Privacy Policy

Effective date: October 9, 2026 Last updated: October 9, 2026

1. Who we are

JakePrep ("we," "us," "our") is an SAT tutoring platform. Our website and app are available at jakeprep.co. We are the data controller for personal data collected through the platform.

2. Age restriction — no users under 13

JakePrep is not intended for children under 13 years old. We do not knowingly collect personal data from children under 13. If you are under 13, do not use this service.

If we learn that we have collected personal data from a child under 13 without verified parental consent, we will delete that data promptly. If you believe we have collected such data, contact us at privacy@jakeprep.co.

Students aged 13–17 may create their own JakePrep account and use the Service on a free trial. We collect their email address, display name, date of birth, and the academic data described below. A parent or guardian must create a parent account and link to the student before any paid access begins, and only a parent, guardian, or other adult pays. A parent or guardian may also create a student's account directly.

A student may exercise their own privacy rights (access, correction, deletion, export) at any time, whether or not a parent account is linked. See "Your rights."

3. What data we collect and why

Account data (all users)

When you create an account, we collect:

Email address
Display name
Role (student, parent)
Password (stored as a one-way hash — we never store your plain-text password)
Date of birth (used to verify age eligibility)

Why: To create and manage your account and authenticate you.

Student academic data

For student accounts, we collect:

SAT target test date and goal composite score
Drill and lesson completion records
Per-question-type performance profiles (adaptive learning data)
SAT score reports you enter (total score, Reading/Writing score, Math score, diagnostic breakdown)
Session wrapup notes prepared by tutors after each session (topics covered, homework assigned, session mood summary)

Why: To deliver personalized SAT prep, track progress, and generate reports for students and parents.

Tutoring session data

When a live tutoring session takes place, we collect:

Session scheduling information (date, time, duration)
Session status (scheduled, completed, cancelled)
Video room links (generated per session via Whereby; we do not record sessions)
Collaborative scratchpad content during sessions (via Liveblocks; scratchpad data is ephemeral and is not retained after the session)

Why: To facilitate live tutoring and maintain session records.

Parent account data

For parent accounts, we collect the account data above plus:

The parent-student relationship (which student accounts are linked to your parent account)
Payment information — we store your Stripe customer ID and a display cache of your card brand and last four digits. Your full card number and payment credentials are held by Stripe, not by us.

Why: To manage billing and link parents to their students' progress.

Parent contact information provided by a student

If a student asks us to contact their parent or guardian, we collect from the student:

The parent or guardian's email address
Optionally, the parent or guardian's first name

Why: To send that person an email introducing the Service, so they can decide whether to create a parent account. We do not use this address for marketing, we do not add it to any mailing list, and we do not sell or share it. If the invitation is never used to create an account, we delete the address after the invitation expires.

Communications

We send transactional emails including:

Session wrapup summaries (to parents and students after each session)
Weekly progress reports
Password reset links
Account notification emails

Why: To keep you informed about your tutoring activity. These are service communications, not marketing.

Contact form messages

If you write to us through the contact form on our homepage, we collect the name, email address, and message you enter, and use them only to reply to you. They are emailed to us through Resend and are not stored in our database.

Daily Words email

If you sign up for Daily Words, our weekday SAT vocabulary email, we collect your email address, when you signed up and confirmed, a record of which Daily Words emails we sent you, and whether you agreed to occasional tutoring notes. If we added you because you asked us to, we may also keep a short note of who you are, which is never emailed.

Why: To send you Daily Words. We may also occasionally email you about JakePrep tutoring (if you signed up from Europe, only if you ticked the box asking for it). After you sign up, we send one email asking you to confirm, and nothing more arrives until you do. If you don't confirm, we delete your address shortly after the confirmation link expires (it works for 7 days). Every email we send to the list has an unsubscribe link, and unsubscribing stops all of them. We do not sell or share your address.

Daily Words is for people 13 and older. A parent or guardian can sign up with their own address and share the words.

Technical and usage data

When you use JakePrep, we automatically collect:

IP address
Browser type and version
Pages visited and features used
Device type

Why: For security, debugging, and keeping the service running, and, for the free lessons, anonymous counts of how far visitors get, so we can improve them. We do not currently use third-party analytics trackers.

4. How we share your data

We share personal data only with the following service providers, and only as necessary to operate the service:

Service	Purpose	Data shared	Location
Neon	Database hosting	All stored user data	United States (AWS us-east-1)
Railway	App hosting and API server	All data processed by the app	United States (US East)
Stripe	Payment processing	Parent name, email, billing details	United States
Whereby	Live video sessions	Session participant identity tokens	Ireland (primary); United States (usage data)
Liveblocks	Real-time shared scratchpad during sessions	Session participant identity, scratchpad content	United States (AWS us-east-1); Cloudflare global edge for real-time data
Resend / Amazon SES	Email delivery (account emails and Daily Words)	Recipient email address, email content	United States
Cloudflare	DNS and CDN	IP address, HTTP request metadata	Global CDN nodes

We do not sell your personal data. We do not share personal data with advertisers or data brokers.

