Third-party services

Preptics runs on other companies’ infrastructure, as every website does. This page names each one that handles data for us, says what it actually receives rather than which category it falls into, and links to its own policy. Each acts on our instructions for the purpose described and nothing else.

We add a service to this page before it receives anything. The privacy policy explains what we collect and why; this page explains where it goes.

The short version

No advertising networks, no tracking pixels, no analytics cookies, no session recording. The public pages count visits with Umami, below; it records nothing from your dashboard, settings or exams.
We do not sell your data or share it for advertising.
The AI services never receive who you are, and are restricted to providers that may not keep what we send them.
Card details go to the payment provider’s checkout and never reach us.

Running the service

Supabase

What it does for us: Our database and sign-in. Everything in your account is stored here.
What it receives: Your account, your answers and timings, your study records, and everything else described in the privacy policy — it is where they are kept. Passwords are stored hashed.
Supabase privacy policy

Vercel

What it does for us: Hosts the website and runs our server code.
What it receives: The requests your browser makes — pages, answers you submit — including your IP address as part of handling them. Our own records keep only a truncated IP; Vercel's handling of request logs is governed by its policy.
Vercel privacy policy

Cloudflare

What it does for us: Our domain's DNS; a scheduled job that tells our server when to send notifications that are due; and Turnstile, the check on sign-up, sign-in and password reset that tells people from automated scripts.
What it receives: For DNS and the scheduled job, nothing about you. For Turnstile, signals from your browser during that one check, used to tell whether it is a person — not to profile you across sites.
Cloudflare Turnstile privacy addendum

Counting visits

Umami

What it does for us: Counts visits to the public pages — home, guides, help, pricing, sign-up and sign-in — so we can see which pages help people and how they found us. It sets no cookies and stores nothing in your browser. Your dashboard, settings and exams never load it, and if you move to one of them from a public page, it sends nothing from there.
What it receives: For each page view: the page's address with everything after a ? removed except campaign tags such as utm_source, and nothing after a #; the page title; the site you came from, reduced to its address (for example www.reddit.com); your screen size and browser language. Like any web request it also carries your IP address and browser details, which Umami uses to estimate your country and device type and to tell one visitor from another without cookies. Never your name, email address or account.
Umami privacy policy

Payments

Lemon Squeezy

What it does for us: Takes payment for a pass as merchant of record, which means it is the seller on your receipt and handles sales tax and VAT.
What it receives: Your card or payment details, billing email and the location needed to charge the right tax — entered on its checkout, never on ours. We receive back an order reference, the amount, currency and date, and the email address the access should go to.
Lemon Squeezy privacy policy

Email and notifications

Zoho Mail

What it does for us: Sends our emails: confirming your address and resetting your password, security notices such as a new sign-in, receipts and access reminders, replies to your messages, and the study emails you have not switched off.
What it receives: Your email address and the content of each message we send you.
Zoho privacy policy

Your browser's push service

What it does for us: Only if you turn on browser notifications: delivers them. Which company runs it is decided by your browser — Google for Chrome, Mozilla for Firefox, Apple for Safari.
What it receives: A delivery address your browser created, and when a notification is sent. The message itself is encrypted for your browser, so the push service cannot read it.
Google privacy policy (Chrome)

Artificial intelligence

How each of these is used, and what never leaves, is set out in full on how we use AI.

OpenRouter

What it does for us: Routes our AI requests to a model provider, restricted to providers that have committed to zero data retention: they may not store what we send or train on it. If no such provider is available, the request is not sent anywhere else and you see our standard wording instead.
What it receives: Either the phrase you asked to have explained, or a summary our software has already calculated about a practice test — score ranges, skills, pacing, kinds of mistake. Never your name, email address, account, the questions you saw or your answers to them.
OpenRouter's zero-data-retention rules

Model providers, through OpenRouter

What it does for us: Run the model that writes explanations — DeepSeek's V4 Flash — on their own infrastructure. On 13 September 2026 the hosts with a zero-data-retention commitment for it were Azure, DeepInfra, DigitalOcean, Mancer, NextBit, Novita, OpenInference, Parasail, Phala, SiliconFlow, Venice and Wafer. OpenRouter picks among eligible hosts per request, and the list changes as hosts join or leave. DeepSeek's own service is excluded from our requests by name, whatever its policy.
What it receives: The same request as OpenRouter above, and nothing more.
OpenRouter privacy policy

OpenAI's embedding model, through OpenRouter

What it does for us: Turns our own published explanations, lessons and help articles into search vectors, so that material can be looked up by meaning. Served under the same zero-data-retention rule; at the time of writing the eligible host was Microsoft Azure.
What it receives: Our published content only. Nothing about you, and nothing you have written.
Microsoft privacy statement

Anthropic

What it does for us: Its Claude models help write and check our questions and lessons in our offline content process, before a person reviews them.
What it receives: Draft questions, lessons and our instructions for writing them. Never anything about any student.
Anthropic privacy policy

Engineering

GitHub

What it does for us: Hosts our source code, and runs the weekly job that recalibrates our statistical models — how hard each question is, and how quickly each skill tends to be learned — from real answers.
What it receives: For question difficulty and skill learning: answers with no name, email or account attached — each practice test is an anonymous occasion, and a student's sequence within a skill is keyed by a one-way hash. For the rare student with 1,000 or more spaced reviews, their review history (which question, when, and how it went) keyed to an internal account number, to compute review timing suited to them. Nothing the job reads is kept on GitHub after it finishes.
GitHub privacy statement

What involves no third party at all

Fonts are bundled with the site when it is built. Your browser does not fetch them from Google or anyone else.
Maths notation is rendered by a library bundled with the site.
The graphing calculator is our own. Until 13 September 2026 the Math tools loaded GeoGebra’s calculator from GeoGebra’s servers; they no longer load any outside script.
Scoring, skill estimates, review timing and your study plan are calculated by our own software, in our database. No outside service decides them.

Where the data is

These services run in data centres in several countries, which may not include yours. Where the law requires it, transfers rely on standard contractual clauses or an equivalent mechanism. See your data rights.

Links to other sites

Some lessons link to outside study resources. If you open one, we record that you opened it, and that site’s own policy applies from then on. We do not follow you there.

Questions

support@preptics.com