The short version
We collect what we need to run your account and your study plan. We don't sell it, we don't use it for ads, and we don't let anyone track you across other sites through preptrak. You can see it, fix it, or delete it any time. Most of the people who use preptrak are 13 to 17, and we handle everyone's information with that in mind.
What we collect
If you join the early access list, we store your email address, the courses you chose, and your birth year. If you create an account, we store your email address, your birth year, a display name (your username, or the name on your Google account), and a record of each device you're signed in on: when you signed in, its IP address, and which browser it is. If you sign in with Google, we also store the link to your Google profile picture and the sign-in tokens Google gives us. If you use a password, we store only a one-way scrambled form of it (a scrypt hash), never the password itself. After you create an account, we ask about your studies so we can build your plan: your grade, the AP courses you're taking, whether you're in a class or studying on your own, where each class is, your grade in it, your target score and whether you plan to take the exam, which days and how long you can study (including different times on different days, and days off), your timezone (for reminder times), whether you want study reminders, what helps when you're stuck, and your calculator. If you choose to, you can also tell us about your class tests (the date, the kind of test, the units it covers, and your score), how sure you feel about each unit, and what costs you the most points. When you take a diagnostic, we store each answer (or that you marked a question not learned yet, or didn't answer it), whether it was right, how long it took, and your results. When you practice while signed in, we store each answer you check: which question it was, the choice you picked or the points you gave yourself against the scoring guide, whether it was right, when, and how long you spent on the question; and, if you tell us, why you missed it or that you guessed. That's what your progress is made of. If you practice without signing in, we store nothing about your answers. If you subscribe, Stripe handles the payment: your card or bank details go to Stripe, never to us. We keep only which courses are paid for, whether you or a parent paid, the subscription's status, start and renewal dates, Stripe's customer ID, and when we sent each of the plan emails below. If you send a payment link to a parent, we pass their email address to Stripe and our email provider to send it, and don't keep it. If you email us, we keep the conversation so we can help. We ask for your birth month and year only to confirm you're 13 or older: the month is used for that check and not kept, only the year is. We never ask for your full date of birth, your school, or where you live.
Sign-in choices
You can sign in with a username and password, a one-time link we email you, or your Google account. Passwords must be at least 12 characters. An account with a password needs a confirmed email address, because that's how you reset a forgotten password. Emailed links work once and expire after an hour, and resetting your password signs you out everywhere else.
What we use it for
To let you sign in, to save your progress, to build your study plan and choose the questions in it (from your answers, your diagnostic, and what you told us about your studies), to handle your subscription, to email you about your account, to keep preptrak secure, and to find and fix mistakes in our questions. If you turn on Analytics in Cookie settings, also to see how the site is used (which pages, where people get stuck, what's slow or broken) so we can improve it. That all happens inside preptrak. We don't sell your information, we don't share it with advertisers or use it for ads, and we don't build a profile of you for anything but your own study plan.
Emails we send
Sign-in links, email verification, password resets, and a confirmation when you delete your account. For a paid plan, whoever paid gets a confirmation of the plan's terms after the first payment and a reminder once a year while it renews, as California law requires, and Stripe emails them receipts. We send the confirmation to the address typed at checkout and ask Stripe for the address when a yearly reminder is due, so we never keep it. If you ask us to send a parent a payment link, that email has a one-click unsubscribe; if they use it, we keep a scrambled fingerprint of their address (an HMAC, not the address) so we never email it a link again. If you joined the early access list, we'll email you when accounts open for your courses. We don't send other marketing email. Study reminders aren't being sent yet; they're off unless you turn them on in your study settings, and every reminder will let you turn them off in one click.
