Privacy Policy

Effective date: April 1, 2026

Introduction
Information We Collect
How We Use Your Information
Emails We Send
What We Don't Do
Data Storage, Security & Transfers
Data Retention
Your Rights
Cookies & Local Storage
Third-Party Services
Children's Privacy
Changes to This Policy
Contact Us

1. Introduction

PrepQuest ("PrepQuest," "we," "us," or "our") is a CFA exam study platform available at prepquest.io (the "Service"). We help candidates prepare for the CFA exam across all three levels with gamified lessons, quizzes, flashcards, mock exams, and progress tracking.

This Privacy Policy explains what personal information we collect when you use PrepQuest, how we use it, and what rights you have over it. It applies to everyone who visits prepquest.io and to all account holders, free and Pro.

By creating an account or using the Service, you agree to the practices described in this policy. If you don't agree, please do not use PrepQuest.

2. Information We Collect

2.1 Account Information

When you create an account, we collect:

Email address: used to identify your account and to send the emails described in section 4
Display name: optional, used to personalize your dashboard and emails
Password: never stored in plain text; handled by Supabase Auth using industry-standard hashing

If you sign up through a third-party sign-in provider (e.g., Google), we receive your email address and display name from that provider. We do not receive your password or payment details from sign-in providers.

2.2 Study Data

When you use PrepQuest, we store your activity to power the platform:

Lessons completed and when you completed them
Quiz, Boss Battle, and mock exam attempts: the answer you chose for each question, whether it was correct, time taken, and your score
XP points, level, streak, and achievements
Flashcard study activity
Your settings and study preferences, such as your CFA level, exam date, Level 3 pathway, curriculum year, and study plan
When you were last active on the dashboard

This data is stored in our database (Supabase) and tied to your account. We use it to run PrepQuest for you, including to decide which study reminders are relevant to you (see section 4).

2.3 Subscription & Payment Information

If you subscribe to PrepQuest Pro:

Stripe processes all payments on our behalf
PrepQuest never sees, receives, or stores your full card number or security code
We receive from Stripe: your subscription status, plan type (monthly or annual), renewal date, and any discount code applied
Stripe's privacy policy is at stripe.com/privacy

2.4 Technical & Usage Data

We automatically collect limited technical data when you use the Service:

IP address: processed by Vercel (our hosting provider) and Upstash for security and abuse prevention
Browser type, device type, and operating system
Page views and navigation patterns: collected by Vercel Web Analytics in a cookieless, aggregated way (no cross-site tracking, no fingerprinting)
Product analytics: in the signed-in app, we record how the app is used: pages visited, what is tapped or clicked, time spent, and session replays, with anything you type hidden. This is processed by PostHog and used only to find what's confusing and improve PrepQuest. We don't use it for people in the EU, EEA, UK, or Switzerland.
How you first found us: on your first visit we note the campaign tags in the link you arrived on (for example, which ad you clicked), the website that sent you, the first page you saw, and your country (worked out from your connection, without storing your IP address). If you create an account, this is saved with it so we can tell which of our marketing brings in people who actually study. It is never shared with ad platforms.
Email activity: whether an email we sent you was delivered and, where your email app allows it, whether it was opened and which links were clicked. We use this only to improve our emails and to stop sending ones that aren't useful.
Error data: collected by Sentry when the app crashes or encounters an error, to help us fix bugs. This may include a stack trace and the URL where the error occurred.

We do not use any of this data for third-party advertising or to build profiles of you for anyone else.

2.5 Information You Send Us

Contact form messages: your name, email address, and message
Feedback and surveys: anything you choose to tell us when we ask how PrepQuest is working for you
Testimonials: if you give us a review or quote, we publish it only with your permission and in the form you approve, and you can ask us to remove it at any time

3. How We Use Your Information

We use the information we collect to:

Provide and operate the Service: run your account, serve content, and track your progress
Personalize your experience: show your XP, streak, achievements, study plan, and next lesson
Process subscription payments: manage your subscription with Stripe, including discounts and promotions
Communicate with you: send the emails described in section 4, and reply when you contact us
Understand our marketing: see which ads, links, and channels bring in people who sign up and study, using the attribution data in section 2.4, so we spend less on what doesn't work
Monitor platform health: use error data from Sentry to identify and fix bugs
Prevent abuse: use rate limiting and IP data to stop automated attacks and account abuse
Improve PrepQuest: use usage patterns (for example, "lesson X has a high drop-off rate") to improve content and the platform

