Privacy Policy
Last Updated: November 14, 2026 • Effective Date: September 28, 2026
We never sell student data or target you with ads
No advertising SDKs in the apps and no ad targeting. The website's one ad tag only measures which of our Google ads lead to visits, sign-ups and purchases. No selling of student performance records. Study data can be saved on your device and privately in your account. Uploaded study materials are processed through Google Cloud and OpenAI as described below.
1. Introduction
This Privacy Policy explains how Magstone Education LLC, the operator of MagstoneRN ("we," "our," or "us") collects, uses, and safeguards information when you use the MagstoneRN mobile application on iOS and Android and our website at magstonern.com.
This policy is written to comply with the Apple App Store Review Guidelines (including Guideline 5.1.1), the Google Play Data Safety requirements, the General Data Protection Regulation (GDPR), and the California Consumer Privacy Act (CCPA).
2. Information We Collect & How We Use It
We collect the information below to run the app and website, link purchases to your account, run the affiliate program, and see how MagstoneRN is used:
Promotional email signup
If you sign up for email offers or unlock a free practice test with your email, we store your email address and a record of your agreement to receive future MagstoneRN promotions in Firebase. This is a separate mailing list: signing up does not create an app account, start a free trial, or start billing. We do not send the email address to Analytics. We keep it until you ask us to remove it. To stop promotional emails or remove your address, contact the MagstoneRN privacy team. App account deletion does not automatically remove this separate signup.
To limit automated submissions, we temporarily store a hashed network address with request counts. Expired counters are checked for removal daily. Your browser also remembers when you dismiss an offer popup or join the email list; that preference contains no email address.
Optional app feedback
If you send feedback from the app, we store your comments, account ID, submission date, and publication permission in Firebase. We also save whether you dismissed or postponed the invitation so that your choice follows your account across devices. We use feedback to improve MagstoneRN. Feedback text is not sent to Analytics.
Publication permission is optional and off by default. If you give permission, we also store the display name you provide. Feedback is submitted privately and is not automatically published. We may quote it on the website only with your permission and after our review.
Your account export includes your feedback. Account deletion removes the private submission and invitation preferences. To request a change or withdraw permission for future website use, contact the MagstoneRN privacy team.
Your uploaded study materials
When you upload a PowerPoint, PDF, document or image in My Study, we store the original file, its name and title, extracted text and page references in your private account. We also save the flashcards, practice questions, explanations and source passages created from it, your edits, material sets, study sessions and review progress. If you request an audio overview, we store its transcript and generated audio so you can listen again.
Google Cloud stores uploaded files privately and processes them to extract their content. The selected extracted text and source passages are sent to OpenAI's GPT models to draft flashcards, practice questions and audio transcripts, including podcasts. We send these requests with OpenAI's response storage turned off and without prompt caching of your uploaded text. These requests also carry a pseudonymous identifier, a one-way hash of your MagstoneRN account ID that contains no name or email, so OpenAI can address misuse by one account instead of blocking the whole service. The drafts, with the selected text and source passages, are then sent to Google Cloud's Gemini models to check study items and audio transcripts. For audio, the transcript is sent to Google Cloud for speech generation.
Processing requires an internet connection. Google Cloud's service terms and retention rules apply to its processing, and OpenAI's API terms and data rules apply to its drafting; we do not promise that either provider retains no data. See Google Cloud's AI data governance information and OpenAI's API data controls.
These uploads and generated materials are not published in our study library or shared with faculty or school administrators. Their content, filenames, prompts, answers and temporary download links are not included in our app analytics or diagnostic reports. We keep processing status, storage allocation and generation usage records to run the feature, enforce spending limits and avoid processing the same request twice.
Account Identifiers
When you sign in to the app (Apple, Google, phone number, or email) or to magstonern.com to make a purchase (Apple, Google, phone number, or email), Firebase Authentication gives us your MagstoneRN account ID and, depending on the sign-in method, your email address or phone number. We use these only to authenticate you, sync your study data, link purchases to your account, and measure sales. Our admin view of website sales shows the account email, or the account ID when there is no email, next to its purchases. When you sign in with a phone number on magstonern.com, Firebase sends the code by text message and uses Google reCAPTCHA, which collects information about your browser and device, to block automated abuse. When you create an account on magstonern.com with an email and password, Firebase emails you a link to confirm the address before you continue.
Study & Spaced Repetition Progress
To schedule reviews, we record card review ratings, quiz attempt scores, and question bookmarks to estimate review intervals. The current card screen records Again through thumbs-down feedback and Good through thumbs up or Next card.
Subscription Status
RevenueCat records which plan you have and whether your access is active. It identifies you by your MagstoneRN account ID when you are signed in, or by a random ID when you are not. We never see or store your full card number.