Who else sees your information
Five companies handle parts of preptrak for us, and only to run it. Cloudflare hosts the site: it runs the database that holds your account and progress, checks sign-in and registration forms for bots (Turnstile), and keeps our request logs. Google, if you sign in with Google: it confirms who you are. Resend delivers our emails (sign-in, verification, recovery, and deletion emails, plan confirmations and yearly reminders, and payment links you send a parent): it sees the email address and the message. Stripe, if you subscribe: it takes the payment and sees the payer's name, email address, and payment details, and also uses payment information under its own privacy policy (stripe.com/privacy), for example to prevent fraud. PostHog, only if you turn on Analytics in Cookie settings: it records which pages you open and what you click, your browser and device, your rough location (country and region, worked out from your IP address, which it then throws away), how fast pages load, errors the site runs into, and recordings of your visits so we can see where something is confusing. Everything you type is hidden in those recordings, and sign-in, account, billing, and setup pages are never recorded. PostHog knows a signed-in student only by their account's ID number, never their email address or name, and it reaches PostHog through our own site. Cloudflare, Resend, Stripe, and PostHog each process information for us under a data processing agreement that limits them to providing their service; Google handles sign-in under its own privacy policy (policies.google.com/privacy); what we receive from it is listed above. That's the whole list. Beyond it, we share information only when the law requires it (a valid court order, for example), to protect someone's safety, or if preptrak is sold or merged, in which case this policy still covers what we already have.
Do Not Track and Global Privacy Control
We don't track you across other sites or let anyone do it through preptrak, and we don't sell or share your information for advertising, so there's nothing for these browser signals to switch off. We treat them as a request not to, all the same: if your browser sends Global Privacy Control, we set your cookie choice to necessary only without asking, and optional cookies stay off unless you turn them on yourself in Cookie settings.
Students under 13
preptrak isn't for children under 13. We ask everyone's birth month and year before an account is created, and keep only the year. If the answer shows someone is under 13, we don't create an account or keep what they entered, and the forms stay closed on that browser for 30 days. If we learn we've collected information from a child under 13 anyway (a parent tells us, for example), we delete the account and its information. Parents and guardians can reach us at privacy@preptrak.org.
Students 13 to 17
Several states have rules for teenagers' information, and we follow them whether or not they apply to a service our size: we collect only what preptrak needs, use it only to run preptrak for you, never sell it, never use it for targeted ads or to profile you for anything else, don't use design tricks to get more of it, and let you delete it any time. We don't need a parent's consent for students 13 and older, but a parent or guardian can make any request below on a student's behalf.
How long we keep it
Your account, your answers, and your plan stay until you delete them. Early access sign-ups stay until you ask us to remove them or delete your account. Emailed links expire after an hour, and sign-ins expire after 30 days without a visit. Our host's request logs (the page asked for, with anything after a ? removed, and details like your IP address and browser) are deleted after 7 days. Records of which plan emails we sent are deleted with your account. If you turned on Analytics, recordings of your visits are deleted after 30 days; other analytics data is tied only to your account's ID number, and we'll delete it if you ask. An unsubscribe fingerprint is kept for good, because an opt-out has to keep working. Deleted information can remain in our database host's automatic backups for up to 30 days before it's gone for good. Stripe keeps its own records of payments, as the law requires, even after you delete your account.
Seeing, fixing, and deleting your information
You can change your courses and study settings, and delete your account yourself, from your Account page (preptrak.org/account). We'll confirm by email once the account is deleted, and deleting cancels any subscription right away. You can also email privacy@preptrak.org from the address you signed up with to get a copy of your information, fix something that's wrong, or have it deleted. We'll answer within 45 days, usually much sooner, and may need to confirm it's you. A parent or guardian can ask on a student's behalf once we've confirmed they are one. If we turn down a request, reply and we'll look at it again. We'll never treat you differently for asking.
Keeping it safe
Everything travels over HTTPS. Passwords are stored only as hashes, emailed sign-in links are stored only in scrambled form and work once, and only the people who run preptrak can reach the database. No system is perfectly secure; if a breach affects your information, we'll tell you as the law requires.
Changes to this policy
When we change this policy, the date at the top changes. If a change affects how we use or share information you've already given us (a new company that handles it, for example), we'll email you before it takes effect, and ask your permission first where the law requires it.
Contact
Questions or requests: privacy@preptrak.org.