Privacy Policy

1. Information We Collect

Account information: Name and email address when you register.

Study activity: Your flashcard progress (known/review later status), mini exam results, full exam results, and study streaks. We use this to power your dashboard and metrics.

Payment information: Subscription and payment data is processed by Stripe. We receive a Stripe customer ID and subscription status but never see or store your card number, CVV, or bank details.

Device information: A randomly generated device identifier stored in your browser (used solely to enforce the Lifetime plan single-device restriction).

Usage data: Standard web server logs (IP address, browser type, pages visited) for security and debugging.

2. How We Use Your Information

• To provide and improve the Service
• To authenticate your account and enforce subscription access
• To display your study progress and metrics
• To process payments and manage your subscription via Stripe
• To send transactional emails (account creation, password reset)
• To respond to support requests

3. Information Sharing

We do not sell, rent, or share your personal information with third parties for marketing purposes. We share data only with:

• Stripe - payment processing
• Neon.tech - database hosting (PostgreSQL)
• Vercel - application hosting
• Resend - transactional email delivery

Each of these providers processes data under their own privacy policies and applicable data protection agreements.

4. Cookies and Local Storage

We use cookies only for session management (keeping you logged in via NextAuth). We also use browser localStorage to store your device identifier for the Lifetime plan restriction. We do not use advertising or tracking cookies.

5. Data Retention

We retain your account and study data for as long as your account is active. If you delete your account, we will delete your personal data within 30 days, except where we are required to retain it by law (e.g., billing records).

6. Your Rights

Depending on your location, you may have rights under GDPR, CCPA, or other privacy laws, including the right to access, correct, export, or delete your personal data. To exercise these rights, email areprepsupport@gmail.com.

7. Security

We use industry-standard practices including bcrypt password hashing, HTTPS encryption, and Stripe's PCI-compliant payment infrastructure. No security system is perfect; we encourage you to use a strong, unique password.

8. Children's Privacy

The Service is not directed at children under 18. We do not knowingly collect personal information from minors.

9. Changes to This Policy

We may update this Privacy Policy periodically. We will notify you of material changes by updating the "Last updated" date above. Continued use of the Service after changes constitutes acceptance.

10. Contact

Privacy questions? Email areprepsupport@gmail.com.