Website Purchases (Stripe)
When you buy on magstonern.com, Stripe processes the payment and receives your payment details, email address, and billing address where needed. We receive your email, plan, and payment and subscription status from Stripe, and we attach your MagstoneRN account ID to the purchase so the app can unlock it. Stripe may email you receipts and billing portal sign-in links.
We keep a copy of your website purchase records from Stripe in our Firebase database, linked to your MagstoneRN account ID: the plan, subscription status, amounts, dates, any refunds or disputes, and Stripe's IDs for the purchase, such as customer, subscription, invoice, checkout session, payment, refund, and dispute IDs. We use it to support your account and to measure sales. It never includes your card number or billing address.
If you buy study credit, we also record the pack on your account in Firebase: its checkout session and payment IDs, the amount, when it expires, how much you have used, and whether its payment was refunded or disputed. The app uses this record to show and spend your credit. Unused study credit is removed when you delete your account.
Affiliate Referrals
If you buy on magstonern.com after opening a referral link, or with any discount code, we keep that code with our copy of your purchase records in Firebase, linked to your MagstoneRN account ID. If the code belongs to an affiliate, we also record the referral and, once you pay, whether it earns the affiliate a commission. We use these records to credit and pay affiliates.
When a browser opens a referral link and its referral cookie (see Cookies and browser storage on magstonern.com below) doesn't already hold that code, we add one to that day's count of link visits, and to a running total, for the approved affiliate the code belongs to. The counts keep only the affiliate, the code, the dates, the numbers and when they last changed. They keep nothing about you, your browser or your device. We leave out visits from known bots and link previews.
Affiliates see only link visit counts and the counts, dates, plans, amounts and statuses of the purchases they referred, never your name, email or account details.
Affiliate Program
If you apply to the MagstoneRN affiliate program, we store your display name, contact email, PayPal email, links to your channels, an optional note about your audience, the referral code you choose and when you accepted the affiliate terms in Firebase, along with your commission and payout records. We use them to review your application, credit your commissions and pay you. When we pay you, PayPal receives your PayPal email and the payout amount.
Website Analytics
magstonern.com uses Google Analytics to measure how the website is used: pages viewed, the referring site, device and browser type, and approximate region. It sends the same information to two Google Analytics properties: one for the website, and the Firebase Analytics property that also measures the MagstoneRN app. It sets first-party cookies. We do not use it to show you ads, and we remove checkout session identifiers from the page addresses it receives.
When you start checkout, it also receives the plan you picked and its price and how you signed in (email, Google, Apple, or phone number). After checkout, it receives whether a free trial started or a payment went through, with the amount. These checkout events never include your email, account ID, or checkout session ID.
It also receives which button or popup started checkout, and when you select the Android app link at the top of a page. On the homepage, it receives which button opened the sample case study, when you open the extra plans, when you start a sample (the case study or the flashcards), each case study answer's step number and whether it was right, and your score when you finish. When you create an account on the website, it receives that an account was created and how (email, Google, Apple, or phone number). These events never include your email, account ID, or the text of your answers.
Google Ads Measurement
magstonern.com also loads a Google Ads tag so we can see which of our ads lead to visits, sign-ups and purchases. It receives the addresses of the pages you view, with checkout session identifiers removed, standard browser information such as your browser type and IP address, and, if you arrived by clicking one of our ads, that ad click. It sets first-party cookies that link your visit to the ad click. It does not receive the website analytics events described above, your email, or your account ID.
Ad personalization is off: we do not use your visits to build advertising audiences or to show you ads on other sites. The MagstoneRN apps do not load it.
App Usage Analytics
The MagstoneRN app, including the web app, uses Google Analytics for Firebase to see how the app is used: which screens you open (the kind of screen, never an ID or search), sign-ins and new accounts with the sign-in method, when a plan screen opens and from where, the result of restoring purchases, and the type and number of items of each study session you finish.
Google Analytics also records app opens, time spent in the app, app and system updates, and purchases in the phone apps, along with an app instance ID or Firebase installation ID, device model or browser, operating system, app version, language, and approximate region. Crash reports sent to Firebase Crashlytics can include recent usage events.
It never receives your name, email, phone number, account ID, answers, scores, topics, or notes, and it does not collect advertising identifiers. We do not use it to show you ads.
You can turn it off under Settings → Privacy → Share app usage data. It's on by default, applies only to the device you change it on, stays set after you sign out, and takes effect right away. In the web app, Google Analytics loads and sets first-party cookies only while sharing is on. Cookies it already set stay until they expire or you clear them.
