Version 21 October 2026

Privacy

Masar CFA is part of Masar-Works. This page says what the site stores and why. Last updated 21 October 2026.

What we collect

• Sign-in. A single passcode opens the site. A signed, HttpOnly session cookie keeps you signed in on your device for up to 180 days. If you change the passcode inside the app, we store only a salted hash of it.
• Your progress. Your progress and settings are stored in your browser on your device and, if you sync, on our servers. Your light or dark display choice is kept in your browser as masar-theme. If you use the AI tutor, your own API key stays in your browser and is sent only to api.anthropic.com.
• Enquiries. If you send a message through the contact form we keep your name, email address and message so we can reply. A short-lived, one-way hashed form of your IP address is used only to limit abuse.
• Technical logs. Our host, Cloudflare, processes requests (IP address, browser, pages) to deliver and protect the site.

What we do not do

• No advertising trackers and no selling of personal data.
• No third-party analytics scripts on your learning pages.

Cookies and device storage

One strictly necessary session cookie (cfa_auth) keeps you signed in. Preferences, progress and your display choice use your browser's local storage. The site works without any marketing cookies.

Your choices

You can ask us to see, correct or delete the personal data we hold about you through the contact page.

Processors

Cloudflare, Inc. hosts the site and its storage. Where an AI feature is part of the product, the text you submit to it is sent to the AI provider only when you use that feature.