Effective date: 3 November 2026
Last updated: 3 November 2026
NotAfter™ is built so that there is almost nothing to write in a privacy policy. We wanted that to be true by construction rather than by promise.
| Do you have my certification data? | No. It stays on your iPhone or iPad. |
| Do you have my provider password? | No. NotAfter never asks for it, never sees it, never stores it, never transmits it. |
| Do you have an account for me? | No. NotAfter has no accounts and no sign-up. |
| Do you run servers that hold my data? | No. Besides the access log in the next answer, the one lasting record our server keeps from the app is a random key your copy of NotAfter made to prove it is genuine. It identifies that copy of the app, not you (§3.2). |
| Does the app talk to your servers at all? | Yes. When you open it, the app downloads two small public files: updated form definitions, at most once in any twenty hours, and which provider portals are currently working, at most once in any six hours. At most once in any twenty hours it also fetches one file that is not public, after proving it is a genuine copy of NotAfter, and the form-definitions check you can start yourself in Settings fetches it too. None of these requests says anything about you. To recognise your copy next time, the server keeps a record of a random key the app made for that purpose; it identifies that copy of the app, not you. The server also keeps an ordinary access log, in which IP addresses are shortened by our hosting provider before they are stored. §3.2 describes both exactly, including how far we have checked the log. |
| Does the app read the provider's web pages? | Yes, while you are submitting credits: each time a page loads or its address changes, and when you tap Fill, the app checks the page, on your device, to see whether the portal is refusing you. Where the app's form definitions list a message the provider shows when it is blocking you, such as a maintenance notice, that check reads the page's visible text to look for it. That check never runs on a page where the app finds a visible password box, nothing from it is sent anywhere, and those checks keep nothing. Two reads do keep what they find, and both happen because of something you did: Capture This Page, which copies your own totals and renewal dates onto your device, and the list of options a provider's form offered when the app had to ask you which one matches your certification. If you accept Fill's offer to rename a certification to the provider's own name for it, that name is kept too. A Fill on the submission form also leaves a small note about the form's structure, never its text or anything you typed, and, where the form states a daily credit limit NotAfter has on record, a note of whether it still says the same, with the form's own line if it says something different. Everything described in this row stays on your device. The app never sends any of it; the one way part of it can reach us is if you choose Report a Problem, which puts the latest Fill note into an email that you read, can edit, and send yourself (§8). §6 and §4 describe each exactly. |
| Do you use analytics or advertising SDKs? | No. |
| Do you sell or share my personal information? | No. We have nothing to sell. |
| Who does receive something? | Apple, if you buy a subscription. Apple bills you; we never see your payment details. Apple also collects crash reports and usage figures under its own settings, and may pass some of them to us (§7), and is asked to vouch that your copy of the app is genuine when the app sets up the check in §3.2. §9 lists every third party and what each receives. |
| What about my email if I write to support? | That we do have, because you sent it to us. §8 explains exactly what happens to it. |
The rest of this policy is the long version, including the specific disclosures Japanese law（個人情報保護法 / APPI）and US state privacy laws expect. Those are additional sections, not different answers. The facts described here are the same in every market.
NotAfter is developed and operated by Jarred Ellerbe.
One address, for everything. support@notafter.app is the only contact address for NotAfter: support questions, privacy questions, and requests about your own information all go to it. We would rather run one address that is actually read than several that are not.
We give our postal address on request. If you need it, to make a formal request or because a law in your country entitles you to it, email support@notafter.app and ask, and we will give it to you.
In this policy, "we," "us," and "NotAfter" mean the operator named above.
This policy covers:
notafter.app website, including the support and help pages.It does not cover the websites and portals of certification providers (CompTIA®, ISC2®, EC-Council and others), which have their own privacy policies and their own terms. When you use NotAfter's in-app browser to visit a provider's site, you are on their site, in your own session, subject to their policies (see §6).
This section is the heart of the policy, because the design is the privacy protection.
There is no sign-up, no login to NotAfter, no username, no profile. We could not connect data to you even if we held it, and we do not hold it.
Your certifications, credit entries, deadlines, and notes are stored on your device (§4). We operate no database of user records, no accounts, and no user profiles. There is nowhere on our side for your data to be.
