Privacy Policy

Who is responsible

Oriol Dellà i Soler (trading as “Prepstellar”), NIF 77623436T, Barcelona 08013, Spain, is the data controller. Contact: support@prepstellar.com.

Where this policy applies

This policy covers the Prepstellar iOS and Android apps, the web app at app.prepstellar.com, prepstellar.com, the waitlist, support and the community features inside the app. The web app is the same Prepstellar in your browser and uses the same account, so everything below about accounts, progress and study features applies to it too. What is specific to the web app is described in In the web app.

Data we handle

Our hosting and security providers may also process standard request data, such as IP address and user agent, to deliver and protect the website, the web app and the backend.

In the web app (app.prepstellar.com)

Unlike the phone app, the web app has no guest mode: you need an account from the start. On top of what is described above, the web app handles the following.

• Sign-up and email verification. You sign in with email and password, Google or Apple. Study content is only served once your email is verified, and email addresses from disposable-mail domains are not accepted (we only check the domain against a list). Basis: performance of our contract and our legitimate interest in preventing fake accounts.
• Your email choices. Before you start, we tell you that your email is used for your account (verification, password resets and important service notices), which are not marketing. Course news and offers by email are a separate, optional checkbox, unticked by default; leaving it unticked does not limit your access. We store your choice with the server's date and time, the version of the text you saw and a short history of your recent changes, so we can show what you agreed to. You can change it any time in Account or by writing to us. Basis: consent.
• One web session at a time. An account can have one open web session: if you open Prepstellar in another browser or tab, the previous one is closed. To do that our server keeps a random session ID, a random ID for the browser tab (created by the web app and kept only in memory), the platform and the times the session was opened and last used. A session unused for 30 days stops counting. Basis: our legitimate interest in preventing account sharing and protecting the content.
• Study pace and content protection. So the courses can't be copied wholesale by automated tools, the server records which course content has been delivered to your account (per course and per day) and applies pace limits designed for real studying: reopening what you have already seen never counts, only moving ahead very fast does. If you reach a limit, you are told when there is room again. If the pattern looks like automated extraction (many lessons in a short time, a systematic sweep of a course, many courses on the same day or connections from data centres), the account is blocked temporarily and automatically: 1 hour, then 24 hours or 7 days if it happens again. The block expires on its own and no person reviews it beforehand; if you think it was a mistake, write to support@prepstellar.com and a person will look at it. Basis: our legitimate interest in protecting the content and the service, and the limits in our Terms.
• Checking you're a person (Google reCAPTCHA Enterprise). The web app uses it invisibly to confirm that requests come from the genuine app and not from a script, and it may show an “I'm not a robot” checkbox if you move through a course faster than usual. To assess this, Google receives technical and connection data from your browser (including your IP address) and may use its own cookies or browser storage for that security purpose, under its privacy policy. We receive the result: a temporary pass if you succeed and a count of failed attempts in a row; several failures in a row are treated as a sign of an automated tool and block the account temporarily, as above. Basis: our legitimate interest in the security of the service.
• Your IP address. Our code does not store your IP address in plain form. It calculates a salted hash of it to count, for a limited time, how many new accounts are created and how much content is requested from one connection, and checks it against published data-centre ranges. Those counters are set to delete themselves after 2 days. Hosting and infrastructure providers may still log the IP in their own access logs. Basis: our legitimate interest in the security of the service.
• Your plan. To know whether you have an active subscription, our server asks RevenueCat using your user ID. You can also subscribe in the web app by card, as described under Purchases. A subscription bought in the phone app also works in the web app, and the other way round. Basis: performance of our contract.
• In your browser. Your signed-in session, your preferences and your local progress are kept in the browser's own storage, because they are needed to keep you signed in and let your progress follow you. They are not used for advertising or to follow you. Study content is not stored in the browser: it stays in memory while the tab is open.
• Counting visits. The web app counts visits anonymously with Umami, like the website: which screens are opened and a few steps, such as signing up, choosing a course, finishing a test or starting a purchase. No cookies, nothing stored in your browser for it, and never your account, user ID, email address or name. Details in Counting visits.
• What isn't there. No analytics linked to you, no automatic crash reports, no advertising cookies and no pixels. The app's code and fonts are served from our own domain. The only third-party resources it loads are the Umami visit counter, Google reCAPTCHA, the Google or Apple sign-in window if you choose one of them, and, when you pay, the secure checkout from RevenueCat and Stripe.

Counting visits

To know, in aggregate, how many people visit prepstellar.com and the web app, where they come from, which pages lead to the app and which parts of the web app are used, the website and the web app use Umami Cloud, by Umami Software, Inc. It sets no cookies and stores no identifier in your browser. It uses your IP address when each visit arrives to work out your country and to tell one visit from another, and does not keep it in the statistics. We see totals: pages viewed, taps on the store buttons, the site and campaign that sent you, country, browser, operating system and device type. In the web app we also see which screens are opened and a few steps (signing up and its method, choosing a course, finishing a test, opening the Premium page, starting and completing a purchase and its billing period, signing out). It never receives your account, user ID, email address or name, and it is never linked to an account. If your browser sends “Do Not Track” or “Global Privacy Control”, nothing is counted. Basis: our legitimate interest in understanding, in aggregate, how the website and the web app are used so we can improve them. You can object at any time by turning on one of those signals, blocking the script or writing to us. More in the Cookie Policy.

