Privacy Policy

1. Who we are and what this covers

PrepyAI is operated by an individual sole proprietor trading under the name PrepyAI(“we”, “us”, or “our”), who is the controller of the personal data described here. This policy explains what we collect through the PrepyAI website and app, why, and the choices you have.

We handle personal data in line with Israel's Privacy Protection Law, 5741-1981, and we aim to honour the access, correction, and deletion rights described below for all users.

2. Data we collect

We collect only what we need to run the Service:

• Account data — your email address and authentication identifiers. Sign-in is handled by our authentication provider; we do not store your password in readable form.
• Practice data — the sessions you run, the questions you practise, the answers, code, and designs you submit, and the scores, hints, and feedback generated for you, plus the progress shown on your dashboard.
• Collaborative room data — the content and messages you share in real-time practice rooms.
• Technical data — IP address, device and browser information, and log data, used for security, debugging, and abuse prevention.
• Billing data — handled by Lemon Squeezy (see below). We receive your subscription status, plan, and limited transaction details; we never receive or store your full payment-card number.

3. How we use your data

We use personal data to:

• provide the Service — generate and grade practice, and show your dashboard;
• operate accounts, enforce usage limits, and prevent abuse;
• provide support and respond to your requests;
• keep the Service secure and fix problems;
• comply with legal obligations and enforce our terms.

Our legal bases are: performing our contract with you, our legitimate interests in running and improving a secure Service, your consent where required, and compliance with the law.

4. AI processing of your content

To generate questions and produce grades, hints, and feedback, content you submit — your answers, code, designs, prompts, and room messages — is sent to third-party AI providers (currently Cerebras, Groq, Google Gemini), who process it on our behalf to return a result.

Please do not submit sensitive personal data, or confidential information you are not permitted to share, into practice exercises or collaborative rooms.

5. Cookies and tracking

We use only first-party, strictly functional cookies and similar storage — to keep you signed in, to remember your theme preference, and to record your timezone for accurate daily usage limits.

We do not use third-party advertising cookies, cross-site trackers, or analytics profiling. The activity charts on your dashboard are built from your own practice data, not from third-party tracking.

6. How we share data

We do not sell your personal data. We share it only with the service providers (processors) that help us run the Service, under appropriate confidentiality and data-protection obligations:

• our database, authentication, and hosting providers, which store your data;
• the AI providers named above, which process submitted content;
• Lemon Squeezy, which processes payments and subscriptions.

We may also disclose data where required by law, to enforce our terms, or to protect the rights and safety of our users or the public.

7. International transfers

Our providers may store and process data in countries outside your own, including in the United States and the European Union. Where data is transferred internationally, we rely on providers that offer appropriate safeguards for it.

8. Data retention

We keep your data for as long as your account is active, so that your practice history can power your dashboard. When you delete your account, we delete or anonymise your personal data within a reasonable period, except where we must retain certain records (for example, billing records) to meet legal obligations.

9. Your rights

Depending on where you live, you may have the right to:

• access the personal data we hold about you and receive a copy;
• correct inaccurate data;
• delete your data, including by deleting your account;
• object to or restrict certain processing, and withdraw consent where you gave it.

To exercise any of these, email us at prepyai26@gmail.com. You also have the right to lodge a complaint with the Israeli Privacy Protection Authority, or with your local data-protection regulator.

10. Security

We protect your data with encryption in transit, row-level access controls in our database, and restricted administrative access. No method of transmission or storage is completely secure, but we work to protect your data and to respond quickly if a problem arises.

11. Children

The Service is not directed to children under 16, and we do not knowingly collect their personal data. If you believe a child has provided us with personal data, contact us at prepyai26@gmail.com and we will delete it.

12. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will revise the date at the top of this page and, for material changes, take reasonable steps to notify you.

13. Contact

For any privacy question or request, email us at prepyai26@gmail.com.