Privacy Policy

CorePrep is an independent AP practice site. It is not affiliated with, endorsed by, or connected to the College Board. This page explains exactly what the site stores about you, why, and how to get rid of it. It describes what the software actually does, not what a template says.

What we collect

If you create an account: your name, your email address, and either a password or a Google account identifier. Passwords are never stored as text — only a scrypt hash, which cannot be turned back into your password.

As you practise: the answers you pick, your scores, how long a test took, which questions you have seen, and the calendar days you were active (used for your study streak).

If you use the Missed Questions notebook (Pro): the list of questions you missed is worked out from the answers you have already given, so it is not stored a second time. What the notebook does save is your tries at those questions, which ones you have marked fixed, and any note you choose to write on a question (up to 400 characters each). Notes are shown only to you in the app.

Technical data: two cookies (below), and a hashed record used to limit repeated sign-in attempts. That record is a SHA-256 hash of your IP address combined with other values — your raw IP address is never written to our database or our logs. We describe it as hashed rather than anonymous, because a hash of something as short as an IP address can in principle be reversed by brute force.

If you use the site as a guest: nothing is sent to our servers at all. Guest progress lives only in your browser tab and disappears when you reload the page.

What we do not do

• No tracking analytics. There is no Google Analytics and no tag manager. The only measurement is Vercel Web Analytics, which counts page views without cookies and without following you across sites or building a profile of you.
• No advertising, and no advertising cookies or trackers.
• We do not sell, rent, or share your personal information with anyone for their own purposes.
• We do not build a profile of you for marketing, or send you marketing email.
• We do not store anything in your browser beyond the two cookies and the few device-only settings described below.

Why we collect it

Account details let you sign in and keep one workspace across devices. Practice data is the product — it is what lets you resume a question bank where you left off, review the questions you got wrong, keep a notebook of your misses, and keep a streak. The hashed sign-in record exists purely to slow down someone trying to guess passwords.

Cookies

Two, both strictly necessary. Both are httpOnly, meaning JavaScript on the page cannot read them, and both are restricted to this site.

• apex_session — keeps you signed in. Expires after 30 days.
• apex_oauth_state — protects the Google sign-in flow against request forgery. Expires after 10 minutes and is deleted as soon as sign-in finishes.

Settings kept on your device

A few preferences are saved in your browser’s own storage, not in cookies. They stay on your device, are never sent to our servers, and clearing your browser’s site data removes them.

• coreprep:extra-time — the extra-time option you picked for timed tests.
• coreprep:sound-muted — whether you turned the answer sounds off.
• coreprep:hide-diagnostic-results — which diagnostic results you closed on your dashboard.
• coreprep:practice-size — how many missed questions you like to practise at a time.
• coreprep:delete-after-google — a one-word flag kept only while a tab is open (session storage), set while you confirm with Google before deleting your account so the page can pick up where it left off.

Who your data reaches

Only the infrastructure needed to run the site. None of these are marketing partners and none receive your data to use for their own ends.

• Google — only if you choose “Continue with Google”. We receive your Google account ID, email address and name. Your Google password is never seen by us.
• MongoDB Atlas — the database where accounts and practice history are stored.
• Vercel — hosts the site, serves every page request, and provides the cookieless page-view counts (page visited, referrer, and approximate country, device and browser type).

We may also disclose information if we are legally required to.

How long we keep it

• Sign-in sessions are deleted automatically 30 days after you sign in.
• The hashed sign-in records expire automatically after 10 minutes.
• Your account and practice history are kept until you ask us to delete them. To be clear: there is currently no automatic expiry on these. They stay until you ask.

Deleting your data

You can delete your account yourself at any time: open your account (your name at the bottom of the sidebar) and choose Delete account. It takes effect immediately.

You can also email coreprepsupport@gmail.com from the address on your account and ask for deletion. We will delete it within 30 days and confirm when it is done. Either way, deletion removes your account record, your sign-in sessions, your saved practice sessions, your question-bank progress, your Missed Questions notebook (tries and notes), and your activity history. Deletion is permanent and cannot be undone.

You can also ask us for a copy of what we hold about you, or ask us to correct it, at the same address.

Security

Passwords are hashed with scrypt and never stored in a readable form. Session cookies are httpOnly, so a script on the page cannot steal them, and traffic is served over HTTPS. No system is perfectly secure and we will not claim otherwise, but we do not keep anything we do not need, and we never store raw IP addresses or plaintext passwords.

Age

CorePrep is intended for students aged 13 and over, and asks everyone to confirm their age the first time they sign in. If someone says they are under 13, the account is deleted immediately. It is not designed for children under 13 and we do not knowingly collect information from them. If you believe a child under 13 has created an account, email us and we will delete it.

Changes to this policy

If this policy changes, the date at the bottom of this page changes with it. If a change materially affects how your data is handled, we will make that clear on the site rather than quietly editing this page.

Contact

Questions about privacy, or a deletion request: coreprepsupport@gmail.com.