Legal
Privacy Policy
Effective October 24, 2026
This policy explains how CETPrep handles information when you use its lessons, questions, mock tests, analytics, accounts, and community features.
Under 18? Read the shorter privacy notice for students.
Information we collect
- Account data: email address, display name, authentication identifiers, profile image, sign-in provider, legal-notice acknowledgements, and optional profile details.
- Learning data: answers, scores, attempt timing, topic progress, mistakes, study-plan activity, question reports, and interactions with lessons and mock tests.
- Community data: comments, replies, display name, and moderation records for content you choose to post.
- Support data: the name, email address, category, message, account identifier (if signed in), and status of a private support request.
- Volunteer application data: contact details and application answers submitted for student testing or Prepi Crew, including current year level for Prepi Crew applicants.
- Technical data: security, request, device, browser, and error records generated when the service or its infrastructure is used.
- Only if you allow optional usage measurement: a random browser identifier, visit dates, a broad link source such as Discord, and your account identifier when signed in. This connects visits to signup, first completed practice, and a later return. Visit records do not include full URLs, raw IP addresses, names, emails, or answers.
Purposes and basis for processing
- To provide the service you request: create and secure an account, save progress, grade attempts, personalize study tools, and respond to support requests.
- With optional measurement consent: understand how students find CETPrep and whether they start practice and return. The admin report also aggregates existing account and saved-practice records to improve the service.
- To review volunteer applications and contact applicants about student testing or Prepi Crew when they consent to that contact.
- With your acknowledgement or consent where required: maintain an account for a student and enable optional profile or community features.
- For legitimate operational interests that do not override student rights: prevent abuse, diagnose failures, improve content, and keep the service secure.
- To meet legal obligations and respond to valid requests from public authorities or data subjects.
Who receives information
- Supabase processes account, authentication, learning, community, and support data as CETPrep's database and authentication provider.
- Vercel may process network, deployment, and error records when hosting the service.
- Resend delivers CETPrep's emails, such as sign-in confirmations, student tester acceptance messages, and practice reminders. It receives your email address and the contents of that message.
- Google receives your Google account identity when you choose to sign in with Google. The sign-in script loads only on the login and signup pages.
- Ko-fi handles donations on its own website under its own terms. CETPrep does not receive your payment details, and donating is not linked to your CETPrep account.
- YouTube may receive device and interaction data when you load or use an embedded video. CETPrep uses YouTube's privacy-enhanced embed domain, but YouTube's own terms still apply.
- When you choose Ask Prepi, CETPrep sends Google Gemini the practice question, answer choices, your selected answer, the official explanation, and any related passage needed to explain the mistake. CETPrep does not send your name, email address, or profile information to Gemini for this feature.
- CETPrep does not sell personal information or use student answers for third-party behavioral advertising.
Retention, storage, and security
- Optional visit records are removed during collection once they are older than 90 days. You can turn measurement off at the bottom of a page where it is enabled and request deletion of visit records linked to this browser. The interface reports any removal failure so you can retry. Account deletion also removes visits linked to that account.
- Account and learning data are kept while the account is active. After a verified deletion request, active records are deleted or de-identified unless a limited record must be kept for security, dispute, or legal reasons.
- Volunteer applications are kept while recruitment and coordination require them. Applicants can request deletion through the support form.
- Support requests and moderation records are reviewed for deletion after two years, unless they remain necessary for an unresolved request, security incident, legal claim, or legal duty.
- Infrastructure providers may retain backups and security logs for their documented recovery or security periods. CETPrep limits access, uses row-level authorization, and reviews public-data permissions.
- No internet service can guarantee absolute security. If a breach creates a legal notification duty, CETPrep will notify affected people and the National Privacy Commission as required.
Your choices and data-subject rights
- You may ask to be informed, access or correct your information, object to processing, withdraw consent where consent is the basis, request erasure or blocking, and obtain data portability when applicable.
- You may ask about automated processing, request human review of a concern, and complain to the Philippine National Privacy Commission.
- A parent or guardian may submit a request for a minor. CETPrep may verify identity and authority before disclosing, changing, or deleting account data.
Children and student-facing explanations
- CETPrep is designed for students and may be used by people below 18. We write key notices in plain language so students can understand them on their own; a parent or guardian is welcome to review them too.
- Community posting is optional. Do not post school records, home addresses, phone numbers, passwords, health information, exact schedules, or other sensitive details.
- CETPrep does not intentionally profile students for advertising or sell children's personal information.
Cookies and similar storage
- CETPrep uses essential authentication cookies and local browser storage to keep you signed in, protect sessions, and remember interface preferences such as theme.
- Optional first-party measurement uses browser storage only after you allow it. Declining does not restrict study tools. Browser Do Not Track and Global Privacy Control signals prevent optional collection. CETPrep does not use third-party advertising cookies or a marketing analytics SDK.
- The Cookie Policy lists every cookie and browser storage key by name, what each one does, and how long it lasts.
Who is responsible, and how to reach us
CETPrep is an independent study project run by an individual student developer based in the Philippines, who acts as the personal information controller for this service. It is not a registered company and has no staff, offices, or investors.
Reach the operator at cetprep.app@gmail.com, or submit a request through the private support form. We do not accept privacy requests through public repositories or social-media comments. We may verify your identity before acting, and material changes will be posted here with a revised effective date.