Security and privacy
A plain account of how Wamberry protects your account and practice data. Everything here describes how the service works today; we do not claim certifications we do not hold.
Payments
Card payments are handled entirely by Stripe. Your card number never reaches our servers and we never store it. We keep only your Stripe customer reference and subscription status.
Signing in without passwords
Accounts use passkeys (for example Face ID, a fingerprint or a security key). Your device keeps the private key; we store only the public half. There is no password database to leak, and a passkey cannot be phished on a look-alike site.
What we keep, and what we don't
- Your answers, ratings and practice history, so your progress page works.
- Site usage is counted as anonymous daily totals, not per-person tracking profiles.
- No advertising cookies, and no personality data: we do not run personality questionnaires.
- To enforce the free allowance we keep a salted, one-way hash of your network address for 8 days, not the address itself.
The full detail is in our privacy notice.
How the site is protected
- All traffic is encrypted over HTTPS, enforced with HTTP Strict Transport Security.
- A strict Content Security Policy limits which scripts the browser will run on our pages.
- Sign-in cookies are HttpOnly and SameSite, so page scripts and other sites cannot read or reuse them.
- Sign-in and other sensitive endpoints are rate-limited against automated guessing.
- Payment notifications from Stripe are verified by signature before we act on them.
- Every change to the site is reviewed by an automated security check before it is deployed.
Your control
You can delete your account, its passkeys and all its practice history from your account page at any time. For a copy of your data, a correction, or any other data-protection request, email contact@wamberry.com.
Reporting a vulnerability
If you believe you have found a security problem, please email contact@wamberry.com with "Security" in the subject. We will acknowledge your report, keep you informed, and not take action against good-faith research that avoids harming users or their data. Our security.txt follows the RFC 9116 standard.
For universities, careers services and employers: we can provide a data processing agreement on request.
Last updated: 3 November 2026