CastorPrep — Privacy Policy

Effective date: July 25, 2026

This Privacy Policy explains how CastorPrep ("CastorPrep," "we," "us") collects, uses, and shares information when you use the CastorPrep website and application (the "Service"). By using the Service you agree to this Policy. It works alongside our Terms of Service.

1. Information we collect

Account & identity. When you create an account, we collect your email address. If you sign in with Google, we also receive your name and basic profile from Google. Passwords for email sign-up are handled and securely hashed by our authentication provider (Supabase) — we never see or store your password in plain text. We also store settings you provide or choose: your selected exam depth, an optional exam date, and your plan/trial status.

Study activity. As you use the Service, we store activity tied to your account: practice attempts (which problems you tried, the answer you chose, whether it was correct, and when), diagnostic results, mock-exam results (scores, per-area and per-question detail, flags, and elapsed time), and problems you bookmark. We use this to score your work, track your progress, and personalize your studying.

AI-tutor conversations. When you use the AI tutor, we store the messages you type and the tutor's replies, along with the related problem and your current answer for context, and a timestamp. We use these to operate the tutor and to improve the Service (understanding what students ask and where a problem or the tutor falls short). They are not shown to other users. How your messages are processed by a third-party AI provider is described in §3. (The tutor on our public landing page can be used without an account; those messages are not linked to any individual.)

Payment information. Payments are processed by Stripe. We do not collect or store your full card number — Stripe handles card data. We store only a payment/subscription identifier and status.

Communications. If you contact us by email at hello@castorprep.com or sign up for updates, we keep the information you provide (such as your email and message).

Technical & operational data. We process limited technical data to run and protect the Service: IP address in short-lived counters used to rate-limit the tutor and answer-checking against abuse and excess cost; standard server request logs (which may include IP address, browser/user-agent, and timestamps) via our hosting provider; and authentication cookies to keep you signed in. We use cookieless product-analytics and session-replay tools to measure usage and diagnose usability issues, and cookie-based Google tools — Google Analytics, which uses cookies to measure how the Service is used and where traffic comes from, and, for our advertising, the Google Ads tag, which uses cookies to measure conversions and show you relevant ads (see §6).

2. How we use information

We use the information above to: provide and operate the Service; create and secure your account; personalize your experience to your chosen depth; score and track your practice, diagnostic, and mock results; run the AI tutor; improve our products and content (including reviewing tutor conversations to find weak spots); measure how the Service is used and attribute traffic to its source (analytics — see §6); prevent abuse and manage costs (rate-limiting); process payments and manage subscriptions; advertise and market the Service (including measuring ad conversions and, through Google Ads remarketing, showing our ads to past visitors — see §6); communicate with you about your account and the Service; and comply with legal obligations.

3. The AI tutor and third-party AI processing

This is an important and less-obvious data flow, so we call it out directly:

• To generate a tutor response, the message you type and the related problem and solution context are sent to our AI provider, Anthropic, via its Claude API.
• We also store these conversations ourselves, as described in §1, to improve the Service.
• Under Anthropic's commercial API terms, the inputs and outputs submitted through the API are not used to train Anthropic's models.
• Please avoid typing sensitive personal information into the tutor; it is a study tool for exam problems.

4. How we share information

We do not sell your personal information. We share it only as follows.

Service providers (sub-processors). We use trusted providers to run the Service:

Legal and safety. We may disclose information if required by law or to protect the rights, safety, or property of CastorPrep, our users, or others.

Business transfers. If we are involved in a merger, acquisition, or sale of assets, information may be transferred as part of that transaction, subject to this Policy.

5. Data retention and deletion

We keep your information while your account is active and as needed to provide the Service, comply with legal obligations, resolve disputes, and enforce our agreements. You may request deletion of your account and associated data by emailing us at hello@castorprep.com. On deletion, we remove the data keyed to your account (your attempts, diagnostic and mock results, bookmarks, and tutor conversations) and your account record, except where we are required to retain certain records. Anonymous landing-page tutor messages are not linked to an individual and cannot be tied back to you.

