Privacy Policy

Last updated 17 September 2026

1. What we collect

• If you create an account: your email address and a securely hashed password (we never see or store your plain-text password — this is handled by our authentication provider, Supabase).
• Your revision progress: which questions you've answered, whether you got them right, your XP, streak, and practice session history.
• If you use guest mode (no account): the same progress data, but stored only in your own browser's local storage — it never reaches our servers at all.

2. What we don't collect

We don't use advertising or analytics trackers, and we don't sell or share your personal data with third parties for marketing purposes. The only cookies set are the essential ones needed to keep you signed in.

3. Why we process it

• To provide the Service — in particular, to sync your progress across devices if you have an account.
• To keep the Service secure and working correctly.

4. Who processes it on our behalf

We use two sub-processors to run DeckPrep: Supabase (authentication and database storage, EU-London region) and Vercel (application hosting). Both are bound by their own data processing terms; neither uses your data for their own purposes.

5. How long we keep it

Account data is kept for as long as your account exists. Guest data stays only on your own device until you clear your browser storage or ask us to help remove it. Deleting your account (see below) permanently removes your account data from our systems.

6. Your rights

If you're in the UK or EU, UK/EU GDPR gives you the right to access, export, correct, or delete your personal data, and to object to how it's processed. In practice:

• Export: download a copy of your data any time from your account settings.
• Delete: permanently delete your account and all associated data from your account settings.
• Anything else (correction, objection, or a question about your data): email charlieaverywork@gmail.com and we'll respond within a reasonable time.

7. Security

We use industry-standard measures (encrypted connections, row-level database access controls scoping every user to their own data) to protect your information, but no system can be guaranteed 100% secure.

8. Children

DeckPrep is not intended for children under 16.

9. Changes to this policy

We may update this policy from time to time; material changes will be reflected here with an updated date.

10. Contact

Questions or requests about your data: charlieaverywork@gmail.com.