Last updated 2026-09-28.
CasesTrain is run by Thomas Kozusnik, who decides how your data is used (the data controller). Write to support@casestrain.com about anything on this page.
Your practice stays in your own browser. The server knows only what it needs to sell you a pass and let you sign in. There is no advertising and no tracking of you as a person, and nothing is stored on your device to count visits, which is why there is no cookie banner.
Your runs, answers, scores and the record of how you worked (clicks and timing, used for the process score) are saved in your browser's local storage so a run survives a reload. They are not sent to us unless you choose to share a run (below). Clearing your browser data deletes them. The browser also remembers that you accepted the Terms, and which runs you shared.
At the end of a run you can press Share this run's scores. Only then is that run's exercise, scenario, date and scores (results, process and its parts, and per-site figures in Microbial Migration) sent to us, without your answers, email, licence key or IP address. We use them to check that the scoring is fair on real runs, on the basis of your consent, which you give by pressing the button. They are deleted automatically after 400 days. Because they are not linked to you, we cannot find or delete a single shared run on request.
cl_session keeps you signed in. It is set when you sign in and lasts until your pass ends or you sign out, at most 30 days. It is strictly necessary for the service you asked for, so it does not need consent.
When you buy: your email address, your licence key, the purchase date and amount, and Stripe's payment references. We use them to give you access, resend a lost key and handle refunds and disputes (performing our contract with you, and legal obligations). They are deleted automatically 12 months after your pass ends.
When you sign in: the IP address you connect from. We use it to keep sessions valid and to notice a key being shared (our legitimate interest in a single-user licence). It is deleted automatically 30 days after your pass ends. Sign-in attempts are also rate-limited by IP.
Logs: sign-ins and purchases are logged with email, key and IP. Cloudflare keeps these logs for a few days.
To see which channels bring visitors and buyers, the server adds one to a daily counter when someone opens the home page or the demo, starts or finishes the demo, opens checkout or buys. Each counter is only: the day, the page, the country (from the connection, not stored with anything else), and where the visit came from: a tag in the link you followed (such as ?ref=club-name) or the name of the site that linked here. No IP address, cookie, device identifier or account is stored with it, so a count can't be traced back to you. The source tag is also saved with a purchase so we know which channel it came from. We rely on our legitimate interest in knowing what works.
Stripe processes the payment and acts as merchant of record, under its own privacy policy. We never see your card details.
Cloudflare hosts the site, the licence database and the logs, under its privacy policy.
Fonts and every other file are served from casestrain.com itself, so using the site sends nothing to Google or any other third party.
Under the GDPR you can ask for a copy of the data we hold about you, have it corrected or deleted, object to how it is used, and complain to your data protection authority. Deleting your licence record also ends your access. To ask, write to support@casestrain.com from the email address you paid with, so we can match the request to your purchase.