6. Cookies, analytics & advertising

Essential cookies. We use authentication-session cookies to keep you signed in.

Product analytics (cookieless). Two of our product-analytics tools are cookieless: Vercel Web Analytics (aggregate page views) and PostHog (product analytics, funnel events, and session replay). Both are configured without cookies — PostHog uses your browser's localStorage.

Analytics & advertising (cookie-based). We also use two Google tools that rely on cookies and similar technologies, loaded through Google's single site tag (gtag.js):

• Google Analytics (GA4) measures how the Service is used — pageviews, events, and which source brought you to us (for example, organic search vs. a paid ad) — so we can understand and improve the experience. Google receives your device and usage data; Google's handling of it is governed by the Google Privacy Policy.
• Google Ads loads Google's advertising tag to (a) measure conversions — so we can tell when an ad led to a sign-up or subscription — and (b) support remarketing, which lets Google show our ads to people who have visited our site as they browse other sites in Google's network. This involves Google receiving your device/usage data and may build an advertising profile associated with your Google activity.

Our Google Analytics and Google Ads accounts are linked, which means analytics audiences can inform the remarketing described above. You can control ad and analytics personalization in your Google Ads Settings, opt out of interest-based ads via aboutads.info, and opt out of Google Analytics specifically with Google's Analytics opt-out browser add-on. See §7 for your rights, including opting out of the "sale"/"sharing" of personal information under California and similar laws.

Advertising measurement (enhanced conversions). When you sign up or purchase after clicking one of our ads, we share a one-way hashed (SHA-256) version of your email address with Google to measure ad performance ("enhanced conversions"). Google cannot recover your email from this hash unless you already have a Google account associated with it. We do not share your name, password, study activity, or payment details with advertising platforms.

Session replay records your on-page interactions (navigation, clicks, and on-screen content) so we can find and fix usability problems. Recordings mask password and email input fields, and payment-card details are never captured (payments are handled off-site by Stripe). If this changes, we will update this Policy and provide any notice or controls required by law.

7. Your privacy rights

Depending on where you live, you may have rights to access, correct, delete, or obtain a copy of your personal information, and to object to or restrict certain processing. To exercise these, contact us by email at hello@castorprep.com. We will not discriminate against you for exercising your rights.

• California residents may request access to and deletion of personal information and may opt out of the "sale" or "sharing" of personal information. We do not sell personal information for money. However, our use of Google Ads remarketing (§6) may qualify as "sharing" — and, under some interpretations, a "sale" — of personal information for cross-context behavioral advertising as those terms are defined under California law. To opt out: enable your browser's Global Privacy Control signal, adjust your Google Ads Settings and the aboutads.info opt-out, or contact us by email at hello@castorprep.com and we will honor your request. We do not share the personal information of anyone we know to be under 16.
• EEA/UK residents: our lawful bases for processing include performance of our contract with you (providing the Service), our legitimate interests (security, product improvement), consent where applicable, and legal obligations. You may also lodge a complaint with your local supervisory authority.

8. International users

We are based in the United States and our service providers are primarily US-based. If you access the Service from outside the United States, your information will be processed in the United States.

9. Security

We use reasonable technical and organizational measures to protect your information (for example, hashed passwords handled by our authentication provider and access controls). No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

10. Children

The Service is intended for adults (18+) and is not directed to children. We do not knowingly collect personal information from children under 18. If you believe a child has provided us information, contact us by email at hello@castorprep.com and we will delete it.

11. Changes to this Policy

We may update this Policy. If changes are material, we will provide reasonable notice (for example, by updating the effective date or notifying you). Your continued use after changes take effect constitutes acceptance.

12. Contact

Questions or requests about this Policy: email us at hello@castorprep.com.