4. Emails We Send

We send three kinds of email:

Type	Examples	Can you turn it off?
Account and service emails	Email verification, password reset, payment receipts, renewal and billing notices, security alerts, and notices about important changes to the Service or these policies	No, while you have an account. They're needed to run it
Study reminders	A link to your first lesson after you sign up, a nudge if you haven't studied in a while, a weekly summary of your progress	Yes, at any time
Product news and offers	New features and content, exam-season tips, discounts on Pro	Yes, at any time

How to stop reminders or offers: use the unsubscribe link at the bottom of any of these emails, change your email preferences in your account settings where available, or contact us. Unsubscribing takes effect right away for one-click unsubscribes and within 10 days otherwise. It never affects your account or your access.

We decide which reminders to send based on your study data (for example, we won't remind you to start a lesson you've already finished). We send product news and offers only where the law allows: where your consent is required, we ask for it first.

Emails are delivered by our email provider, Resend. We never sell or rent your email address, and we never send you emails on behalf of other companies.

5. What We Don't Do

We want to be direct about what we will never do with your data:

We do not sell your personal data. To anyone. Ever.
We do not share your data with advertisers. We buy ads on platforms like Reddit and Google, but we never send them information about you or your account.
We do not use advertising cookies or third-party tracking pixels. There is no Meta Pixel, Reddit Pixel, Google Ads tag, or similar tracking code on PrepQuest.
We do not fingerprint your browser for cross-site tracking.
We do not send you emails from or for other companies.

6. Data Storage, Security & Transfers

Where your data is stored

Your account and study data are stored in Supabase (a PostgreSQL database hosted on AWS), with row-level security so each user can only access their own data.
Payment and subscription data is managed by Stripe.
The PrepQuest platform is hosted on Vercel.

International transfers

PrepQuest and the services listed in section 10 may process your data in the United States and other countries outside your own. Where data about people in the EU, EEA, or UK is transferred, our providers rely on recognized safeguards such as the European Commission's Standard Contractual Clauses.

How we protect it

All data is transmitted over HTTPS/TLS, encrypted in transit.
Passwords are never stored by PrepQuest. They are handled by Supabase Auth, which uses bcrypt hashing.
Database access uses row-level security policies (RLS), so even a compromised query can only return data belonging to the signed-in user.
Payment processing is handled by Stripe, which is PCI-DSS compliant.
We use rate limiting (via Upstash Redis) to prevent brute-force attacks on sign-in.

What if there's a data breach?

If we become aware of a security incident that affects your personal data, we will take immediate steps to contain it, notify the relevant authorities where the law requires (within 72 hours under GDPR), and notify affected users by email without undue delay.

7. Data Retention

Account and study data is kept as long as your account exists.
If you delete your account, all personally identifiable data (email, display name, study data, and how you first found us) is deleted within 30 days.
Unsubscribe records: if you unsubscribe and later delete your account, we may keep your email address on a suppression list so that we never email you again by mistake.
Contact form messages are kept for up to 2 years, then deleted.
Email delivery records at Resend are kept according to Resend's retention settings, typically no more than 90 days.
Anonymized, aggregated statistics (e.g., "1,400 users completed the Ethics module") may be kept indefinitely. This data cannot be used to identify you.
Error logs in Sentry are automatically purged after 90 days.
Product analytics records are kept for no more than 12 months, and session replays for no more than 90 days.
Payment records in Stripe are subject to Stripe's own retention policy (typically 7 years, for financial compliance reasons). PrepQuest cannot delete Stripe's records on your behalf, but these records do not contain your full card details.

8. Your Rights

You have the following rights over your data:

Access

You can request a copy of all personal data we hold about you. Send a message via our contact form with "Data Access Request" in the subject line. We will respond within 30 days.

Deletion (Right to be Forgotten)

You can ask us to delete your account and all your personal data at any time, from your account settings where available or via our contact form. We complete deletion within 30 days.

Correction

You can ask us to correct your email address, display name, or any other data via our contact form. Some details, such as your exam date and study preferences, you can change yourself in the app.

Data Portability

You can request an export of your study data (lessons completed, quiz history, XP) in a machine-readable format. Send us a message via our contact form.

