Privacy Policy | Free AP Practice

1. Introduction

This Privacy Policy explains how Free AP Practice ("Service", "we", "us", or "our") collects, uses, stores, and shares information when you use the website, account features, practice tools, AI tutor, and Super features. Free AP Practice is a personal project maintained by Ajay Saravanan. This policy does not replace the privacy policies of the third-party services described below.

2. Information We Collect

2.1 Information You Provide Directly

Account and sign-in data: name, email address, password hash, account timestamps, and identifiers supplied through Google sign-in. OAuth tokens are stored by the authentication system in encrypted form when needed for account linking.
Practice data: AP class and unit selections, answers, correctness, timing, hints and attempt outcomes, progress, history, bookmarks, written-response submissions, and grades.
Personalization data: selected classes, target dates, study availability, teaching-style preference, age-confirmation timestamp, memory preference, and memory disclosure acknowledgement.
AI interactions: prompts, written responses, conversation context, and feedback you send to the standard tutor, personalized tutor, Coach, or other AI features. Coach and Insights may also process your practice data to generate recommendations, study plans, and summaries.
Super conversations: Super Coach and question-focused Super Tutor conversations, tool activity, and approved actions are stored for continuity and personalization. The standard free Tutor does not use this durable Super conversation system.
Tutor memory: when you enable it and acknowledge its disclosure, the tutor may send recent tutor exchanges to Mem0 to extract limited learning preferences, study constraints, recurring misconceptions, and helpful explanation strategies. Memory is associated with a pseudonymous identifier and is not intended to store full transcripts.
Bug reports and support requests: the title, description, reproduction steps, expected result, optional email address, severity, and technical question metadata you submit.
Transactional requests: password reset, verification, and account deletion requests.
Billing data: subscription and billing status, plan, billing period, and Stripe customer and subscription identifiers. Stripe handles payment-card details.
Referral data: referral codes, attribution timestamps, and the account relationship needed to measure referrals.

2.2 Automatically Collected Data

Server and hosting logs such as IP address, request path, timestamps, and status codes
Browser, device, approximate location, and network information sent through standard HTTP headers
Usage information such as page visits, feature interactions, and authentication state
Security, reliability, performance, and error information collected through Vercel, Sentry, and application logs
When optional analytics are enabled: product analytics events, feature usage, a pseudonymous account identifier after sign-in, client-side errors, and masked session-replay data collected through PostHog

2.3 Information Stored Locally in Your Browser

Theme, layout, and settings preferences
Analytics consent, an analytics journey key, and related opt-in measurement flags
Onboarding, first-use hint, referral, timezone, and sidebar-state cookies
Temporary conversation identifiers, Coach state, and written-response drafts in session storage

3. How We Use Your Information

To create and serve practice questions, written-response grades, explanations, and tutor responses
To authenticate accounts, maintain sessions, and protect the Service
To track progress, bookmarks, attempts, referrals, and saved preferences
To personalize tutoring, generate Insights, and build or update study plans
To send transactional emails such as verification and password reset emails
To process subscriptions, payments, taxes, cancellations, and account access
To respond to bug reports, account requests, and support inquiries
To prevent abuse, fraud, unauthorized access, and excessive automated use
To analyze usage trends and improve reliability, quality, and performance when optional analytics are enabled

4. Data Storage and Security

We store account, practice, personalization, billing-mirror, and feature data in Neon-hosted PostgreSQL. Generated question content and related assets may also be stored in PostgreSQL. Passwords are stored as hashes, not plain text, and OAuth tokens are encrypted by the authentication system. Authentication uses secure HTTP-only session cookies. We use access controls, validation, rate limits, and monitoring appropriate to a personal project, but no method of transmission or storage is completely secure.

5. Super AI and Tutor Memory

Super’s personalized tutor, Coach, Insights, and study plans use your selected AP classes, target dates, study availability, teaching-style preference, and scored practice patterns. Insights calculate strengths, weaknesses, trends, and suggested actions from recorded multiple-choice and written-response performance. We do not use this feature to predict AP exam scores or make decisions about admission, employment, credit, insurance, or other high-impact opportunities.

Tutor memory is optional and is limited to learning preferences, stable study constraints, and recurring course misconceptions. It is not a transcript store. We use a pseudonymous identifier rather than your account ID for this memory. You can pause memory reads and writes, inspect saved facts, delete individual facts, or delete all facts in Super setup. After Super access ends, tutor memory is retained for up to 90 days before scheduled deletion, unless you delete it sooner or delete your account.

Super Coach and question Tutor use separate durable conversation threads, while sharing the student learning model and approved long-term memory. Question references and attempt identifiers are validated on the server; the browser does not provide canonical answers, grades, or hidden grading context as trusted input.

