The short version
You need an account to use PrepPal, so we store your email and the study details you give us. Most of what the tools remember — your streaks, your progress, your planner — never leaves your device at all. We don’t sell anything to anyone, we don’t run advertising, and we don’t use third-party trackers. Usage analytics and practice reminders are optional and off unless you turn them on.
You can see everything we hold, download it, or delete your account entirely from Your data & privacy.
Who we are
The data controller is PrepPal — [REGISTERED NAME / SOLE TRADER NAME TO CONFIRM], [REGISTERED ADDRESS TO CONFIRM], Ireland. You can reach us about anything in this policy at hello@preppal.ie. We are not required to appoint a Data Protection Officer, so questions come straight to us.
What we collect, and why
| What | Why | Lawful basis |
|---|---|---|
| Your email address and password | To create your account, sign you in and let you reset your password. | Contract — Art 6(1)(b) |
| Your name, exam (JC or LC), exam year, school and points target | To personalise the tools, the countdown and your planner. | Contract |
| Your birth year | To work out whether you are under 16, which changes what we’re allowed to do. We never ask for a full date of birth. | Legal obligation — Art 6(1)(c) |
| A parent or guardian’s email, if you’re under 16 | Only to ask them about the two optional settings. Nothing else is ever sent to it. | Legal obligation |
| Credits, referrals, daily study claims and streaks | To run the rewards system you signed up for. | Contract |
| Which tools you open and when (“usage analytics”) | To see which tools are worth building more of, and which are broken. Optional. | Consent — Art 6(1)(a) |
| Your reminder settings and notification read receipts | To send the daily nudge you asked for and not show you the same news twice. Optional. | Consent |
| A record of the consents you gave or withdrew, and when | The law requires us to be able to prove we asked properly. | Legal obligation |
We do not collect: your location, your contacts, your photos, advertising identifiers, or anything from third-party trackers. There are no advertising or analytics SDKs in PrepPal.
What stays on your device
Most of what PrepPal remembers never reaches our servers. Your streaks, card progress, planner, milestones, practice log and saved feature requests all live in your browser’s local storage on the device you used. That means they are private to that device — and also that clearing your browser data will lose them. The full list is on the Cookies & storage page.
If you’re under 16
In Ireland the digital age of consent is 16 (Data Protection Act 2018, section 31). Below that age you can’t give valid consent for the optional things yourself — a parent or guardian has to.
We built PrepPal so this costs you nothing. Your account, every tool, your profile, your credits and your referrals run on contract, not consent, so they work normally whatever your age. The only two things that stay switched off until a parent or guardian confirms are usage analytics and practice reminders.
Parents and guardians: you can email us at hello@preppal.ie at any time to see what we hold about your child, change these settings, or have the account deleted.
Who else sees it
Nobody buys it, because we don’t sell it. We use a small number of service providers (“processors”) who handle data strictly on our instructions:
| Provider | What they do | Where |
|---|---|---|
| Supabase | Database, authentication and hosting of your account data | EU (eu-west-1, Ireland) |
| Vercel | Serves the PrepPal website | EU edge; company is US-based, covered by EU SCCs |
| Resend | Sends account emails (verification, password reset) | EU/US, covered by EU SCCs |
Your account database sits in the EU (Ireland). Where a provider is US-headquartered, transfers are covered by the European Commission’s Standard Contractual Clauses. We would only ever hand data to anyone else if the law required it.
How long we keep it
- Account and profile data — until you delete your account. Deletion is immediate and permanent.
- Usage analytics — 24 months, then automatically deleted by a nightly job.
- Consent records — for as long as your account exists, because they are the evidence that we asked you properly.
- Account emails (verification, password reset) — held briefly by our email provider for delivery, then discarded.
Your rights
Under the GDPR you can ask us to:
- Show you what we hold (Art 15) — instant, from Your data & privacy.
- Give it to you in a portable file (Art 20) — same button, downloads as JSON.
- Fix anything wrong (Art 16) — edit it in your profile, or email us.
- Delete everything (Art 17) — one button, immediate, no waiting on us.
- Restrict or object to processing (Arts 18 and 21).
- Withdraw consent (Art 7(3)) — flip the toggles off any time. It’s as easy to withdraw as it was to give, and withdrawing doesn’t undo anything that was lawful beforehand.
Most of these you can do yourself, right now, at Your data & privacy. For anything else, email us and we’ll reply within one month.
Automated decisions
Nothing here has a legal or similarly significant effect on you, and we build no profile of you on our servers — we hold no marks, no answers and no scores.
Your device does make one kind of decision, and you should know how it works. From the practice you’ve done on this device, PrepPal works out which topics look solid and which look shaky, and uses that to order the cards it offers you. It never adds cards, never holds one back, and never makes a session longer — it’s the same set, pointed somewhere. That calculation happens on your device, is never uploaded, and is shown to you on screen rather than kept from you. Clearing your device data at Your data & privacy removes it, and the app carries on working.
Keeping it safe
- Everything travels over HTTPS.
- Passwords are hashed by our authentication provider — we never see them and can’t recover them.
- Every table uses row-level security, so the database itself enforces that you can only ever read your own rows.
- We collect as little as we can get away with, which is the most effective security measure there is.
If you’re unhappy
Tell us first — hello@preppal.ie — and we’ll try to sort it. You also have the right to complain to the Data Protection Commission (Ireland), 6 Pembroke Row, Dublin 2, D02 X963, at any point.
Changes to this policy
If we change anything that matters, the version number at the top goes up and PrepPal will ask you about the optional settings again the next time you sign in. We won’t quietly widen what we do with your data.