Opt-out

You can stop study reminders and product news and offers at any time (see section 4). Account and service emails continue while you have an account. We don't use advertising cookies, so there is nothing to opt out of there.

EU/EEA and UK Users: Additional Rights

If you are located in the EU, EEA, or UK, you also have the right to:

Object to processing based on legitimate interests, including study reminders and marketing measurement
Restrict processing
Withdraw consent at any time, where we rely on consent
Lodge a complaint with your local data protection authority

To exercise any of these rights, send us a message via our contact form. We will respond within 30 days.

Our legal bases for processing your data are:

Contract performance: to provide the Service you signed up for, including account and service emails
Legitimate interests: study reminders that help you use what you signed up for, understanding which marketing works, error monitoring, abuse prevention, and improving the platform
Consent: product news and offers where the law requires consent, and any optional feature that asks for it
Legal obligation: keeping payment records and responding to lawful requests

9. Cookies & Local Storage

PrepQuest uses a small number of first-party cookies and browser storage items. None are used for advertising.

Essential

Session cookies: secure, HTTP-only cookies that keep you signed in. Without them the app cannot work. They are removed when you sign out or your session expires.

Preferences

Curriculum year cookie (pq_curriculum_year) and local storage items (names starting with pq_): remember choices such as your active CFA level, curriculum year, exam date, font size, sound settings, and where you are in a lesson. They stay on your device and only make the app work the way you set it.

Attribution

pq_src: set on your first visit to our public pages. It holds the campaign tags in the link you arrived on, the referring website, the first page you saw, your country, and the date. It lasts 90 days, is only ever read by PrepQuest, and is never sent to Reddit, Google, or any other ad platform. When you sign up, its contents are saved with your account (see section 2.4).

Product analytics

In the signed-in app, PostHog keeps an identifier in your browser (names starting with ph_) so a visit can be followed from page to page. It is not set for people in the EU, EEA, UK, or Switzerland, and it is never used for advertising.

Payment pages

When you pay, you are taken to Stripe Checkout, which may set its own cookies for fraud prevention under Stripe's policy.

What we don't use

No advertising cookies
No third-party tracking pixels
No cross-site tracking cookies

Vercel Web Analytics

We use Vercel Web Analytics for basic traffic measurement (page views, referrers, device type, country). It is cookieless: it does not use cookies or browser fingerprinting, and it cannot identify individual users.

If you block all cookies, the only thing that breaks is your ability to stay signed in. Blocking the attribution cookie changes nothing about how the site works; we simply won't know how you found us.

10. Third-Party Services

PrepQuest uses the following service providers. They process data only to provide their service to us, and each has its own privacy policy:

Service	Purpose	Privacy Policy
Supabase	Database, authentication	supabase.com/privacy
Stripe	Payment processing	stripe.com/privacy
Vercel	Hosting, web analytics	vercel.com/legal/privacy-policy
Resend	Sending email	resend.com/legal/privacy-policy
Sentry	Error monitoring	sentry.io/privacy
PostHog	Product analytics	posthog.com/privacy
Upstash	Rate limiting (Redis)	upstash.com/privacy

None of these providers is permitted to use your data for its own advertising. We keep this list current.

11. Children's Privacy

PrepQuest is not directed at children under the age of 13. We do not knowingly collect personal information from children under 13. If you are under 13, please do not create an account or provide any personal information.

If we learn that we have collected personal data from a child under 13, we will delete it promptly. If you believe we may have such data, send us a message via our contact form.

Users between 13 and 17 may use the free tier with parental consent. A Pro subscription requires you to be at least 18.

12. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will publish the new version on this page with a new effective date. If a change materially reduces your rights or expands how we use your data, we will also tell you before it takes effect, by email or by a notice in the app.

Continued use of PrepQuest after changes take effect constitutes acceptance of the updated policy.

13. Contact Us

If you have questions about this Privacy Policy, want to exercise your data rights, or have a privacy concern, contact us:

Contact: our contact form Response time: Within 5 business days for general inquiries; within 30 days for formal data rights requests.

We do not have a physical mailing address that is useful for privacy inquiries. The contact form is the fastest and most reliable way to reach us.

PrepQuest is not affiliated with CFA Institute. CFA® is a registered trademark of CFA Institute.