Privacy Policy

Last updated 13 October 2026

1. What we collect

• If you create an account: your email address, a securely hashed password (we never see or store your plain-text password — this is handled by our authentication provider, Supabase), your name, a username, and — optionally — a mobile number.
• If you buy a paid plan: which plan you have, its status and renewal date, and the customer and subscription IDs Stripe gives us. Your card details go straight to Stripe and never reach our servers.
• Your revision progress: which questions you've answered, whether you got them right, your XP, streak, and quiz session history, your progress through lessons and your answers to the checks in them, plus your exam date if you choose to set one.
• If you send us a bug report: what you write in it, the page you reported it from, the details of your browser (such as its type and version), and your email address if you choose to give one. If you're signed in, the report is linked to your account.
• If you message us from your account page: your message and its topic, your account email (so we can reply) and which plan you're on.
• How you use the site: the pages you visit, the site that sent you and any campaign tags in the link (for the first page of a visit only), your device type (mobile, tablet or desktop) and your country, worked out from your connection. Pages from the same visit are grouped by a random ID kept in your browser tab, which is cleared when you close the tab. If you're signed in, these records are linked to your account. We don't store your IP address.
• Notes we keep for ourselves when we help you with something, such as a support conversation, and a record of whether we've sent you our one-off welcome email.

2. Cookies, browser storage and analytics

We don't use advertising trackers or advertising cookies, and we don't sell or share your personal data with third parties for marketing purposes. To keep you signed in, your browser keeps your session in its local storage; if you revise before creating an account, your progress is kept there too. We use Vercel Web Analytics and Speed Insights to count page views and measure site performance. These are cookieless and aggregated: they don't build a profile of you or follow you across other sites.

We also keep our own record of how the site is used (described above), to see which pages help people and where they get stuck. To opt out, turn on Global Privacy Control or “Do Not Track” in your browser, and we won't record your visits.

3. Why we process it, and our lawful basis

• To provide the Service you signed up for: your account, lessons, quizzes, mock exams, paid plan, and saving your progress so it syncs across your devices. (Contract.)
• To send emails about your account, such as verification links, password resets and a one-off welcome email. (Contract.)
• To send you DeckPrep updates and offers by email, only if you ticked the box at sign-up or switched it on in your account. You can unsubscribe from any email or turn it off in your account at any time. (Consent.)
• To take payments and keep the records the law requires us to keep. (Contract and legal obligation.)
• To reply to your messages and bug reports, and to fix what you tell us about. (Legitimate interests: running a reliable service.)
• To understand how the site is used so we can improve it, using the site-usage records above. (Legitimate interests; you can opt out as described in section 2.)
• To keep the Service secure and prevent abuse, such as spam through our forms. (Legitimate interests.)

4. Who processes it on our behalf

We use four sub-processors to run DeckPrep: Stripe (taking payments), Supabase (authentication and database storage, London (UK) region), Vercel (application hosting and site analytics) and Resend (sending emails, such as account verification, our welcome email, and notifications to us about bug reports and messages). Each is bound by its own data processing terms. Supabase and Vercel don't use your data for their own purposes. Stripe also acts as an independent controller of payment data (for example for fraud prevention and its own legal obligations) — see Stripe's privacy policy for how it handles that.

5. How long we keep it

Your account, progress, messages to us and our notes about you are kept for as long as your account exists, and are permanently deleted with it. Deleting your account also cancels any subscription straight away. Bug reports are kept for as long as we need them to investigate and fix the problem, and site-usage records are kept so we can compare how the site is used over time. When you delete your account, both are unlinked from it; a bug report still contains whatever you wrote in it, including an email address if you gave one, so email us if you'd like yours removed. Stripe keeps its own payment records for as long as the law requires.

6. Your rights

If you're in the UK or EU, UK/EU GDPR gives you the right to access, export, correct, or delete your personal data, and to object to how it's processed. In practice:

• Export: download a copy of your profile and revision progress any time from your account settings. For a copy of anything else we hold about you, email us.
• Delete: permanently delete your account from your account settings (see section 5 for what happens to bug reports and site-usage records).
• Anything else (correction, objection, or a question about your data): email deckhandprep@gmail.com and we'll respond within one month.

If you're unhappy with how we've handled your data, you can complain to the Information Commissioner's Office at ico.org.uk.

7. Security

We use industry-standard measures (encrypted connections, row-level database access controls scoping every user to their own data) to protect your information, but no system can be guaranteed 100% secure.

8. Children

DeckPrep is not intended for children under 16.

9. Changes to this policy

We may update this policy from time to time; material changes will be reflected here with an updated date.

10. Contact

Questions or requests about your data: deckhandprep@gmail.com.