PrepQuest

Privacy Policy

PrepQuest Effective date: April 1, 2026 Last updated: April 1, 2026

Table of Contents

  1. Introduction
  2. Information We Collect
  3. How We Use Your Information
  4. What We Don't Do
  5. Data Storage & Security
  6. Data Retention
  7. Your Rights
  8. Cookies
  9. Third-Party Services
  10. Children's Privacy
  11. Changes to This Policy
  12. Contact Us

1. Introduction

PrepQuest ("PrepQuest," "we," "us," or "our") is a CFA exam study platform available at prepquest.io (the "Service"). We help candidates prepare for the CFA exam across all three levels with gamified lessons, quizzes, flashcards, and progress tracking.

This Privacy Policy explains what personal information we collect when you use PrepQuest, how we use it, and what rights you have over it. It applies to all users of prepquest.io, including free and Pro subscribers.

By creating an account or using the Service, you agree to the practices described in this policy. If you don't agree, please do not use PrepQuest.

2. Information We Collect

2.1 Account Information

When you create an account, we collect:

  • Email address: required to identify your account and send transactional emails (account verification, password reset)
  • Display name: optional, used to personalize your dashboard
  • Password: never stored in plain text; handled by Supabase Auth using industry-standard hashing

If you sign up through a third-party OAuth provider (e.g., Google), we receive your email address and display name from that provider. We do not receive your password or payment details from OAuth providers.

2.2 Study Progress Data

When you use PrepQuest, we store your activity to power the platform:

  • Lessons completed and their timestamps
  • Quiz question results (correct/incorrect, not your specific answers)
  • XP points, level, and streak data
  • Achievements unlocked
  • Flashcard study sessions
  • Daily study activity

This data is stored in our database (Supabase), tied to your account, and is what makes progress tracking possible. We don't collect this data for any purpose other than running PrepQuest for you.

2.3 Subscription & Payment Information

If you subscribe to PrepQuest Pro:

  • Stripe processes all payments on our behalf
  • PrepQuest never sees, receives, or stores your card number, billing address, or any other payment details
  • We only receive from Stripe: your subscription status (active/cancelled), plan type (monthly/annual), and renewal date
  • Stripe's privacy policy is at stripe.com/privacy

2.4 Technical & Usage Data

We automatically collect limited technical data when you use the Service:

  • IP address: collected by Vercel (our hosting provider) for security and abuse prevention
  • Browser type and version
  • Device type (desktop or mobile)
  • Page views and navigation patterns: collected by Vercel Analytics in a privacy-preserving, cookieless manner (no cross-site tracking, no fingerprinting)
  • Error data: collected by Sentry when the app crashes or encounters an error, to help us fix bugs. This may include a stack trace and the URL where the error occurred.

We do not use any of this technical data for advertising or to build profiles of you.

3. How We Use Your Information

We use the information we collect to:

  • Provide and operate the Service: run your account, serve content, and track your progress
  • Personalize your experience: display your XP, streak, achievements, and study plan based on your data
  • Process subscription payments: communicate your subscription status with Stripe
  • Send transactional emails: account verification, password reset, and subscription receipts. These are functional emails, not marketing. We do not send promotional emails unless you explicitly opt in.
  • Monitor platform health: use error data from Sentry to identify and fix bugs
  • Prevent abuse: use rate limiting (via Upstash) and IP data to prevent automated attacks or account abuse
  • Improve PrepQuest: use anonymized, aggregated usage patterns (e.g., "lesson X has a high drop-off rate") to improve content and the platform

4. What We Don't Do

We want to be direct about what we will never do with your data:

  • We do not sell your personal data. To anyone. Ever.
  • We do not share your data with advertisers or any third-party marketing platforms.
  • We do not send marketing emails unless you have explicitly opted in (which is currently not offered; we don't have a marketing email list).
  • We do not use advertising cookies or third-party tracking pixels. There is no Facebook Pixel, Google Ads tag, or similar tracking code on PrepQuest.
  • We do not fingerprint your browser for cross-site tracking.

5. Data Storage & Security

Where your data is stored

  • Your account and study progress data is stored in Supabase (PostgreSQL database hosted on AWS), which provides row-level security, meaning each user can only access their own data.
  • Payment and subscription data is managed entirely by Stripe.
  • The PrepQuest platform is hosted on Vercel.

How we protect it

  • All data is transmitted over HTTPS/TLS, encrypted in transit.
  • Passwords are never stored by PrepQuest. They are handled entirely by Supabase Auth, which uses bcrypt hashing.
  • Database access uses row-level security policies (RLS), meaning even if a database query is compromised, it can only return data belonging to the authenticated user.
  • Payment processing is handled by Stripe, which is PCI-DSS compliant.
  • We use rate limiting (via Upstash Redis) to prevent brute-force attacks on auth endpoints.

