Privacy Policy

Last updated: 2026-05-19

What we collect, why, and what you can do about it.

1. What we collect

  • Account info: name, email, hashed password (if email signup) or Google OAuth identifier.
  • Attempts: answers you submit, time spent per part, scores.
  • Writing and Speaking submissions you save during practice.
  • Payment metadata: customer ID and subscription status from Stripe. We never see your card details.
  • Anonymous usage analytics (PostHog) and error logs (Sentry) so we can fix problems.

2. How we use it

To run your account, score your attempts, show your history, process payments, and improve the product. That's it.

We don't sell your data. We don't use your submissions to train external models.

3. Who we share with (subprocessors)

We use a small number of third-party service providers to run the site. They process data on our behalf, under their own privacy terms. We do not sell your personal data and we do not share it with anyone outside this list.

SubprocessorWhat they doTheir privacy policy
Stripe, Inc.Subscription billing and payment processingLink
NeonPostgres database hosting (account data, attempts, submissions)Link
NetlifyWeb hosting and CDN for the siteLink
ResendTransactional email (account, password reset, receipts)Link
PostHogAnonymous product analyticsLink
SentryError monitoring and crash reportingLink
Google LLCSign-in via Google OAuth (only if you choose the Google login option)Link

Some of these providers may store or process data outside Canada. By using CELPrep you consent to your data being transferred to and processed by these providers, subject to the protections their privacy policies offer.

4. Your rights

You can access, export, or delete your data at any time from your account page. Deleting your account permanently removes your attempts, submissions, and personal info from our database.

Under PIPEDA and GDPR (if you're in the EU/UK), you also have the right to correct inaccurate data and to object to certain processing. Email us to exercise any of these rights.

5. Security and retention

Data is encrypted in transit (TLS) and at rest. Passwords are hashed. We retain account data while your account is active. After deletion, residual data may persist in backups for up to 30 days before being purged.

6. Contact

Privacy questions or data requests: privacy@cel-prep.com.