When you create an account, we collect your first name, last name, and email address. If you sign in with Google, we receive your name and email from Google's authentication service.
To help you find compatible study partners, we collect information you provide during onboarding and profile editing, including:
If you choose to verify your student or professional status, we collect an additional email address (.edu or work domain) solely for the purpose of sending a verification link. This email is displayed on your profile as a verified badge once confirmed.
We store the content of direct messages sent between matched users, connection requests (including any optional message), and your connection status with other users.
Our server logs standard technical data including IP addresses, browser type, device type, and request timestamps. This data is used for security monitoring, abuse prevention, and debugging. It is not sold or used for advertising.
We do not use your information to serve targeted advertising, and we do not sell or rent your data to any third party for marketing purposes.
All user data — including profiles, messages, and connections — is stored in a SQLite database hosted on Railway's cloud infrastructure in the United States. Profile photos are stored on Railway's persistent volume storage.
Passwords are never stored in plain text. If you registered with a password (legacy accounts), it is stored as a bcrypt hash with 12 rounds of hashing. Google Sign-In accounts have no stored password.
We take reasonable technical and organizational measures to protect your data from unauthorized access, alteration, or disclosure. However, no system is completely secure, and we cannot guarantee absolute security.
If you choose to sign in with Google, we use Google's OAuth 2.0 service to verify your identity. During this process, we receive the following information from Google:
We do not receive access to your Google account, Gmail, Google Drive, or any other Google service. We do not receive your Google password. The Google token is verified server-side and discarded — we do not store it.
Your profile picture URL is stored in your Prep Pairing profile and displayed to other users. For more information on how Google handles your data, see Google's Privacy Policy.
We use Brevo (formerly Sendinblue) to deliver transactional emails. These are non-marketing, service-related emails that include:
To send these emails, we share your email address and first name with Brevo. Brevo acts as a data processor on our behalf and does not use your data for its own marketing purposes.
You can opt out of message notification emails at any time from your Settings → Notifications page. Verification emails cannot be opted out of, as they are required to complete the verification process you initiated.
For more information, see Brevo's Privacy Policy.
Prep Pairing runs on Railway (railway.app), a cloud hosting platform based in the United States. Our application server, database, and file storage are all hosted on Railway's infrastructure.
Railway may have access to server infrastructure but does not access application-level data (your profile content, messages, or personal information) in the ordinary course of operations.
For more information, see Railway's Privacy Policy.
You can view and edit your profile information at any time by opening your profile from the browse page.
You may permanently delete your account and all associated data at any time from your Settings page. Account deletion removes:
Certain data (such as server access logs) may be retained for up to 30 days for security purposes before being automatically purged.
If you are unable to delete your account through the app, you may request deletion by emailing [email protected]. We will process your request within 30 days.
If you are a California resident, you may have additional rights under the California Consumer Privacy Act (CCPA), including the right to know what personal information we have collected and the right to request deletion. To exercise these rights, contact us at [email protected].
If you have any questions, concerns, or requests regarding this Privacy Policy or how we handle your data, please contact us:
We will respond to all privacy-related inquiries within 30 days.