This policy is written in plain language for the PrepArc app owner and is pending final legal review. It is not legal advice and does not claim independent certification.
Who we are
PrepArc is a personal vocabulary study tool for SSAT and SAT preparation, operated by an individual maintainer. Contact: hello@preparc.com.
What we collect
- Account: your email address and a hashed password (or the Google identifier if you sign in with Google), plus an optional display name.
- Your chosen test track: whether you are preparing for the SSAT, PSAT, SAT, or ACT, so the app shows the right practice.
- Grade level and Research Paper Navigator answers: the short intake answers you give the Navigator, such as grade, research interests, available resources, and hours per week.
- Dream school and college list: the schools you enter, used to personalize the app's colors and the Navigator roadmap.
- Practice progress and drill results: which words you have marked "got" or "still learning," and your results on vocabulary, math, reading, English, and context drills. This is stored in your account so it syncs across devices.
- Saved test dates: the test date you enter so the app can show your countdown.
- SSAT writing sample drafts: essays you write in the app are saved to your own account and visible only to you. They are never scored by AI, never reviewed by us for quality, and never shared with anyone else.
- Navigator notes: the notes and phase progress you record while planning your research paper.
- Parent SMS notifications (opt-in only): if a parent turns them on, we store the phone number to text and the per-event flags. If left off, we store nothing about a phone.
- Billing: PrepArc is currently free. We do not collect payment information and there is no checkout in the app.
- Basic operational logs: minimal server logs (timestamps, request paths, error codes) for security and troubleshooting. We do not log passwords, session tokens, or the contents of SMS messages.
Why we collect it
- Provide the study experience and sync progress across your devices.
- Authenticate you and protect the account.
- Send the parent SMS alerts you opted into.
- Detect abuse, prevent fraud, and diagnose errors.
What we do NOT do
- No advertising, ad tracking, or advertising cookies.
- No sale or "sharing" of personal information for cross-context behavioral advertising (as those terms are defined under California law).
- No use of student learning data to train third-party AI models.
Service providers we use
- Lovable Cloud (backed by Supabase): hosting, database, and authentication.
- Twilio: only when parent SMS notifications are enabled, to deliver texts.
- Payment processor: not in use today, since PrepArc is free. If that ever changes, we would never see or store your full card number.
- Google: only if you choose "Continue with Google," to authenticate you.
Each processor handles data on our behalf under its own terms and security program. We do not send data to any other third parties.
Children under 13 (COPPA)
PrepArc requires a free account to use the practice content, and accounts are for students aged 13 and up. Every account confirms this at signup. PrepArc is not intended for and should not be used by children under 13.
PrepArc does not currently offer verifiable parental consent or parent-managed child accounts. A parent cannot create or authorize an account for a child under 13 on their behalf at this time. If you believe an under-13 child has created an account, email hello@preparc.com and we will delete it.
We do not ask for a date of birth or exact age. We use a simple 13+ confirmation only to gate account creation and do not store an under-13 status.
Security
Data is transmitted over HTTPS. Passwords are stored only as salted hashes by our authentication provider. Access controls (row-level security) restrict database rows to the account that owns them. No online service can guarantee absolute security, but we work to apply reasonable technical and organizational safeguards appropriate for a small study tool.
Retention
Account, profile, and progress data are kept while your account is active. When you delete your account, associated rows are removed within roughly 30 days, except where a shorter or longer period is required for security, dispute resolution, or law (for example, minimal billing records for tax purposes). Parent phone numbers are deleted when you turn notifications off or delete the account.
Your choices and rights
- Turn parent SMS off any time in Settings.
- Request access, correction, or deletion of your data using the "Delete my account" action in Settings or by emailing hello@preparc.com.
- California residents may request the categories and specific pieces of personal information collected, request deletion, and are entitled to non-discrimination for exercising these rights. We do not sell or "share" personal information for behavioral advertising, so a "Do Not Sell or Share" link is not required.
International
PrepArc is operated from the United States. If you use it from elsewhere, you understand your information is processed in the US and other countries where our processors operate.
Changes
If we make material changes, we will update the effective date above and flag it in-app. Continued use after changes means you accept the update.
Contact
Questions, requests, or complaints: hello@preparc.com.