriptions for us, receives your account id, the purchase record from Apple or Google, and an identifier the phone gives the app. A subscription bought on the phone is kept with your account.
• Study reminders. If you turn reminders on, they are set on the phone itself and shown by it. Nothing about them is sent to us or anyone else.
• Measurement. The phone apps send no usage measurement.
• Without an account. The phone apps can be used without an account; then your progress stays on that phone only.

What the app does not collect

• No name and no phone number. The web app does not ask for them. It asks for an email address only if you choose to create a free account; see Accounts in the web app.
• No identifying analytics of your study. The web app counts how it is used (for example that a practice session was finished), without your name, your email address, your answers or any identifier of you; see Measurement in the web app. The web app keeps your answers with your account only so that your progress follows you; see Your study progress. The purchase service records when the app last checked your subscription; see Purchases.
• No advertising and no advertising identifiers. The app does not track you across other apps or websites.
• No location, contacts, photos, camera or microphone. The web app learns only which country your connection comes from, to know whether to offer an account, and, to pre-set the email box, reads your device's time zone and language without sending them anywhere; see Accounts in the web app.

Your study progress

The web app keeps a record of which questions you answered, whether you got them right, when, and your practice exam results, for each test you study (General, Airframe and Powerplant). It also keeps your test date if you set one, which lessons you marked as read, and what the flashcards remember about each card: which box it is in, the day it is next due and the day you last judged it.

This record is stored in your browser. While you are signed in, it is also kept with your account by Supabase, our sign-in service, so that it is the same in every browser where you sign in. A practice exam is sent only once it is finished. Signed out, your progress stays in the browser and is not sent anywhere. Signing out removes the account's copy from that browser; the account keeps its own.

With your progress, the account keeps the day the app last showed you the offer at the end of the free sample, and technical records that keep the copies in different browsers in step.

The browser also keeps how much you studied each day (up to 400 days), the day you passed a test if you tell the app, and your settings (appearance and daily goal). None of this is sent anywhere.

You can erase your progress at any time: open the "You" tab, then "Your data", and choose "Reset progress". While you are signed in, this erases it in every browser signed in to your account and in the account's copy. Clearing this site's data in your browser removes the browser's copy. Deleting your account deletes the account's copy; see Deleting your account.

Accounts in the web app

New accounts can be made only in the United States. To know whether to offer one, the web app asks our course server which country your connection comes from. The server repeats what our host, Cloudflare, works out from your internet address, and keeps neither. Anywhere else you can still sign in to an account you already have.

In the web app you can give 10 answers without an account. After that, the free sample's questions, mini exams and flashcards need a free account (your email address only); its lessons and the glossary stay open without one. The account keeps your progress, on the web and in our phone apps. Buying a subscription on the website needs an account too, so that the purchase is not lost with the browser's data.

You can create an account with your email address and a password, with a one-time code we email you, or with Google. Signing in with Apple is not offered. We do not ask for your name.

Your account is held by Supabase, our sign-in service, which stores it in the United States. Supabase gives your account an id and keeps:

• your email address;
• if you choose a password, a one-way scrambled form of it (a hash) that cannot be turned back into it;
• if you continue with Google, the Google identity you linked. Google tells Supabase your email address and an id for you; the app asks Google for nothing else;
• what a sign-in service keeps: when you sign in and, typically, the internet address and the kind of device you sign in from.

When you choose a password, the app checks it against a list of passwords known from data breaches (Pwned Passwords, by Have I Been Pwned). Only the first five characters of a scrambled form of it (its SHA-1 hash) are sent, never the password and never your email address, and the answer is checked in your browser.

While you are signed in, the sign-in service keeps your session in your browser's storage, so that a reload does not sign you out. That session usually includes your email address. Signing out removes it.

The emails that sign you in, confirm your address or reset your password are sent for us by Resend, an email delivery service, from an address at mechanicbythebook.com. Resend receives your email address and the email it delivers.

With your account we also keep:

• your study progress, as described above;
• your choice about email from us, as described in Email from us;
• for a subscription bought on the website: which plan it is, whether it still renews and when the current period ends, so that the app knows how long full access lasts;
• for a yearly plan bought on the website: the date and price of the next renewal, and whether the reminder about it has been sent.

Email from us

When you create your account there is a box: "Email me study tips and offers from us and our partners. Optional; unsubscribe any time." It starts ticked where the app takes you to be in the United States (by your device's time zone and language), and unticked everywhere else. You can untick it before you continue.

• If it is ticked when you create the account, we may use your email address to send you study tips, product news and offers, from us and from partners we choose, and we may share it with those partners so that they can send you their offers. Each partner may use it only under its own privacy policy.
• If it is not ticked, we do not.

Signing in to an account you already have changes nothing unless you change the box. You can change your choice at any time in the web app: open the "You" tab, then "Account", and use the switch under "Email from us".

