Privacy Policy

1. Data Minimization & Information We Collect

We collect only information necessary to deliver and secure our educational study tools:

• Account Credentials: Email address and salted, securely hashed password (bcrypt).
• Study Progress: Practice exam answer submissions, score reports, and study notes chat history.
• Billing Records: Handled entirely by our Merchant of Record, Paddle.com, via secure tokens. EmmaPrep never stores credit card or debit card numbers on our servers.

2. AI Model Training & Data Handling

Your exam submissions, diagnostic weaknesses, and private study notebook queries are not used to train AI models.

Under OpenAI’s commercial API Data Usage Policy, data sent through their API endpoints is not used to train or improve OpenAI foundation models. API request content is retained by the API provider for up to 30 days solely for temporary security and abuse-monitoring purposes, after which it is deleted.

3. First-Party Cookieless Web Analytics

To monitor platform performance, reliability, and content usage without compromising student privacy, we operate a self-hosted, cookieless web analytics system:

• No IP Address Storage in Analytics: Your raw IP address is not stored in our analytics database. At request time, it is combined in memory with a secret salt, the UTC date, and your browser’s User-Agent string to produce a one-way HMAC-SHA256 daily visitor hash. As with standard web services, our hosting provider may maintain infrastructure access logs.
• Daily Hash Rotation: Because the hash rotates at midnight UTC every day, visits across different calendar days cannot be joined or correlated. Cross-site and cross-day tracking are impossible.
• 95-Day Retention & Automatic Pruning: Detailed event logs are kept for 95 days solely for aggregation and are permanently purged daily by an automated pruning job.
• Coarse Metadata: We collect country, city, and general client information (device category, browser name, operating system) derived at the edge.
• Benchmark Comparison: During an initial transition period, @vercel/analytics remains co-mounted alongside our first-party engine to confirm telemetry accuracy before third-party tracking scripts are retired.

4. Data Subject Rights & Requests

Depending on your location, you may have the right to access, export, or request permanent deletion of your personal account data at any time. You can request data export or account closure by contacting us at privacy@EmmaPrep.com.