Privacy Policy

Effective date: April 20, 2026

1. Who we are

LeaPrep ("we", "us", "our") is an online CFA exam preparation platform accessible at https://leaprep.com. This Privacy Policy explains what personal data we collect, how we use it, and your rights.

Contact for privacy questions: contact@leaprep.com.

2. Data we collect

Account data: email, display name, password (stored as a bcrypt hash — we never see your plaintext password).
Google Sign-In data (if you choose to sign in with Google): Google account ID, email, display name, and profile picture URL received from Google. We do not receive your Google password.
Learning data: quizzes you take, answers you submit, time spent per question, wrong-answer review schedule, daily streaks, bookmarks, and personal notes you create.
Profile content: avatar image you upload (hosted on Cloudinary), optional display name.
AI tutor conversations: messages you send to the in-app AI tutor, which are forwarded to OpenAI for processing. We log these conversations for quality and abuse prevention.
Technical logs: IP address, user agent, and timestamps for security and debugging. Logs are retained for 30 days.

We do not collect payment card data directly — billing (if enabled in future) will be handled by Stripe.

3. How we use your data

Provide the service: authenticate you, show your quiz history, recommend wrong answers for review.
Personalize learning: compute performance analytics, streaks, and spaced-repetition schedules.
Improve the product: aggregated, anonymized usage analytics.
Security: detect abuse, prevent fraud, protect other users.
Communicate: send transactional emails (password reset, account notices). We do not send marketing emails without opt-in.

4. Third-party processors

We share minimum-necessary data with the following processors to operate the service:

Neon (neon.tech) — primary PostgreSQL database (region: ap-southeast-1, Singapore).
Cloudinary — avatar image hosting.
OpenAI — AI tutor chat completions (GPT-4o-mini). Per OpenAI policy, API data is not used to train OpenAI models.
Google — only if you sign in with Google; we receive the profile fields listed above.
Hostinger — VPS hosting (application runtime).
Cloudflare — DNS and, optionally, edge proxy for performance and DDoS protection.

5. Cookies

We use strictly necessary cookies to keep you signed in and protect against CSRF. We do not currently use advertising, analytics, or cross-site tracking cookies. See the Cookie Policy for details.

6. Data retention

Account data: for the life of your account. Deleted within 30 days after you request account deletion.
Learning data: as long as your account is active; anonymized aggregates may be retained for research.
Technical logs: 30 days.
AI tutor messages: 90 days, then permanently deleted.

7. Your rights

Regardless of where you live, you may request to: access a copy of your data, correct inaccuracies, export your data, restrict or object to processing, and delete your account. EU/UK/California residents have additional rights under GDPR/CCPA including non-discrimination for exercising them. Send requests to contact@leaprep.com. We respond within 30 days.

8. Security

Passwords are hashed with bcrypt. All traffic is served over HTTPS (TLS 1.3 where supported). Database connections use SSL. Access to production systems is limited to the founder and requires SSH key + 2FA on the hosting account. We cannot guarantee absolute security — please use a unique, strong password.

9. Children

LeaPrep is intended for users aged 18 and above. We do not knowingly collect data from children under 13. If we learn we have done so, we will delete the account.

10. International transfers

Your data is stored in Singapore (Neon ap-southeast-1) and processed on servers we operate (Hostinger, EU). By using LeaPrep you consent to these transfers.

11. Changes to this policy

We may update this policy. Material changes will be announced by email (where we have your address) or an in-app notice at least 7 days before taking effect.

12. Contact

Questions or requests: contact@leaprep.com.