Privacy Policy

Not yet in effect. Owner review and completion of the legal details are pending.

Effective date: [YYYY-MM-DD, the day the pages go public]

This Privacy Policy explains how [PUBLISHER LEGAL NAME, e.g. an LLC name or the owner's full legal name if operating as a sole proprietor] ("PrepLuma," "we," "us," or "our") handles personal information when you use the PrepLuma website, mobile application, and related services.

Information we collect

We collect information you provide, including your email address, optional display name, account credentials in protected derived form, study settings, support messages, and choices you make in the product.

We collect product activity needed to operate the service, including lesson progress, question attempts, review history, mock exam results, completion timestamps, and consent records. The same server-owned account record supplies this state to authenticated website and mobile clients.

When you purchase access, Apple, Google, Stripe if web billing is enabled, and RevenueCat may process transaction and subscription information. We receive identifiers and entitlement status needed to unlock access and retain bounded provider-source records for reconciliation, restore, management, refunds, deletion, and legally required records. Provider account identifiers are not returned in ordinary membership API responses. We do not receive full payment-card numbers from native app purchases.

We collect limited security and operational information, which may include IP address, user agent, session timestamps, request identifiers, and authentication or rate-limit events.

Study reminders are scheduled locally on your device. The current app does not collect a remote push token for these reminders.

How we use information

We use information to:

create, authenticate, secure, and support accounts
provide lessons, practice, review scheduling, mock exams, and progress
verify, restore, and manage paid access
send account verification, password recovery, support, and service messages
detect abuse, investigate incidents, and protect the service
maintain required consent, transaction, and operational records
correct content and improve the reliability of the product
comply with law and enforce our terms

How we disclose information

We may disclose information to service providers that operate the product on our behalf, including:

Hosting: Railway
Database and backups: SQLite on a Railway volume with encrypted backups in Cloudflare R2
Transactional email: Resend
Native purchases and entitlement management: Apple App Store, Google Play, RevenueCat
Website purchases, if enabled: Stripe
Support or monitoring: None

We may disclose information when required by law, to protect rights and safety, or as part of a business transaction subject to appropriate safeguards.

We do not sell personal information. The current product does not use personal information for cross-context behavioral advertising and does not use advertising SDKs.

California Do Not Track disclosures

PrepLuma does not use third-party tracking or advertising cookies and does not respond differently to Do Not Track or Global Privacy Control signals because there is nothing to opt out of.

We do not permit third parties to collect personal information about your online activities over time and across different websites through PrepLuma for advertising.

Retention

We retain information only for as long as needed for the purposes described here, including security, support, tax, accounting, dispute, and legal obligations. The data retention schedule below describes our retention periods. Backups may retain deleted information for a limited period before automatic expiration.

Data retention schedule

Active account and profile: While the account is active. Delete when the account is deleted, subject to listed exceptions.
Study settings, progress, attempts, review, and mocks: While the account is active. Delete with the account.
Sessions: 14 days from creation or last valid replacement. Expired rows are removed by automated maintenance.
Password-reset tokens: 30 minutes. Expired rows are removed by automated maintenance.
Email-verification tokens: 24 hours. Expired rows are removed by automated maintenance.
Rate-limit buckets: Until the bucket resets. Expired rows are removed by automated maintenance.
Support tickets: 24 months after closure. Delete or de-identify unless needed for an active dispute.
Consent records: Account lifetime plus 5 years. Retain only if needed to prove consent or legal compliance.
Payment and webhook records: 7 years, or the shorter or longer period required by applicable tax law. Minimize stored payloads and delete when the period ends.
Security audit events: 24 months. Delete or de-identify unless tied to an active incident.
Provider deletion jobs: Until completion, then 12 months in pseudonymized form. Remove external customer ID immediately after completion.
Application logs: 30 days. Rotate automatically and avoid request bodies or secrets.
Encrypted backups: 30 days. Expire automatically; deleted data may remain until backup rotation completes.

Account deletion target

Local account data: immediate after password confirmation
RevenueCat customer data: immediate provider request, with durable retry on failure
Other processors: request promptly and complete within 30 days unless law permits or requires retention
User confirmation: state when deletion is complete and disclose any narrow retained records

Your choices and rights

You can update study settings in the app. You can export your account data and request permanent account deletion on the website, or use You, Your data in the app.

Depending on where you live, you may have rights to access, correct, delete, restrict, or obtain a copy of personal information, and to appeal certain decisions. Submit a request to support@prepluma.com. We may need to verify your identity.

Deleting a PrepLuma account does not automatically cancel a store subscription. The app provides subscription-management access, and the deletion flow explains any required store step. We will delete or de-identify associated data unless retention is required for security, fraud prevention, financial records, dispute resolution, or law.

Security

We use administrative, technical, and organizational measures designed to protect information. No system can guarantee absolute security. Use a unique password and notify us if you believe your account has been compromised.

Children

PrepLuma is not directed to children under 18, and we do not knowingly collect personal information from children under 18. If you believe a child provided information, contact us.

International processing

Information may be processed in the United States and other locations where our providers operate. Where required, we use appropriate safeguards for international transfers.

Changes

We may update this policy. We will post the updated version here and change the effective date. For material changes, we will announce the changes through a prominent website or in-app notice, or by email, before they take effect when required. Previous effective dates and the revised policy will identify when changes apply.

Contact

[PUBLISHER LEGAL NAME, e.g. an LLC name or the owner's full legal name if operating as a sole proprietor]

[MAILING ADDRESS THAT MAY APPEAR PUBLICLY; a registered agent or mailbox address is acceptable]

Privacy: support@prepluma.com

Support: support@prepluma.com