We may disclose personal data if required by law, court order, or to protect the rights and safety of our users.

5. Data location and international transfers

Our database and primary infrastructure are located in the United States (US East). We do not offer EU data residency.

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland: Your personal data is transferred to and processed in the United States. We rely on Standard Contractual Clauses (SCCs) and our service providers' own transfer mechanisms for these transfers:

Neon and Railway: We rely on SCCs incorporated in each provider's Data Processing Agreement.
Stripe, Resend/Amazon SES, Liveblocks: Each provider uses SCCs or other approved transfer mechanisms. See their respective privacy policies for details.
Whereby: A Norwegian company hosting primary data in Ireland (EEA). Whereby uses SCCs for any transfers outside the EEA.

6. How long we keep your data

Data type	Retention
Account data	Until you delete your account, plus 30 days (recovery window), then permanently deleted
Academic performance data (drills, scores, profiles)	Deleted with the account
Session wrapups and tutor notes	Deleted with the account
Billing records	7 years, as required by applicable financial record-keeping laws
GDPR/CCPA request log	3 years
Server logs	90 days
Daily Words	While you're subscribed. If you unsubscribe, we keep your address marked as unsubscribed so we never email you again; email privacy@jakeprep.co to have it deleted entirely. Unconfirmed signups are deleted shortly after the 7-day confirmation link expires.

When an account is deleted, we initiate a soft-delete (30-day recovery window) followed by permanent erasure from our database. Database backups are retained for 30 days, after which deleted data is purged from backups as well.

7. Your rights

All users

You may at any time:

Access your data — request a copy of the personal data we hold about you
Delete your account — available in account settings; triggers our 30-day recovery window then permanent deletion. If a parent or guardian is linked to a student's account, deletion is handled through the parent or guardian.
Correct your data — update your account information in settings or contact us

Students may access and export their own data at any time. A student whose account is not linked to a parent or guardian may also delete their own account directly. Once a parent or guardian is linked, that parent or guardian is responsible for the student's account, and deletion requests are made through them — a student may still ask us directly at privacy@jakeprep.co and we will handle the request.

EEA, UK, and Swiss users (GDPR)

Under the GDPR, you also have the right to:

Data portability — receive your data in a structured, machine-readable format
Restrict processing — ask us to pause processing your data in certain circumstances
Object to processing — object to processing based on legitimate interests
Withdraw consent — where processing is based on consent, withdraw it at any time
Lodge a complaint — with your local data protection authority (e.g., your national DPA in the EEA, the ICO in the UK)

To exercise any of these rights, email privacy@jakeprep.co. We will respond within 30 days (extendable to 3 months for complex requests — we will notify you if an extension applies).

We will verify your identity before processing requests by confirming against your account email address.

Daily Words has no account, so for a Daily Words request we confirm by replying to the subscribed address.

California users (CCPA / CPRA)

California residents have the right to:

Know what personal information we collect, use, disclose, and sell
Delete your personal information (subject to certain exceptions)
Correct inaccurate personal information
Opt out of sale or sharing — we do not sell or share personal information for cross-context behavioral advertising
Limit use of sensitive personal information — we collect date of birth (to verify age); we do not use it for any purpose beyond age verification and account management
Non-discrimination — we will not discriminate against you for exercising your privacy rights

To submit a CCPA request, email privacy@jakeprep.co. We will respond within 45 days (extendable to 90 days with notice).

Other US state residents

Residents of Virginia, Colorado, Texas, Connecticut, and other states with comprehensive privacy laws have similar rights to access, delete, correct, and port their personal data. Contact us at privacy@jakeprep.co to exercise these rights.

8. Security

We use industry-standard security measures including:

Passwords stored as one-way hashes (never in plain text)
HTTPS/TLS in transit
Database access restricted to application layer
Stripe handles all payment card data (we never see full card numbers)

No system is perfectly secure. If you believe your account has been compromised, contact us immediately at privacy@jakeprep.co.

9. Cookies and tracking

We use session cookies to keep you logged in. We do not currently use third-party tracking cookies or advertising cookies.

Cloudflare may set cookies for security and performance purposes. See Cloudflare's privacy policy for details.

10. Changes to this policy

We will post any changes to this policy on this page with an updated effective date. For material changes, we will notify you by email at least 30 days before the change takes effect.

11. Contact us

For privacy questions, data requests, or complaints:

Email: privacy@jakeprep.co Mailing address: Jacob Greenberg, JakePrep, 2248 Broadway #1015, New York, NY 10024, United States