Privacy policy

Your account. An email address, and a password if you set one. If you sign in with Google or Apple we receive your email address and the display name that provider gives us: never your password with them, and nothing else from your account there. Authentication is run for us by Supabase.

What you do in the product. This is the bulk of it, and it exists because it is the product: every question you answer and whether you got it right, the review schedule built from that, practice and mock exam runs and their answers, your streaks and daily quests, your mastery of each topic, your readiness figures, and how far through a book or guide you have read. Without it there is no progress screen, no revision schedule and no readiness estimate.

Device and session records. The kind of device (web, iOS, Android), the app version, a notification token if you turn notifications on, and when the device was last seen. We also record security events on your account: when you sign in, when your password changes, and how fast questions are being served. This is how we spot abuse of the free plan and of the account itself.

Attempts to sign up or reset a password. Both of those forms send email to whatever address is typed into them, so we limit how often each connection can use them. To count the attempts from one connection we store a salted digest (SHA-256) of its IP address, alongside the hour it belongs to and a count. The address itself is never written down and the digest cannot be turned back into it. Each row covers a single hour and is deleted automatically once it has expired. None of this is attached to your account, because these are the forms you use before you are signed in, and we do not use it to recognise you, to build a profile or to follow you anywhere.

Payment. If you subscribe, we store the identifier of your customer record with Stripe, the status of the subscription and the date the paid period ends. We never receive or store your card number. It is entered on Stripe’s own checkout and stays with Stripe.

What you send us. If you report a question or email support, we keep what you wrote and our reply.

UK GDPR requires a reason for each use. Ours are:

This site runs no analytics package and carries no advertising or social media trackers. There is no Google Analytics, no tag manager, no pixel, no session recorder and no third party profiling of any kind. That is why you have not been asked to accept cookies: the only cookies we set are the ones needed to keep you signed in.

We do not sell your personal data, we do not share it for anyone else’s marketing, and we do not use your answers to advertise to you.

Each one is bound by contract to act only on our instructions, and each does one job:

Some of these operate outside the UK. Where personal data is transferred out of the UK we rely on the UK’s approved safeguards: an adequacy decision where one exists, and otherwise the International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses. We will also disclose data where the law requires it.

Some email is part of the service and cannot be switched off while you have an account: a welcome message, password resets, and receipts and notices about your subscription.

Everything else is yours to turn off from the account screen: the exam countdown as a paper approaches, the weekly summary of what you answered, and the notice that a question you reported has been ruled on. The switch is checked before an email is prepared, not after.

Your account and its study data are kept while the account exists. We keep it rather than expiring it because a revision schedule and a readiness estimate are built from everything you have answered. An attempt from a year ago is still evidence of what you know.

When an account is deleted, everything attached to it goes with it, as described in the next section.

Payment records are the exception. Invoices and the record of payments you actually made stay with Stripe for six years, because UK tax law requires them to be kept. Erasure covers the personal data we hold to run the service, not the accounting trail behind a payment.

Under UK GDPR you have the right to:

Deleting your account. You do not need to ask us: the account screen has it, under Leaving. Asking gives you fourteen days to change your mind by signing back in. After that the account is destroyed: the login, the email address, every answer, every mock run, every reading position, the streaks and the entitlement. We keep a record that an erasure happened. That record holds a digest of the account id that cannot be turned back into it, and nothing else, so we can confirm it was done without keeping what was deleted.

One case needs a human: an account with a live subscription is not erased automatically, because cancelling a subscription is something only the payment provider can do and an erased account with a live subscription would go on being charged. Cancel first, or write to us and we will handle both.

For anything else, like a copy of your data, a correction or an objection, email support@prep66academy.com. We answer within one month. If you are not satisfied you can complain to the Information Commissioner’s Office at ico.org.uk, though we would rather you gave us the chance to put it right first.

This service is built for adults training towards an aircraft maintenance licence and is not directed at children. We do not knowingly collect data from anyone under 16. If you believe a child has an account, tell us and we will delete it.

All of them are strictly necessary. They exist to sign you in and keep you signed in, which is why no consent banner is needed and none is shown:

Clearing cookies signs you out and nothing else. None of them tracks you across other websites.

If what we collect or why changes, this page changes with it and the version date at the top moves. That date is the notice: we keep no mailing list for policy announcements and we will not email you about a change to this page, so a revision is something you find here rather than something we send you. The date is shared with the terms of service, so a revision to either document moves both.

Questions, requests and complaints all go to support@prep66academy.com. The terms of service cover the rest of the agreement.

The controller is Ancestorii Ltd, a company registered in England and Wales (number 17224876), registered office 41 Pentre Road, Maerdy, Ferndale, Wales, CF43 4DP.