If the box is ticked, we give our email service, Resend, your email address and whether you have full access (yes or no), and it sends our study tips, product news and offers, starting with a short welcome series. Turning the switch off, or deleting your account, reaches Resend within a day. Every such email has an unsubscribe link; it acts at once and stops this kind of email from all of our study apps.

Each time you make or change this choice, we keep a record of it, so that we can show that we had your permission: whether emails are allowed, whether you changed the box yourself or left it as it was, which version of the wording you were shown, the time our server recorded it, and the time on your device.

If you turn these emails off yourself, we also put a scrambled form of your address (a hash) that cannot be turned back into it on a list of addresses that turned them off. It is kept even after you delete your account, only so that if the same address signs up again, those emails stay off until you turn them on yourself.

Whatever the box says, we use your address to sign you in and to write to you about your account or a purchase when we have to, for example a receipt.

If you buy a yearly plan on the website, we email your account's address about 30 days before each renewal, through Resend. The email gives the date, the price and how to cancel. No reminder is sent if, by then, the plan has been cancelled, refunded or changed to monthly, or has ended.

If the business changes hands. If Three Little Geese LLC, or the app or the website, is sold, merged or transferred, the information described on this page, including your email address and your choice about email, may pass to the new owner, who will be bound by this policy for it until it tells you otherwise.

Purchases

A subscription bought in the web app is paid by card. The card form is provided by RevenueCat, a subscription service, through its Web Billing service, and the payment is taken by Stripe, the payment processor. We never see your full card number.

Each time the web app opens it asks RevenueCat what is on sale and, when you are signed in, whether your account has a subscription. RevenueCat keeps a record under your account's id. The record holds any purchase (which plan, when it was bought, when it renews or ends), the email address you signed in with (it is passed to the card form when you buy), when the web app last checked, and technical details of the browser (its type and internet address). Stripe receives what it needs to take the payment and to prevent fraud. Nothing about your study is sent to either.

The full course is not kept in the web page. When your account has a subscription, the web app fetches the course from our own course server, which runs on Cloudflare, and sends your sign-in session with each request. The session holds your account's id and may hold your email address. The server checks that the session is genuine and asks RevenueCat whether that account has a subscription. It keeps nothing else about you. Each line it logs holds the time, which kind of request it was, its result, and a short scrambled form (a hash) of your account's id, which is not your id and cannot be turned back into it. No line holds your email address or your internet address.

RevenueCat processes this information on our behalf, under RevenueCat's data processing agreement, only to confirm purchases and to show us subscription totals. It is not used for advertising and is not sold.

Purchase records are kept for as long as they are needed to provide the subscription and to meet tax and accounting duties, or until you ask us to delete them.

To ask for the purchase record tied to your account to be deleted, email us your purchase id. It is shown in the app, in the "You" tab under "Your data", as "Your purchase id".

Deleting your account

In the web app, sign in, open the "You" tab, then "Account", and choose "Delete account". That deletes your account at Supabase: your sign-in, your email address, your progress kept with the account, the record of your choices about email, and what we keep about a subscription bought on the website.

A subscription bought on the website that is still renewing must be cancelled first: open the "You" tab, then "Membership", and choose "Manage or cancel subscription". The app does not let you delete the account until then, because nobody could then sign in to cancel it. If you cancelled and the paid period has not ended yet, deleting the account gives up the time that is left.

Deleting your account does not delete:

• the purchase record RevenueCat keeps under your account's id. To have it deleted, email us your purchase id, as described under Purchases;
• the scrambled form of your address described under Email from us, if you had turned those emails off yourself;
• your progress still stored in a browser. Clearing this site's data in the browser removes it.

You can also ask us to delete your account by writing to [email protected] from the address of the account. We reply to that address to confirm before deleting, because the sender of an email can be forged.

Measurement in the web app

The web app (app.mechanicbythebook.com) counts how it is used, so that we can learn what helps people study and what makes them buy.

Each time one of the events below happens, the web app sends a short record of it to our own course server. The server checks it and keeps it in a store run for us by our host, Cloudflare. Each record holds the name of the event, a few counts, yes-or-no values or one-word labels, the time it arrived, and these things beside them:

• the name of the link you arrived by, if it had one, from our own short list (for example the word that marks this website, or one of our social networks); any other word is counted as "other";
• the kind of site that sent you, from a fixed list (for example a search engine, a social network or this website), never the address of the page. This and the name of the link are kept in your browser tab until you close it, so that they are not lost when signing in reloads the page;
• the country your connection comes from, as our host works it out.