NotAfter is not a fully offline app, and we would rather tell you than have you find it. It fetches three files over ordinary HTTPS from infrastructure we operate, and it does so only when you open the app. The form definitions are fetched at most once in any twenty hours, the status file at most once in any six hours, and the third file at most once in any twenty hours, so a day in which you open the app several hours apart can include several status requests and one of each of the others. You can also ask for the form definitions yourself, in the app's settings; that check also fetches the third file, and it runs when you tap it.
The first two are plain requests for public, static files: the same files, for every user, whoever they are. They carry nothing about you: no account (there is none), no device or advertising identifier, no certification or credit data, no analytics event, and no request body at all.
The third works differently, and we want to be exact about how. Before our server sends that file, the app proves that it is a genuine copy of NotAfter, using Apple's App Attest. The first time, the app has your device create a key pair in its secure hardware, where the private half stays. Your device asks Apple to vouch for the key, and the app sends us Apple's answer, which contains the key's public half, together with the key's identifier. After that, each fetch of the file takes two requests: one asking our server for a single-use challenge, and one that sends back a signature over that challenge, made on your device with the key, and receives the file. A fetch that has to set up a key takes a few more. These requests have a body, and the key's identifier, the challenge and the signature travel inside it, never in the request's address, so they never appear in the access log below. Each body also says that it comes from the iPhone and iPad app, which is the same for everyone.
What the server keeps from this: the key's identifier, its public half, a counter that rises with each signature, which of Apple's two attestation environments it came from, and the dates (not times) it was first and last used. To limit abuse, the server also keeps, for about ten minutes, a scrambled form of the network a request came from and of the key's identifier, with a count of requests; and it keeps a running count, by day, of requests it refused and why. None of that names a device or a person. The key list holds no IP address, no device name or model, and no app version. (The access log below records the user-agent your device sends with every request, as it does for the other two files, and that string usually includes the app's version.) The key is random and made for this one purpose, and Apple's design gives each installation its own: reinstalling the app, restoring a backup or moving to a new device produces a new one. It identifies that copy of the app, not you, and we do not combine it with the access log or anything else. A key unused for 90 days is deleted the next time the check runs; if we ever take the check down, we delete the whole list. If your copy asks again later, it makes a new one. Because nothing ties a key to you, we cannot find yours if you ask us to delete it. Deleting the app abandons the key, and it is deleted on that schedule.
What comes back from all three is reference data. Nothing about you goes out, and nothing about you comes back. Apart from the key described above, the app has no mechanism to upload anything to us: it contains no other upload or form-submission path of any kind.
Where those files are served from, and where the keys are kept. We do not run our own hardware. The files, and the list of app keys described above, sit on a server operated for us by a third-party hosting provider, an ordinary commercial hosting arrangement. The provider is not given anything about you, because we have nothing about you to give. Its daily backups of our account include the folder that holds that list, and it keeps each backup for about two weeks, so a key we have deleted can remain in a backup for up to about two weeks more. We do not set that period and cannot shorten it.
What the server records. Like almost any web server, it keeps a standard access log of the requests it serves: an IP address, the time, the file requested, and the user-agent string the requesting software sends. We use it to detect abuse and protect the service: to see that the files are being served correctly, and to notice an attack on or misuse of the endpoint. The requests that go with the third file appear in this log like any other, with the same four items and nothing more.
The IP address is shortened before it is stored. Our hosting provider strips the last part of the address before the log line is written. An address like 203.0.113.47 is recorded as 203.0.113.0. What ends up in the log therefore points at a block of roughly 256 addresses rather than at the one your device used.
We want to be exact about whose protection that is, and about how far we have checked it. It is the hosting provider's, applied as a standard part of their service, not something we built. We did not design it and we cannot take credit for it. What we can tell you is what we did: we read our own log files on 12 August 2026, and every address in them ended in .0, which is what the provider's own documentation says it does. That is an inspection of our real traffic, not a promise about every circumstance. If we ever move to hosting where the protection is not applied for us, this paragraph changes before the move does.
How long it is kept. Our hosting provider deletes old entries from the log on its own weekly schedule, within about 9 weeks of their being written. Its backups of our account can keep a copy for up to about two weeks after that, so no entry is kept for longer than about 11 weeks. We do not set either period and cannot shorten them.