Why we may use it

Under the GDPR, we process service and account data to perform our contract with you or take steps you request (Art. 6.1.b); security, reliability, content protection, moderation and limited aggregate service measurement for our legitimate interests (Art. 6.1.f); analytics in the phone app, marketing emails and the waitlist with your consent (Art. 6.1.a); and records we must retain to meet legal obligations, such as invoices (Art. 6.1.c). Apart from the temporary automatic blocks described in In the web app, which a person reviews if you ask, you are not subject to advertising profiling or decisions that produce legal or similarly significant effects.

Service providers and disclosures

We disclose data only as needed to operate Prepstellar:

• Google: Firebase Auth, Firestore, App Check, Cloud Functions and Storage; Analytics and Crashlytics in the phone app only; and reCAPTCHA Enterprise in the web app, which handles the data it receives under its own privacy policy.
• Anthropic: the AI tutor, coach, exam generator and comment moderation (Claude API).
• RevenueCat: subscription status in every version and, in the web app, the sale itself (RevenueCat Web Billing, which charges through Stripe). It receives your user ID and, for web purchases, the billing email you enter at checkout. Our server asks it with your user ID whether your subscription is active.
• Stripe (Stripe Payments Europe, Limited, Ireland): payment processor for the web app. When you subscribe there, it processes the card payment through RevenueCat and handles your payment details and billing email. Prepstellar never sees or stores your card number.
• Apple and Google Play: sell the subscription in the phone app and process the payment as independent controllers under their own privacy policies.
• Hostinger: hosts the website and the web app.
• Umami Software, Inc. (Umami Cloud, United States): cookieless visit counts for the website and the web app, as described in Counting visits. It receives the IP address and technical data of each visit, never any account data.
• Our email provider, when we answer support or send the waitlist notice.

They process data under their own terms or our processor agreements, as applicable. We do not sell personal data, use it for third-party advertising, or track you across other companies' apps and websites. We only disclose it to anyone else if the law or a competent authority requires it. Public community comments and nicknames are visible to other users after moderation because that is the feature you chose to use.

International transfers

We select EU locations where the service supports them. Some providers are in the United States or may process data outside the European Economic Area. Where required, transfers rely on an adequacy decision, Standard Contractual Clauses or another lawful safeguard, as each provider has agreed.

Retention and deletion

• Account-linked Firebase data is kept while your account exists and is deleted when you complete account deletion.
• Web app records (open sessions, delivered content and pace, temporary blocks and your email choices) are kept while your account exists. IP counters are set to delete themselves after 2 days, and the record of a temporary block 30 days after it ends.
• AI conversation text is not stored in Firestore during normal use. If you report an answer, the report stores that answer and its related prompt with your user ID. Reports linked to your user ID and quota counters are deleted with your account.
• Waitlist data is kept until the launch notice is sent or you ask for deletion.
• Operational diagnostics are kept only for the periods configured by the provider and needed to investigate reliability or security.
• Invoices are kept for as long as tax law requires. Aggregated or anonymous statistics and reports that can no longer identify you may remain. Store, payment, transaction or tax records may be retained where Apple, Google, RevenueCat, Stripe or the law requires it.

To delete your account, open Account → Delete account in the app or in the web app, type “delete” and complete re-authentication if requested. This removes the Firebase account, synced progress, profile, device registrations, usage counters, web sessions, delivered-content records, temporary blocks, your email choices, comments and reports linked to your user ID. Deleting an account does not cancel an active subscription: cancel it in the App Store or Google Play or, if you subscribed in the web app, from the link in your purchase receipt email. Full instructions and an email alternative are on our Delete account page.

Your choices and rights

You can use the phone app anonymously, turn usage statistics on or off at any time in Settings → Usage statistics, turn course news and offers by email on or off in the web app's Account, avoid community and AI features, or delete your account from Account → Delete account (details in Delete your data). Under the GDPR you may request access, correction, deletion, restriction, portability or object to processing. You may withdraw consent at any time without affecting earlier lawful processing. Email support@prepstellar.com; we will normally respond within one month.

You may complain to the Spanish supervisory authority, the AEPD, or your local authority. California residents may request access, correction or deletion and opt out of sale or sharing; Prepstellar does not sell or share personal information for cross-context behavioural advertising and will not discriminate for exercising a right.

Children

Prepstellar is a professional and technical exam-preparation service and is not directed to children under 16. If you believe a child has provided personal data, contact us so we can investigate and delete it.

Security and changes

Data is encrypted in transit. We use access controls, Firebase Security Rules, App Check (reCAPTCHA Enterprise in the web app) and server-side entitlement checks, but no service can guarantee absolute security. We will update the date above when this policy changes and provide an appropriate notice if a change materially affects your rights.

Latest change (29 October 2026): the web app now counts visits anonymously with Umami, like the website (see Counting visits).

Previous change (27 October 2026): we added the web app (app.prepstellar.com): sign-up with a verified email, your email choices with date and version, one web session at a time, pace limits with temporary automatic blocks, reCAPTCHA Enterprise and the hashed IP address; card payments through RevenueCat and Stripe; and how website visits are counted, which now respects Do Not Track and Global Privacy Control.