These are all the events:

• the app was opened: whether you have full access or the free sample, and whether this copy of the app can sell a subscription;
• the first practice answer in this browser was given;
• a practice session was finished: its kind (for example all questions, a subject area, missed questions, figure questions or calculation questions), how many questions it had and how many were answered correctly;
• a practice exam in the free sample was finished: the band its score fell in (0 to 49, 50 to 69, 70 to 84, or 85 to 100), whether that was a pass, and how many questions it had;
• the last question of the free sample was answered;
• a free account was offered, and at which moment; "Not now" was pressed; a sign-in code was asked for; an account was created; someone signed in; the choice about email was recorded (on or off);
• the plans were shown, and the name of the screen that led to them; a plan was pressed, and a purchase was started, completed, cancelled or failed: which plan; "Restore purchases" was pressed;
• a test date was saved: the number of days until it, not the date (read with the day the record arrived, that number gives the date);
• a lesson was marked as read: how many lessons are now marked, not which; a flashcard session was finished: how many cards and how many needed another look;
• "Report a problem" was pressed: on a question, a lesson or a flashcard, not which one and not what you wrote;
• you said you passed a test; the day's study goal was met (the goal and the streak); a choice on the "You" screen was saved (daily goal, reminders, appearance); the share button was pressed.

A record never holds your name, your email address, anything you type, which question, lesson or flashcard you worked on or any of its text, which answer you chose, your account's id, your purchase id, an identifier of you, your browser or your device, or your internet address. No cookie is used. Because there is no identifier, the records cannot be put together into what one person did: we see only how many times each event happened, and from which kind of link. The server keeps its own copy of the list of events above, with the only labels each may carry, and refuses any record that is not on it. Cloudflare keeps the records for up to three months; we may keep the weekly totals worked out from them.

Links that leave the app

Each question links to the FAA source it is based on. Choosing a source link opens a United States government website (for example faa.gov or ecfr.gov) in your browser. The app sends that website nothing about you, but the website sees an ordinary visit from your browser and applies its own privacy policy.

The links to this privacy policy, the terms of use and the support page open this website in your browser. For a subscription bought on the website, "Manage or cancel subscription" opens the page where you manage or cancel that subscription.

"Report a problem with this question" opens a draft email in your own mail app, addressed to us, with the question's number in the subject. The app does not send the report itself; the web app counts only that the button was pressed, as described in Measurement in the web app. If you send the email, it reaches us like any other email.

This website and email

This website (mechanicbythebook.com) has no advertising, sets no cookies and runs no analytics or other scripts. The company that hosts the site, Cloudflare, Inc., keeps standard server logs, which include visitors' IP addresses and the pages they requested, for security and to keep the site running.

The web app has no advertising and no analytics scripts from other companies; it counts how it is used through our own course server, as described in Measurement in the web app. It keeps your progress, your settings and, while you are signed in, your sign-in session in your browser's storage, as described above.

If you email us, we receive your email address and whatever you write. We use it only to answer you and to fix the problem you report. We delete support email when it is no longer needed, and sooner if you ask.

Who we share information with

The outside services involved in the app and this website are the ones named on this page, each only for the service it provides to us:

• RevenueCat, for confirming purchases and for the card form;
• Stripe, for taking card payments;
• Supabase, for accounts and the progress kept with them;
• Resend, for sending sign-in emails, the reminder before a yearly renewal and, if you allowed it, study tips and offers;
• Cloudflare, which hosts this website and our course server, and keeps the web app's measurement records for us;
• Google, if you choose to sign in with Google;
• Have I Been Pwned, which receives only the five characters described above when you choose a password;
• our email provider, for support email.

If you left the email box ticked when you created your account, we may also share your email address with partners we choose, as described in Email from us. We would also disclose information if the law required it.

Children

The app and this website are not directed at children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child under 13 has sent us personal information, email us and we will delete it.

Your choices and rights

You can read the free lessons and the glossary, and give 10 answers, without an account. After that the web app needs a free account to go on with the free sample, and an account to buy a subscription; it asks only for your email address, never your name. You can erase your progress yourself, change your choice about email, and delete your account, as described above. You can ask us what information we hold about you, ask us to correct or delete it, or object to how we use it, by emailing [email protected]. We will answer within 30 days and we will not treat you differently for asking.

Readers in the European Economic Area, the United Kingdom or Switzerland: the app is offered only in the United States, and new accounts can be made only there. If this policy applies to you, we are the controller of the information described here. We use it to provide the account and the subscription you asked for, to answer your messages and, if you agreed, to email you as described above. The information is processed in the United States. You may also complain to your local data protection authority.

Security

Connections to RevenueCat, Stripe, Supabase and our course server are encrypted in transit. A password, if you choose one, is kept only as a one-way scrambled form (a hash).

Changes to this policy

If the app or this policy changes, we will post the new policy on this page and change the effective date at the top. If a change means the app collects something it did not collect before, we will say so on this page before the change takes effect, and in the store's update notes for an Android or iPhone app.

Contact

Three Little Geese LLC
[email protected]
202 N Cedar Ave, STE #1
Owatonna, MN 55060