Educational purpose
ASVAB Forge provides independent ASVAB and AFQT preparation through original practice questions, guided lessons, flashcards, diagnostics, and progress tracking. It is not affiliated with or endorsed by the U.S. Department of Defense.
Allowlist information
The primary domain is asvabforge.com. Account registration uses Cloudflare Turnstile, which may require access to challenges.cloudflare.com. Cloudflare's aggregate analytics domains are optional for core study use. The site does not require executable downloads, browser extensions, pop-ups, advertising networks, or URL shorteners.
Data minimization
Accounts use a username, email address, and password. The service does not request a home address, phone number, date of birth, Social Security number, military record, payment information, or precise location. Optional names can be omitted, and students can download or permanently delete their data.
Security controls
Traffic is encrypted with HTTPS. Passwords are salted and hashed rather than stored as readable text. Sessions use secure, HTTP-only cookies and expire after inactivity. Email verification, expiring recovery links, session revocation after password reset, bot protection, request throttling, cross-site request protection, request-size limits, and restrictive browser security headers help protect the service.
Student privacy and age
Self-service registration is limited to people age 13 or older. Students under 13 may use the service only through a school- or parent-authorized arrangement. School use involving education records should be reviewed under the school's FERPA procedures, and under-13 use should be reviewed for COPPA consent and contracting requirements. This page describes controls; it is not a certification of legal compliance.
Purpose and disclosure
Student information is used to deliver and improve the study service, restore progress, personalize recommendations, prevent abuse, and maintain reliability. ASVAB Forge does not sell student information or use it for targeted advertising.
Retention
The current public service retains verified accounts and study records until the user deletes the account. Students can export and erase their information through Profile & Account. District-managed retention periods, bulk deletion, and school-controlled provisioning require a separate written school arrangement and are not yet features of the public service.
Third-party services
Cloudflare provides hosting, security checks, and privacy-focused aggregate web analytics. Resend delivers account verification and password-recovery email. Schools evaluating a deployment should review these services and the Privacy Policy under their own vendor-approval process.
Filtering and review
If the site is blocked as new or uncategorized, network administrators may classify it as Education, Test Preparation, or Training and allowlist the domains above. Administrators can also request a database review through Palo Alto Test A Site or Zscaler Site Review. ASVAB Forge does not use alternate domains or proxies to evade school policies.
Current readiness boundary
The public service is suitable for individual learners and school evaluation. A district-wide rollout should establish a written school agreement, designated privacy contact, record-retention schedule, incident-response commitments, and school-controlled account provisioning before students are assigned accounts.