Back to home

Privacy Policy

Last updated: April 23, 2026

1. What this policy covers

This Privacy Policy describes what data we collect, why, how long we keep it, and what rights you have. It applies to NursingPrep (the website and any mobile apps).

2. What we collect

Account data

  • Email address, first name (optional)
  • Password (stored hashed via Supabase Auth)
  • Exam type (NCLEX, TEAS, or both)
  • Avatar instructor choice + accent preference
  • Onboarding quiz answers (learning-profile signals)
  • Target exam date (optional)

Learning activity

  • Which lessons you viewed, for how long
  • Practice questions answered and correctness
  • Flashcard spaced-repetition state
  • Session start and end timestamps

Payment data

Handled by Stripe. We store only the Stripe customer ID, subscription status, and the last four digits of your card. We do not store full card numbers.

Technical data

  • Device type and browser (user-agent string)
  • A hashed, salted version of your IP address (for abuse detection, never stored raw)
  • Error events (React render errors, API failures) — no PII in stack traces

3. What we do NOT collect

  • We do not collect medical records, patient data, or any clinical information tied to real patients
  • We do not collect biometric data, precise geolocation, or contact lists
  • We do not sell your data to third parties. Ever.

4. How we use your data

  • Deliver the service (serve lessons, track progress, surface weak spots)
  • Improve the service (which lesson formats convert, which topics fail most)
  • Send transactional email (receipts, password resets, cohort announcements)
  • Send marketing email (only if you opted in — one-click unsubscribe)
  • Detect abuse (rate limiting, bot detection)
  • Comply with law

5. Who we share with

Service providers who help us run the platform:

  • Supabase — database and authentication
  • Vercel — application hosting (migrating to Cloudflare Workers)
  • Cloudflare R2 — media file storage
  • Anthropic + Google — LLM calls for AI-generated study content (they do not retain your data beyond the call)
  • Stripe — payment processing
  • Resend / Postmark — transactional email delivery

Each processor is bound by a data-processing agreement that mirrors the protections in this policy.

6. International users

Data is stored on US-based infrastructure. If you are in the EU, UK, or other jurisdictions with stricter data laws, your GDPR / UK-GDPR / CCPA rights are respected: access, rectification, erasure, portability, and objection to processing. Email privacy@nursingprep.com to exercise them.

7. How long we keep data

  • Account data: until you delete your account, then 30-day soft-delete grace period
  • Learning events older than 90 days: archived to cold storage, aggregated for product analytics
  • Payment records: 7 years (US tax retention requirement)
  • Error logs: 30 days

8. Children

Our service is not directed to children under 13. We do not knowingly collect data from children under 13. If you are a parent and believe your child has signed up, email us at privacy@nursingprep.com and we will delete the account.

9. AI-generated content and your data

When you generate study materials from your own notes (the Upload + Generate feature), your notes are sent to Anthropic or Google LLM APIs to produce the output. The providers process this data transiently and do not use it to train their base models. Generated artifacts are cached in our database keyed to your account so you can revisit them.

10. Cookies

We use strictly-necessary cookies for authentication and session management. We do not use advertising or third-party tracking cookies.

11. Changes to this policy

Material changes are emailed to you at least 14 days before they take effect.

12. Contact

Questions, data requests, or account deletion: privacy@nursingprep.com.