What if there's a data breach?

If we become aware of a security incident that affects your personal data, we will notify affected users by email within 72 hours of discovery, as required by GDPR. We will also take immediate steps to contain and remediate the breach.

6. Data Retention

  • Account and progress data is retained as long as your account exists.
  • If you delete your account, all personally identifiable data (email, display name, progress data) is deleted within 30 days.
  • Anonymized, aggregated statistics (e.g., "1,400 users completed the Ethics module") may be retained indefinitely. This data cannot be used to identify you.
  • Error logs in Sentry are automatically purged after 90 days.
  • Payment records in Stripe are subject to Stripe's own retention policy (typically 7 years, for financial compliance reasons). PrepQuest cannot delete Stripe's records on your behalf, but these records do not contain your card details.

7. Your Rights

You have the following rights over your data:

Access

You can request a copy of all personal data we hold about you. Send a message via our contact form with "Data Access Request" in the subject line. We will respond within 5 business days.

Deletion (Right to be Forgotten)

You can delete your account directly from your account settings at any time. This initiates the deletion of all your personal data within 30 days. You can also use our contact form to request manual deletion.

Correction

You can update your email address and display name directly in your account settings. If you need help correcting other data, send us a message via our contact form.

Data Portability

You can request an export of your study progress data (lessons completed, quiz history, XP) in a machine-readable format. Send us a message via our contact form.

Opt-out

Since we don't send marketing emails and don't use advertising cookies, there's nothing to opt out of beyond transactional account emails (which are required for the Service to function).

EU/EEA Users: Additional GDPR Rights

If you are located in the EU or EEA, you have additional rights under the General Data Protection Regulation (GDPR), including the right to:

  • Object to processing
  • Restrict processing
  • Lodge a complaint with your local supervisory authority

To exercise any GDPR rights, send us a message via our contact form. We will respond within 30 days.

Our legal basis for processing your data is:

  • Contract performance: to provide the Service you signed up for
  • Legitimate interests: error monitoring, abuse prevention, platform improvement
  • Consent: for any optional data collection (currently none)

8. Cookies

PrepQuest uses a minimal number of cookies:

Required cookies (cannot be disabled)

  • Session cookie: a secure, HTTP-only cookie that keeps you logged in while you use PrepQuest. Without this cookie, the app cannot function. It is deleted when your session ends or you log out.

What we don't use

  • No advertising cookies
  • No third-party tracking pixels (no Facebook Pixel, no Google Analytics UA)
  • No cross-site tracking cookies

Vercel Analytics

We use Vercel Analytics for basic traffic measurement (page views, referrers). Vercel Analytics is cookieless: it does not use cookies or browser fingerprinting. It cannot identify individual users. Data collected is aggregated and anonymized.

If you block all cookies, the only thing that breaks is your ability to stay logged in. Nothing else about the site requires cookies.

9. Third-Party Services

PrepQuest uses the following third-party services. Each has its own privacy policy:

ServicePurposePrivacy Policy
SupabaseDatabase, authenticationsupabase.com/privacy
StripePayment processingstripe.com/privacy
VercelHosting, analyticsvercel.com/legal/privacy-policy
SentryError monitoringsentry.io/privacy
UpstashRate limiting (Redis)upstash.com/privacy

We have reviewed each of these providers to confirm they do not use data shared with them for advertising purposes. If we add new third-party services in the future, we will update this policy before doing so.

10. Children's Privacy

PrepQuest is not directed at children under the age of 13. We do not knowingly collect personal information from children under 13. If you are under 13, please do not create an account or provide any personal information.

If we learn that we have inadvertently collected personal data from a child under 13, we will delete that data promptly. If you believe we may have such data, send us a message via our contact form.

Users between 13 and 18 may use the free tier with parental consent. A credit card is required for the Pro subscription, which effectively limits Pro access to adults.

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes (changes that affect how we collect, use, or share your data), we will:

  1. Update the "Last updated" date at the top of this page
  2. Send a notification email to all registered users
  3. Display a notice on the PrepQuest dashboard for 30 days

For minor, non-material changes (e.g., clarifying existing practices, fixing typos), we will update the policy without a separate notification.

Continued use of PrepQuest after changes take effect constitutes acceptance of the updated policy.

12. Contact Us

If you have questions about this Privacy Policy, want to exercise your data rights, or have a privacy concern, contact us:

Contact: our contact form Response time: Within 5 business days for general inquiries; within 30 days for formal data rights requests.

We do not have a physical mailing address that is useful for privacy inquiries. The contact form is the fastest and most reliable way to reach us.

PrepQuest is not affiliated with CFA Institute. CFA® is a registered trademark of CFA Institute.