6. Cookies and Local Storage

We use HTTP-only session cookies to keep you signed in, plus first-party cookies for onboarding, first-use hints, referral attribution, timezone, analytics consent, and sidebar state. Local storage stores theme and settings preferences and opt-in analytics controls. Session storage can hold temporary written-response drafts and Coach session state. Durable Super conversation messages remain server-side so a signed-in student can continue a Coach or question Tutor thread after reload.

If you accept optional PostHog analytics, PostHog may set first-party cookies and use local storage to remember your device, session, and analytics preferences. Vercel Analytics and Speed Insights run in a cookieless mode for aggregate page views and performance signals. We do not use third-party advertising cookies. If you use a shared device, you should sign out when finished.

7. Optional Analytics and Monitoring

PostHog product analytics are off by default. A consent banner asks before detailed PostHog tracking begins. We also use:

Vercel Analytics and Speed Insights: always-on, cookieless page views and performance-related signals
PostHog (opt-in): product analytics, feature usage, masked session replay, client-side error tracking, and a pseudonymous account identifier after sign-in
Sentry: production error and performance monitoring, which may receive error, request, browser, device, and diagnostic metadata

If you reject PostHog, it may still load in a cookieless mode for limited anonymous page-view measurement. It does not set PostHog cookies, store PostHog identifiers in your browser, or send detailed product events or account identification. Server-side operational metrics and security logs may still be collected. You can change this preference in Settings at any time.

8. Third-Party Services and Sharing

OpenAI or an OpenAI-compatible provider: AI prompts, written responses, grading inputs, and generated outputs needed for AI operations
Google: sign-in, Google One Tap, and identity information when configured and used
Neon-hosted PostgreSQL: database storage for accounts, practice, feature data, and private bug reports
Resend: verification and password-reset email delivery
PostHog: optional product analytics, error tracking, and session replay
Vercel: hosting, deployment infrastructure, cookieless analytics, and related infrastructure
Sentry: production error and performance monitoring
Stripe: payment processing, tax calculation, and subscription management
Mem0: optional pseudonymous tutor-memory storage
Upstash: short-lived rate-limit, usage, approval, and request-control data

Bug reports may include the optional email address and technical question metadata you provide. They are stored in our private application database for review and support. Do not submit sensitive information in a bug report; use support email for private requests. Each third party has its own terms and privacy practices. We do not sell your personal information or use it for cross-context behavioral advertising.

9. Retention and Deletion

We retain information for as long as needed to provide the Service, maintain security, resolve disputes, comply with law, and support legitimate operational needs. Current product retention behavior includes:

Study-plan records expire after approximately 90 days.
Durable Super conversation messages and Coach audit records are retained while needed for Super continuity and are removed with the account.
Insight snapshots may be retained for up to 365 days while the feature remains available, subject to per-user limits.
When Super access ends, stored Insights are locked and scheduled maintenance deletes them; tutor memory is scheduled for deletion after up to 90 days.
Rate limits, usage counters, locks, idempotency keys, and other Redis controls are short-lived and expire automatically.
Server logs, monitoring records, emails, billing records, backups, and bug reports follow the retention practices of the relevant operator or provider; we do not currently publish one fixed period for all of them.

You can clear practice data from Settings, which removes question history, mastery progress, bookmarks, and written-response submissions while keeping your account. You can request account deletion in Settings or by contacting us. Account deletion initiates removal of app-owned account, profile, practice, personalization, referral, billing-mirror, Insight, study-plan, feedback, and audit records; authentication records are handled by Better Auth, Stripe subscriptions are canceled, and Mem0 cleanup is queued and retried. Information held by third parties, backups, logs, or support records may persist under their own practices or legal obligations.

10. Your Rights and Choices

Depending on your location, you may have rights to access, correct, delete, or receive a copy of personal information, and to object to or limit certain processing. You can change optional PostHog consent in Settings, disable tutor memory, delete memories, clear practice data, or request account deletion. Contact us to exercise a right or ask for help; we may need to verify the request and may retain information where law or security requires it.

11. Children’s Privacy

The Service is intended for students aged 13 and older and is not directed to children under 13. Do not create an account or submit personal information if you are under 13. We do not knowingly collect personal information from children under 13. If we learn that we have done so, we will take reasonable steps to delete it. A parent or guardian who believes a child has used the Service should contact us promptly.

12. International Transfers

Your information may be processed in the United States or other countries where we or our service providers operate. Where required, we take steps intended to protect the information in accordance with applicable law.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with a revised "Last Updated" date. Where required, we will provide additional notice. Continued use of the Service after changes take effect means you accept the updated policy.

14. Contact Us

For questions about this policy or to exercise your privacy rights, contact us at:
Operator: Ajay Saravanan
Website: freeappractice.org
Email: [email protected]