That log is not linked to any account (there is none), not combined with anything else, not used to identify you, not used for analytics or advertising, and not shared with anyone.
A full IP address can, in some circumstances and in some countries, be personal information. A shortened one is a considerably weaker case, which is the point of shortening it, but we would rather describe what happens than let you assume the flattering version. This is the paragraph to check against your own proxy capture, and we have tried to write it so that it survives the check.
NotAfter never asks for, receives, stores, or transmits your CompTIA, ISC2, EC-Council or any other provider password or one-time code, and never reads credentials or session tokens out of the provider's own website data (§6). We will not accept them if you offer them. Our support is instructed to refuse.
The in-app browser refuses to read any page where it finds a visible password field, and refuses to read a page it recognises as a login page at all. §6 describes exactly how that check works and when it runs, because it is a mechanism rather than a promise.
NotAfter fills a form in front of you. You always tap Submit yourself.
There is no user-level event stream, and no third-party code of any kind is built into the app. We do not know which screens you opened or which buttons you tapped.
In any sense of those words used by any privacy law, including "sale" and "sharing for cross-context behavioral advertising" as those terms are used in US state privacy laws.
The following stays on your device, in the app's local storage. This is a description of the kinds of things it keeps rather than a field-by-field inventory, and none of it reaches us unless you send it to us yourself:
We do not receive any of it, except what you choose to email us (§8).
Reminders stay on your device. NotAfter has no push server and no push notifications, and it is not built to have them. Any deadline reminder you see is scheduled by the app itself, on your device, from dates that are already there. Nothing is sent to us, and nothing about your certifications leaves your device in order to produce it. Team reminders work the same way, and they never name a person or a team.
Backup and sync. NotAfter does not sync your data to any cloud service: there is no NotAfter account and no iCloud sync of app data. If iCloud Backup is enabled on your device, your NotAfter data may be included in your own iCloud backup, because the app does nothing to exclude it. That backup is between you and Apple, under Apple's privacy policy and controlled from your own device settings; we have no access to it.
Deleting your data. Delete an entry in the app, or delete the app from your device, and the local data goes with it. One small exception: iOS can keep a keychain item after the app that made it is deleted, so the key identifier described above may stay on the device. It names a key that no longer works and says nothing about you, and if you reinstall the app, it finds the old key rejected and replaces the entry with a new one. Because we never had a copy, there is nothing for us to delete on our side. If a backup of your device exists, remove it through your device or iCloud settings.
If you already have a completion certificate as an image, NotAfter can read the details off it so you do not have to retype them.
You can skip images entirely and enter your credits by hand.
When you are ready to report credits to a certification provider, NotAfter opens that provider's own website in an in-app browser.
What the app checks while you are on the provider's site, and what stops it. Each time a page loads or its address changes, NotAfter asks the page short questions, such as whether a password box is showing and whether the provider is showing a message that the app's form definitions list as blocking you, like a maintenance notice. The questions are answered inside the page. Only the answers come back to the app: which listed message is showing, if any, and, when the page is refused, the kind of thing that caused it, such as a password box or a frame, its rounded size where it has one, and, for a frame, the site it comes from. No text from the page comes back. NotAfter asks again when you tap Fill. There is no timer. To see whether a listed message is showing, the app reads the page's visible text, on your device, inside the page itself. That is a real read of page content, and we would rather write that down than have you discover it: the text stays in the page, and the app keeps none of it and sends none of it anywhere.
Two rules govern every one of those checks (the same check runs first when you tap Fill) and every read Capture This Page makes. Both rules are enforced in the app's code, and they are the reason §3.4 is true:
What those checks learn is used immediately, to warn you when the provider is blocking you, is asking you to sign in, or is showing a page the app will not read, and then discarded in the same step. While the provider is blocking you, the app also hides the Fill button. On the provider's sign-in page, a tap on Fill runs nothing: the app checks the address first and stops. On any other page the check refuses, a tap on Fill fills nothing and reads nothing more. Nothing from them is kept, and nothing from them is sent anywhere. The app has no upload path at all (§3.2), so there is nowhere for it to go. Separately, the scripts that fill the form are there to write values into fields, and automated tests check each kind of script the fill engine builds for reads of what is typed in a field. Two narrow checks do look at a field before writing, and we would rather name them than have you find them: before choosing in a dropdown, a script may look at which choice is already showing, so that it can leave a choice already made in place; and a script may check whether a required question is still unanswered, without learning what any answer is. Only the result of each check comes back to the app.
