Privacy Policy
Last updated: 2026-09-30
Template prepared from the project blueprint. Have it reviewed before launch.
What we collect
- Account: your name, email address and a password (stored only as a salted hash). Country and exam date only if you add them.
- Premium: payments are handled by Stripe. We receive confirmation of payment and the plan end date — never your card details.
- Practice data: your answers, scores, which practice sections you have seen, and your speaking recordings.
- Usage: pages visited and events such as “set completed”, through Google Analytics 4 and Cloudflare Analytics.
Before you have an account
Visitor progress is stored only in your browser (local storage and IndexedDB). It moves into your account when you sign up. Before that, your answers are not sent to us — only which test or set you start (see the next section).
Giving you something new each time
To avoid giving you a test or practice section you already took, we remember which ones you started and how many times you visited. With an account this is linked to your account. Without one, we use a one-way, salted hash of your IP address. We never store the IP address itself, and we delete hash records after 13 months without a visit.
Where it is stored
Account data and answers are stored in Supabase (PostgreSQL) with row-level security: each user can read and change only their own records. Speaking recordings are stored in a private bucket in a folder that only you can access.
Analytics, advertising and cookies
Google Analytics and Google AdSense cookies are used only with your consent. Visitors from the EEA, the UK and Switzerland are asked first — by our own banner, or by a Google-certified consent platform when ads are shown — and until they choose, those cookies stay off (Google Consent Mode). You can refuse, and change your choice at any time under Cookie settings. Details: Cookie Policy.
Why we may use your data (legal bases, GDPR art. 6)
- Contract — your account, progress, results, recordings and Premium: needed to give you the service you signed up for.
- Legitimate interest — the salted IP hash that avoids repeating tests, security and preventing abuse. You can object (see Your rights).
- Consent — analytics and advertising cookies, and personalised ads. You can withdraw it at any time; this does not affect what happened before.
- Legal obligation — payment records we must keep for tax purposes.
Who processes data for us
Supabase (accounts and data), our hosting provider, Stripe (payments), Brevo or another email provider (sign-up and password codes), and Google (Analytics and AdSense, only with consent). Some of them may process data outside the EEA; where they do, they rely on the EU Standard Contractual Clauses or the EU–US Data Privacy Framework.
How long we keep it
Account data until you delete your account. Salted IP-hash records: 13 months after your last visit. Analytics cookies: up to 2 years. Payment records: as long as tax law requires.
Your rights
You can edit your profile and delete your account at any time in Settings. Deleting your account permanently removes your profile, attempts, answers and recordings.
If you are in the EEA, the UK or Switzerland you also have the right to access your data, have it corrected, erased or restricted, to receive it in a portable format (portability), to object to processing based on legitimate interest, and to withdraw consent at any time. Write to us at the address below — we answer within one month. You can also complain to your local data protection authority.
Children
Prepora is not intended for children under 13 (or the minimum age in your country).