Privacy Policy

Information you provide directly:

• Account information: name, email address, and password (hashed) when you register with email/password.
• OAuth information: name and email address provided by Google or GitHub when you sign in via those providers.
• MFA data: an encrypted TOTP secret if you enable two-factor authentication.
• Communications: any messages you send to support@adaptiveprep.app.

Information collected automatically:

• Usage data: practice test sessions, questions answered, scores, domain performance metrics, and session timestamps.
• Log data: IP address, browser type, operating system, referring URLs, and pages visited.
• Cookies and session tokens: authentication session cookies and JWT tokens necessary to keep you logged in.

Information from payment processors:

• We use Stripe for payment processing. We receive a customer ID and subscription status from Stripe but do not store your full card number or payment details on our servers.

Information sent to AI Coach (Anthropic):

• When you complete a practice test, we send a summary of your performance — including the chapters and domains tested, the questions you missed, your difficulty progression, and your overall score — to Anthropic's API to generate a personalized AI Coach analysis. We do not include your name, email, or any other directly identifying information in that request. Anthropic processes this data solely to return the analysis to you and, per their published policy, does not use it for model training.

We use the information we collect to:

• Create and manage your account and authenticate your identity.
• Provide, operate, and improve the Service, including generating adaptive practice tests and tracking your performance over time.
• Process payments and manage your subscription.
• Send transactional emails such as email verification, password reset, and account notifications.
• Respond to your support requests and communications.
• Monitor and analyze usage patterns to improve the Service.
• Detect, investigate, and prevent fraudulent or unauthorized activity.
• Comply with legal obligations.

We do not use your practice test responses or performance data for any purpose other than delivering and improving your personal experience on the Service.

We do not sell, trade, or rent your personal information to third parties. We may share your information only in the following circumstances:

• Service providers (sub-processors): We share information with third-party vendors who assist us in operating the Service. All sub-processors are contractually bound to use your information only as directed by us. Our current sub-processors are:
  • Railway — application hosting and PostgreSQL database hosting (United States).
  • Stripe — payment processing and subscription billing (United States).
  • Resend — transactional email delivery: email verification, password reset, support replies, and question-flag confirmations (United States).
  • Anthropic — AI Coach analysis of your test sessions, as described in Section 1 (United States).
  • Upstash — distributed rate limiting; receives a hash of your IP address to prevent abuse (United States).
  • Google / GitHub — identity providers, only if you choose to sign in with them. They receive an authentication request from us; we receive your name and email from them.
• Legal requirements: We may disclose your information if required to do so by law, subpoena, court order, or governmental authority.
• Business transfers: In the event of a merger, acquisition, or sale of substantially all assets, your information may be transferred as part of that transaction.
• Protection of rights: We may disclose information where we believe it is necessary to investigate, prevent, or take action regarding illegal activity, fraud, or threats to safety.

We use only strictly necessary cookies — those required for authentication, session management, and cross-site request forgery (CSRF) protection. We do not use advertising cookies, third-party tracking pixels, analytics cookies, or behavioral advertising technologies. Because we use only strictly necessary cookies, no cookie consent banner is required under the ePrivacy Directive.

Most browsers allow you to control cookies through their settings. Disabling these cookies will prevent you from logging into the Service.

We retain your account information and practice test data for as long as your account remains active or as needed to provide the Service. If you delete your account, we will delete or anonymize your personal data within 30 days, except where retention is required by law or for legitimate business purposes such as fraud prevention.

We implement industry-standard security measures to protect your information, including encrypted connections (HTTPS/TLS), hashed password storage (bcrypt), and optional two-factor authentication. However, no method of transmission over the Internet or electronic storage is 100% secure, and we cannot guarantee absolute security.

If you believe your account has been compromised, please contact us immediately at support@adaptiveprep.app.

Depending on your jurisdiction (GDPR for residents of the EU/UK, CCPA/CPRA for residents of California, and similar laws elsewhere), you have the right to:

• Access & portability: download a complete copy of your personal data in a structured, machine-readable JSON format. Available immediately at Account Settings → Your Data → Download my data.
• Deletion (right to erasure): permanently delete your account and all associated data. Available immediately at Account Settings → Danger Zone → Delete my account.
• Correction: request that we correct inaccurate or incomplete information.
• Withdraw consent: withdraw the consent you gave at sign-up at any time by deleting your account.
• Non-discrimination: we will not discriminate against you for exercising any of these rights.
• Opt-out of sale/sharing: we do not sell or share your personal information with third parties for advertising purposes, so this right does not apply.

For correction requests or any other privacy concerns, please email support@adaptiveprep.app. We will respond within 30 days.

The Service is not directed to children under the age of 13, and we do not knowingly collect personal information from children under 13. If we learn that we have collected personal information from a child under 13, we will promptly delete it. If you believe we have collected such information, please contact us at support@adaptiveprep.app.

The Service is operated in the United States, and all of our sub-processors (listed in Section 3) are also located in the United States. If you are accessing the Service from the EU, UK, or another jurisdiction with restrictions on cross-border data transfers, your information will be transferred to, stored, and processed in the United States.

For EU/UK users, this transfer takes place under the European Commission's Standard Contractual Clauses (SCCs) and equivalent UK addendum, which we and our sub-processors maintain with the relevant parties. By creating an account and accepting this Privacy Policy at sign-up, you provide explicit consent to this transfer as an additional safeguard.

The Service may contain links to third-party websites. We are not responsible for the privacy practices or content of those sites. We encourage you to review the privacy policy of any third-party site you visit.

We may update this Privacy Policy periodically. We will notify you of significant changes by updating the effective date at the top of this page and, where appropriate, by sending an email to your registered address. Your continued use of the Service after changes are posted constitutes your acceptance of the updated policy.

If you have any questions or concerns about this Privacy Policy or our data practices, please contact us at support@adaptiveprep.app.