Two reads do keep what they find, and both of them happen because of something you did. On your own account page at a provider, NotAfter shows a Capture This Page button. Tapping it reads that page once and copies your own record (your credit totals, your renewal dates and, where the page shows them, your renewal fee's due date and amount) into the app on your device, so you do not have to type figures you have already earned.
These two reads, the small Fill note described in §4, the provider's own name for a certification when you accept Fill's offer to use it, and the daily-limit check after a Fill (both described below), are where NotAfter keeps something it saw on a provider's site. Three things about the first of them:
It reads only the page you are looking at, in your own signed-in session, and only your own record. It has no way to reach another member's information, and no way to reach anything the provider has not already shown you.
The second one is the list of options a provider's own form offered you. When NotAfter pre-fills a submission form and the form asks which of your certifications the entry is for, it sometimes cannot work out which option matches the certification you are filing. When that happens it shows you the list and asks, and it saves that list, in the provider's own words, on your device. It keeps the ten most recent versions of each provider's list and writes a new one only when the list has changed, so that when a provider quietly renames or reorders that menu, the app can tell. It also keeps the answer you gave, which option is yours, so that it does not have to ask you again. The list and the answer are both in the provider's wording, not anything you typed, and never include a password, a code, or anything from a page where the check found a visible password box. Like everything else in §4, they stay on your device: there is no server that could receive them, and deleting the app removes them. Deleting the certification also removes the answer you gave for it, and so does tapping None of these is mine if the app asks you again, for example because the provider's list no longer offers the answer you gave.
Sometimes the provider's list offers only one option, and Fill chooses it even though its name differs from the name you gave the certification. NotAfter may then offer to rename your certification to the provider's name. If you accept, the certification takes that name, and NotAfter keeps it as the answer for future Fills. It stays on your device, and deleting the certification removes it.
After a Fill, one more check, for a provider's daily limit. Some provider forms say how many credits can count in one day for an activity. Where NotAfter has that sentence on record for the activity a Fill chose, it first checks that the form's activity menu still shows that activity, and then reads the text of the form's information and help notes, inside the page, looking for the sentence. The form can take a moment to draw its notes, so the app may look again for a few seconds; after that it stops. If the notes show the same sentence, NotAfter notes that they did, and the date, so that it can apply the limit to your totals. If they show a different limit line, NotAfter keeps that one line, in the provider's words, and the date, so that it can show you the provider's line instead of applying its own. It keeps nothing else from the page, only that one line. It also passes over anything the form marks as an error message, and any line that speaks to you or uses words such as entered, invalid, or required, since a line like that can repeat a figure you typed. The check runs only after a Fill that the password check cleared. What it keeps stays on your device and is never sent anywhere. Signing out of that provider in the app (described below) removes what it kept for that provider, and deleting the app removes all of it. If there is no session to sign out of, deleting the app is the way to remove it. Deleting a certification does not remove it, because it is about the provider's form as your account shows it, not about one of your certifications.
You can also import a screenshot instead of tapping Capture This Page. When you start bringing in your own figures, NotAfter first asks which way you want to do it, and Import a Screenshot or Photo is the second choice: a picture you took yourself of your own account page, with no signing in at all. You choose the picture in your device's own photo picker, exactly as in §5; the text on it is read on your device by the operating system's own text recognition; and you review the figures and decide whether to apply them before anything is saved. NotAfter keeps no copy of the picture and does not send it anywhere, and what is kept is the same kind of figures described above, on your device. This one is not a read of the provider's site: NotAfter sees only the picture you chose, so what is in it is your choice.
Pages about paying are for Safari, not the in-app browser. When the in-app browser is headed to a checkout or payment page, NotAfter hands that page to Safari, outside the app, and the in-app browser stays on — or steps back to — the page you were on. Paying a provider, renewal fees included, happens between you, the provider, and your own browser.