Support Emails
When you email MagstoneRN support or the MagstoneRN privacy team, we receive your email address and whatever you include in the message, and use it only to answer you. If you claim the NCLEX Pass Guarantee, we use the exam result you send only to check your claim and your free access, and keep a record of the claim while that access lasts.
Crash Diagnostics & App Health
Anonymous stack traces, device model, and OS version when an unexpected error occurs, utilized strictly to fix bugs and prevent calculation errors.
Cookies and browser storage on magstonern.com
- Google Analytics sets first-party cookies to count visits and sessions.
- Google Ads sets first-party cookies that link a visit to a click on one of our ads, so a sign-up or purchase that follows can be counted for that ad. They are not used for ad targeting.
- Website sign-in keeps your Firebase session for the current browser tab by default. If you select "Keep me signed in", Firebase stores your session in this browser so you can return after closing it. Sign out to end a remembered session, or clear this site's browser data. Use this option only on a device you trust.
- Checkout confirmation remembers, in your browser's storage for that tab, that a completed order was already counted, so reloading the page doesn't count it twice. It keeps the order's Stripe checkout reference there, and your browser clears it when you close the tab.
- Email verification: after a new account is emailed its verification link, the website remembers, in your browser's storage for that tab, the account ID it was sent for, so reloading the page doesn't send another. Your browser clears it when you close the tab.
- Plan check: while you're signed in, the website remembers, in your browser's storage for that tab and for up to 10 minutes, whether your account has a plan, with your account ID, so the header can show "Open web app" or "Subscribe now" without asking again on every page. Your browser clears it when you close the tab.
- Free TEAS practice tests keep, in this browser's storage, a note that the tests are unlocked and your progress on each test (your answers, flagged questions, and timers), so you can pick up where you left off. Resetting a test erases its saved answers. The unlock note and any progress you have not reset stay until you clear this site's browser data. Neither holds an email address.
- Affiliate referral sets a first-party cookie,
mrn_ref, only when you open a referral link, a magstonern.com page address that carries a referral code (such as https://www.magstonern.com/?ref=YOURCODE). It holds only that code, never your name, email or account ID, and lasts 30 days. Opening another referral link replaces it. Opening a link also adds to the affiliate's link visit count, as Affiliate Referrals above describes; our server sends only the code. When you check out, we send the code to Stripe as part of the checkout details so the purchase can be credited to the affiliate the code belongs to. At checkout for the Monthly plan, we also use it to apply a MagstoneRN discount code with the same name, if one is set up. - Checkout happens on Stripe's own pages (checkout.stripe.com), which use Stripe's cookies under Stripe's privacy policy.
Sharing progress with your nursing program
School rosters show your name, email, enrollment date and coarse activity counts. If your cohort enables progress reporting, you can choose to share your enrolled activity, completed quiz and test summaries, topic scores and trends, and flashcard confidence in the app under Settings → Faculty sharing.
Assigned faculty and school administrators can view and download those summaries for your enrollment period. Your answer choices, private notes and item-level responses are not included. Turning sharing off removes access through the portal; it cannot recall reports already downloaded by your school. Your own study history remains saved. Reporting copies are removed when your Firebase account is deleted.
3. Information we do not request
MagstoneRN does not ask you to provide the following:
- Precise Geolocation: We never request or access GPS coordinates.
- Biometric Data: Face ID / Touch ID authentication is handled locally by iOS/Android; we never receive biometric data.
- Your address book: We do not request access to your contacts. We receive only the documents or images you choose to upload, not your entire photo library.
- Protected Health Information (PHI): MagstoneRN is a nursing study material suite. Do not upload or enter real patient information. Files you choose to upload are processed as described in section 2.
- Cross-App Advertising Identifiers (IDFA / GAID): The apps do not use advertising identifiers or track you across other companies' apps and websites. On magstonern.com, the Google Ads tag only measures whether a visit followed a click on one of our ads; it does not build ad audiences.
4. Device and account storage
MagstoneRN uses both device storage and private account storage:
- Native app builds bundle curriculum content, question catalogs, dose-math methods, and anatomy model assets. Some study state is saved on your device.
- Bundled learning activities can work offline after installation. Account services, purchases, and restoration require a connection.
- When you are signed in and connected, study history, saved assessment checkpoints and results sync through Firebase so you can resume across devices. Faculty reporting uses only the enrolled summaries you choose to share.
- Uploaded originals, extracted content and generated study materials are stored in Firebase and Google Cloud under your account. Downloads require an account ownership check and use temporary links that expire within five minutes. Anyone with a link may use it before it expires, so do not share it. A link already issued may remain usable until it expires; signing out does not immediately revoke it.
