Privacy
Last updated 7 September 2026
CFA SHOTS is a practice-question app for CFA Level I. This page says exactly what it stores and where. It is short because the app collects very little.
Using it without an account
Your answers, your session history, and your timer and appearance preferences are kept in your browser’s local storage, and none of it leaves your device. There is no account and no record on our side, with one exception: if you report a question, that report is stored on our server even when you are signed out. See “Reporting a question” below. Clearing your browser data erases everything held on your device.
Mock exams
Mock exams are held on this device only, whether or not you are signed in. The sitting you have open, every answer in it, the time it has taken, and the score afterwards are written to your browser’s local storage and are never sent to our server. Nothing about a mock reaches another device, and nothing about a mock counts towards the practice figures on the topic screens. Clearing your browser data or signing out removes it, and there is no copy anywhere for us to give back.
Signing in
Signing in exists for one reason: so your progress follows you to another device. If you sign in with Google, Google gives us your email address, your name, your profile picture link, and your Google account identifier. We also store the tokens Google issues so the sign-in can be completed and kept alive. We do not ask for access to anything else in your Google account — no mail, no files, no contacts.
What syncs once you are signed in
- Each practice session: the topic, the reading, the mode, how many questions, whether the timer was on, when it started and finished, and the score.
- Each answer: which question, which option you picked or that you skipped, whether it was right, how long you took, when you answered, and what calendar date that was for you.
That is all of it. It is exactly the data the practice and topic screens build their figures from. Mock exams are not in this list and do not sync.
Reporting a question
If you report a question we store the question, the reason you chose, any note you write, and — if you are signed in — your user id, so we can follow up. Deleting your account detaches your id from the report but keeps the report, because the question still needs fixing.
Cookies and tracking
Cookies, set when you sign in, are what keep you signed in. There is no analytics, no advertising, and no third-party tracking of any kind.
Where it lives
On a virtual machine rented from Oracle Cloud, in a database on that same machine. Your data is not sold, not shared with anyone, and not used to train anything. The web server keeps no access log, so ordinary page views are not recorded. When a request fails, the server does write an error record that can include your IP address, the page you asked for, and your browser and language settings. Those records are deleted after seven days and are used only to fix faults.
Deleting your data
Email raghavmehrotra73@gmail.com and ask. We will delete your account and everything attached to it. Signing out removes this device’s local copy on its own, without asking anyone.
Changes
If this page changes in any way that matters, the date at the top changes with it.