Your provider login stays signed in, on your device, until you sign it out. So that you are not made to log in to CompTIA, ISC2, or EC-Council every single time, the in-app browser keeps that provider's website data (cookies and site storage) in a separate store for each provider, inside NotAfter's own sandbox on your device. This store persists across app launches: it does not clear itself when you close the app, and it lasts until you clear it. That data is set by the provider's site and is subject to the provider's privacy policy; the app never examines a cookie's value and never reads credentials or session tokens out of it. It only counts the cookies in that provider's store and reads their expiry dates, to show you in Settings whether there is a session to sign out of. None of that data is ever transmitted to us. The app also keeps one small note of its own for each provider: whether your last visit in the in-app browser ended on the provider's sign-in page or past it, and when. It works that out from the page's address alone, never from what the page says, and shows it on that provider's page in Settings as Last visit. It stays on your device. To clear the website data and that note, open Settings, tap that provider under Providers, and tap Sign Out. You will be asked to confirm, and the app then deletes that provider's stored website data, and its Last visit note, from your device. The Sign Out button appears only while that provider's store holds cookies, because cookies are what the app counts. So when the provider's page says there is no session data on this phone, no provider cookies are left. Other site storage the provider's site set can still be there, and so can a Last visit note; the app has no separate button for those. Your next visit replaces the Last visit note, and if the provider's site sets cookies again, Sign Out comes back and clears all of it. Deleting the app removes all of it.
We receive nothing from this process unless you send us a report (§8). Otherwise we do not know whether you submitted, what you submitted, or whether the provider accepted it.
Some of NotAfter's features are sold as a subscription through the App Store. If you buy one:
Crash reports and usage figures from Apple. Apple may pass us crash reports and usage figures for NotAfter. They come from Apple's own collection, not from code in the app. If you installed NotAfter from the App Store, that happens only while Share With App Developers is on in your device's analytics settings, and Apple gives developers this information only in aggregated form or in a form that does not identify you. You can turn it off in Settings > Privacy & Security > Analytics & Improvements. If you are testing a beta of NotAfter through Apple's TestFlight, Apple collects crash logs and usage information automatically and shares them with us, and they can carry the name and email address you gave TestFlight, as can any feedback you choose to send. Apple's TestFlight terms govern that collection. We use the TestFlight crash logs, usage information and feedback only to find and fix problems in the app.
§9 lists every third party that receives anything in the ordinary operation of NotAfter, Apple included, and what each one receives.
Apart from a beta test through TestFlight (§7), this is the one place where we genuinely do handle your personal information, because you chose to send it to us.
What we receive: your email address, whatever you write, and anything you choose to attach.
If you use Report a Problem. In the in-app browser, once you have used Fill on the submission form, Report a Problem shows you a short technical report before anything else happens: the app's version, your iOS version and device model, which provider and page you were on (the address cut down as described in §4), the version of the form definitions in use, the hour of the check, which form fields NotAfter could and couldn't find, what kind of field each found one was, and how the Fill went. You can change or delete any of it. Open in Mail then puts it into an email to us in your own mail app, and nothing is sent until you send it there yourself. Once sent, it is support correspondence like any other email, and the rest of this section applies to it. The Report a problem link in Settings opens a blank email to the same address.
Purpose of use. We use it only to:
We do not use support correspondence for marketing, we do not build profiles from it, and we do not add you to a mailing list because you wrote to us.
Please do not send us: your provider password or one-time code (we will refuse it and ask you to change it), or a certificate image containing personal details you would rather not share, or your team list, or an export or screenshot of it, which holds other people's names. To diagnose a problem with an imported image we almost never need the certificate itself. Our support page explains what to send instead.
Who else sees it. Your correspondence is read only by us, and we do not sell or share it. Our mailboxes are run on ordinary commercial email services, described in §9.
Retention. We keep support emails for as long as we need them to help you and to keep a record of your support history. If you ask us at support@notafter.app, we'll delete your emails from our mailboxes. Copies in our email providers' backups expire on those providers' own schedules.