- Signed-in services use Firebase. Account and program information may be stored remotely; availability of study synchronization depends on the app build and service configuration. Browser-local data may be cleared by browser settings. Do not enter patient-identifying information.
5. Authorized Third-Party Sub-Processors
We work with trusted infrastructure providers who adhere to strict data security standards:
| Provider | Purpose | Data Shared |
|---|---|---|
| Apple App Store | In-App Purchase & Subscriptions (iOS) | Anonymous receipt validation |
| Google Play Store | In-App Purchase & Subscriptions (Android) | Anonymous purchase token |
| Stripe | Website payments & subscription billing | Payment details, email, billing address where needed, MagstoneRN account ID, purchase history, and the referral code if you opened a referral link before checkout |
| RevenueCat | Subscription status across the app and website | MagstoneRN account ID (or a random ID when signed out), purchase and entitlement records, including website purchases from Stripe |
| Google Firebase | Sign-in (app and website), cloud study synchronization, private material storage, our copy of website purchase records, and affiliate program records | Account ID, sign-in email or phone number, study state records, uploaded originals and generated study materials, website purchase records from Stripe (no card numbers), affiliate applications, link visit counts, referral, commission and payout records |
| Google Cloud | Private file storage, document extraction, checking AI study items and transcripts, and speech generation | Uploaded files, extracted text and source passages, generated cards, questions, transcripts and audio, and processing and usage records |
| OpenAI | Drafting AI study items and audio transcripts, including podcasts, from uploaded materials | Selected extracted text and source passages, the draft cards, questions and transcripts it returns, and a pseudonymous one-way hash of the MagstoneRN account ID |
| PayPal | Affiliate payouts | The affiliate's PayPal email and the payout amount |
| Google Ads | Measuring which of our ads lead to visits, sign-ups and purchases on magstonern.com (no ad personalization) | Addresses of pages viewed (checkout session identifiers removed), browser type, IP address, ad click and cookie identifiers |
| Google Analytics | Website and app usage measurement (magstonern.com and the MagstoneRN app) | Pages and screens viewed, the checkout, homepage sample, sign-up and app events described above, device and browser type, approximate region, cookie, app instance and installation identifiers |
6. Your Rights & Account Deletion
You can contact us to request access to, correction of, or deletion of personal data associated with your MagstoneRN account. We confirm ownership before acting on an account request.
Keeping, exporting and deleting your materials
We keep uploaded originals and generated study materials in your account until you delete the material or your account. Incomplete uploads may be removed automatically. You can also delete individual study items, audio overviews and saved sessions. A saved session keeps a copy of the items you studied, even if you later edit or delete an item; delete that session or its source material to remove the saved copy.
The app's account export includes your extracted text, source references, generated text and transcripts, material sets, review progress and saved study sessions. It does not embed original files or audio recordings; download those separately from your materials before deleting them.
Deleting a material stops new processing and removes its original file, extracted content, generated items and audio, and associated sessions from active account storage. Minimal records that prevent a delayed request from restoring deleted data or spending the same allowance twice may remain. Account deletion also removes account-specific material usage records; service-wide usage totals without document content may remain.
Deletion does not recall files you already downloaded or shared, immediately revoke an unexpired download link, or remotely erase cached data on an offline device. Provider backups, operational records and processing retention follow Firebase, Google Cloud and OpenAI's service rules.
Request deletion or data assistance:
- Account support: Email MagstoneRN support from your account email. We will explain the deletion scope, device-local storage, and any records that must be retained.
- Via Web Portal: If you uninstalled the app or lost your device, submit a request on our Account Deletion Request Page or email the Magstone Education LLC privacy team.
Deleting your MagstoneRN account does not cancel a subscription bought on magstonern.com or through Apple or Google, so cancel it first (see our Terms). Payment and transaction records held by Stripe, Apple, or Google are kept under their own retention rules and legal obligations and are not removed when you delete your MagstoneRN account. Our copy of your website purchase records in Firebase is also kept when you delete your account. These are financial records, kept for accounting, tax, and fraud prevention. If you are an affiliate, deleting your account deletes your affiliate profile, code and link visit counts. Affiliate referral, commission and payout records, including those linked to purchases you made through an affiliate, are kept as business and tax records. Send questions about them to the Magstone Education LLC privacy team.
7. Children's Privacy (COPPA)
MagstoneRN is intended for post-secondary adult nursing students and candidates for professional licensure. We do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal data, please contact us for immediate removal.
8. Privacy Inquiries & Data Protection Officer
For any questions, data export requests, or concerns regarding your privacy, contact our team:
Magstone Education LLC Privacy Office
Email: Magstone Education LLC privacy team
Website: https://www.magstonern.com/privacy