Privacy Policy

• Account information. Your email address and authentication credentials, managed through our authentication provider (Supabase).
• Study data. Your answers to practice questions, per-question timing, skill-tier progress, notes and Playbook entries, and your messages with the AI tutor.
• Uploaded score reports. When you upload a practice-test score report, we extract performance metadata — which questions you answered, right or wrong, timing, and question types. We do not extract, store, or reproduce the text of official LSAT questions.
• Billing information (planned). When paid checkout launches, payments will be processed by Stripe. Stripe will receive your payment details directly; we will store only what we need to manage your subscription (such as plan, status, and a customer reference), never your full card number.
• Technical logs. Standard server logs (such as IP address, browser type, and timestamps) and error reports, used for security, rate limiting, and keeping the Service running.

We do not use advertising trackers or third-party behavioral-analytics scripts. We do not build advertising profiles, and we do not sell or rent your personal information to anyone. Product metrics we rely on are computed from our own database, not from tracking beacons.

• To provide the Service: diagnose your skills, select and generate practice questions, track progress, and power the tutor.
• To operate accounts, subscriptions, and support.
• To secure the Service: authentication, abuse prevention, and rate limiting.
• To improve the Service, using aggregated or de-identified usage data (for example, per-question difficulty statistics).
• To communicate with you about your account and the Service.

Core features are powered by large language models. When you use the tutor, request an explanation, or upload a score report for parsing, the relevant inputs (such as your chat message or report content) are sent to LLM providers via OpenRouter for processing. These providers process the data to return a response to you. We do not send your data to LLM providers for any purpose other than serving your request.

Your data is stored in a Postgres database and authentication system hosted by Supabase. Data is encrypted in transit, and access to production data is restricted server-side — client applications cannot query the database directly.

We share personal information only with:

• Service providers that host and run the Service (Supabase for database and auth; OpenRouter and its underlying model providers for AI processing; Stripe for payments once billing launches), each only as needed to perform their function;
• authorities, when required by law or to protect rights, safety, or the integrity of the Service;
• a successor entity in a merger or acquisition, in which case this policy continues to apply to your data.

We retain your data while your account is active. When you delete your account, you are signed out and access is disabled immediately, and any active subscription is canceled. Your data is soft-deleted and retained for approximately 30 days — during which you can contact us to restore it — and then permanently purged from our systems. Aggregated statistics that do not identify you may be retained.

You can access and update your account information in the app, export your data (available from account settings or by request), and delete your account at any time. Depending on where you live, you may have additional legal rights such as access, correction, deletion, and portability; to exercise them, contact us at the address below and we will respond as required by applicable law.

We use cookies solely to keep you signed in and to secure your session (authentication cookies via Supabase). We do not use advertising or cross-site tracking cookies.

The Service is not directed to children under 16, and we do not knowingly collect personal information from them. If you believe a child has provided us personal information, contact us and we will delete it.

We may update this policy as the Service evolves (for example, when Stripe billing launches). For material changes we will give notice before they take effect, and we will update the effective date above.

Privacy questions or requests: support@testifyprep.app. See also our Terms of Service.