Email is not fully private in transit. Ordinary email is not end-to-end encrypted. Please don't send us anything you would not put on a postcard.
| Third party | What they receive | Why |
|---|---|---|
| Apple | Your purchase and subscription transaction; your Apple Account and payment details, which you give to Apple, not to us; and, under Apple's own settings and TestFlight terms, crash reports and usage information, which Apple may pass to us (§7); and, the first time the app proves it is a genuine copy (§3.2) and whenever it has to make a new key, the request your device makes to Apple's App Attest service, handled under Apple's own privacy policy | To sell and bill the subscription, to distribute the app, and to vouch that a copy of the app is genuine |
| Certification providers (CompTIA, ISC2, EC-Council and others) | Whatever you submit on their own website, in your own session, by tapping Submit yourself | To report your credits to the body that requires them |
| Our hosting provider | The access log described in §3.2: a shortened IP address, a timestamp, the file requested, and a user-agent string; and the list of app keys described in §3.2. Nothing about you, because nothing about you is sent | To serve the files the app downloads, to send the non-public one only to genuine copies of the app, and to let us detect abuse of that service |
| Our email providers | Support email you send us, in the ordinary course of operating a mailbox | To operate a support inbox |
Two of those rows are infrastructure, not audiences. Our hosting provider and our email providers handle information on our behalf and on our instructions, as part of running a server and our mailboxes. We do not authorise any of them to use it for their own purposes, and none is given anything about you beyond what the table says. We identify them by the role they play rather than by name, so that changing supplier is an operations decision and not a silent rewrite of this page. If you want to know who a particular provider is, ask us at support@notafter.app and we will tell you.
We do not provide personal information to any other third party, and we do not provide it to anyone for their own marketing purposes. We may disclose information if we are legally required to. We have very little that could be demanded.
The rights below are offered to everyone, in every country, regardless of whether a particular law applies to us. Where a specific law requires more, that is added. It is never subtracted.
In practice, for almost every user the honest answer to "what do you hold about me?" is "nothing, unless you have emailed us." If you test a beta through TestFlight, add the crash logs, usage information and feedback described in §7. Data in the app is in your own hands: you can read it, correct it, and delete it without asking us. If someone has added you to their team list in NotAfter, that list is on their device, not with us. We cannot see it, change it or delete it. Please ask the person who keeps it.
To exercise any of these, email support@notafter.app and say that your message is a privacy request. That address is the front door for everything, and we answer every request it receives about your own information. We will respond within a reasonable period and normally within 30 days. We may need to ask a question to confirm that the request comes from you. For support records, that usually means replying from the address that wrote to us in the first place.
The items below are the ones Japan's APPI asks a business to make available about its handling of personal information. We publish them whether or not the Act reaches us, because the answers are short, they are the same in every market, and arguing about whether we are in scope would take longer than answering.
support@notafter.app, our single contact address.support@notafter.app.Several US states have comprehensive privacy laws, most of which apply only to businesses well above our size. We are not claiming an exemption as a way of doing less: the rights in §11.1 are available to every US resident regardless, and the underlying fact is that we hold nothing to hand over.
For the avoidance of doubt:
NotAfter is a professional certification tool intended for adults holding IT and information-security certifications. It is not directed to children, and we do not knowingly collect personal information from children. If you believe a child has sent us personal information through support, email support@notafter.app and we will delete it.
notafter.app is a static informational site. It sets no advertising or analytics cookies, does not track visitors across sites, loads no third-party scripts, fonts, or embeds, and serves a content-security policy that forbids them. There is nothing on the site to opt out of.
If we change this policy we will update the date at the top, and, for a change that materially affects your rights or what we do with your information, we will say so in the app or on notafter.app. Because our practices are constrained by the app's architecture rather than by our intentions, a material change to this policy would mean a material change to the product. We would rather explain that than bury it.
Everything goes to support@notafter.app: support, privacy questions, requests about your own information, and a request for our postal address. We answer all of it.
NotAfter is an independent app and is not affiliated with, endorsed by, sponsored by, authorized by, or certified by CompTIA, ISC2, EC-Council, or any other certification body. All certification names and marks are the property of their respective owners and are used here only to describe which certifications NotAfter works with. NotAfter does not use their logos and does not represent them.
Nothing in NotAfter is a substitute for the rules published by your certification provider. Your provider's own portal and published policies are always authoritative for what you owe, by when, and how it must be reported.