Start free

Home/Privacy

// Legal

Privacy Policy

Last updated: 7 August 2026

The short version. We collect only what we need to run your account and your practice - your email address, a display name if you choose to set one, and the record of what you practised. You sign in with a six-digit one-time code we email you, so there is no password and no social login. Your code runs in your own browser and never reaches us. Usage analytics are a separate choice and are off unless you turn them on. We never sell your personal data, we do not use third-party advertising trackers, and you can export or delete your data at any time. The full detail is below.

1. Who we are

Prepshotz is operated by Prepshotz Edutech Private Limited ("Prepshotz", "we", "us"), a company incorporated in India (CIN U72900MH2022PTC387631) and recognized as a startup by DPIIT under the Startup India initiative (DIPP110269), with its registered office at Akola, Maharashtra 444005, India. We are the data fiduciary (data controller) responsible for the personal data described here. This policy covers our website at https://prepshotz.com and our app at https://app.prepshotz.com (together, the "Service").

2. What we collect

We keep data collection to the minimum needed to run the Service.

  • Account data: your email address, and a display name. You sign in by entering that address and then a six-digit one-time code we email to it, so there is no password. We do not offer a social login, so we never receive your name, a profile picture, or an account identifier from Google or any other provider. Your display name starts out empty and stays empty unless you set one yourself, in Settings, where you can also change it later; the app uses it to greet you. Alongside these we hold an internal account id, whether the address has been verified, and when the account was created and last updated.
  • Sign-in data: when you ask for a code we create a short-lived sign-in record holding your email address and that code, and counters that record your address: one so a single address cannot be used to send more than five codes an hour, and one that counts wrong codes entered against your address from each source network, so that someone else guessing at your code cannot stop you signing in. All of these are written before you finish signing in, so if you type an address and never complete sign-in, that address is still held in those records for the periods in section 8. Once you are signed in, your session record also holds the IP address and browser user-agent of the device you used.
  • Practice data: which problem you attempted, whether it passed, a short machine-generated label for how a failed attempt failed (for example, that the wrong number of rows came back), when it happened, which skills and topics the problem exercised, your streak, and the scheduling state we use to decide what to bring back for review. We do not receive the code you wrote - see section 3.
  • Goal text: when you create a practice track you describe your goal in your own words. We store that text with the track and send it to a language model, to build the ladder and its exercises, as described in section 6. Please do not put personal or confidential information in it.
  • Technical data: your IP address, browser and device type, the general location our providers infer from your IP address, and diagnostic logs. Every request to our API is written to Cloudflare Workers Logs - all of them, not a sample.
  • Product analytics: first-party usage events, recorded in Cloudflare Analytics Engine so we can see what works and fix what does not, and only if you turn analytics on. Each event carries its name, when it happened, your account id, and a small bundle of properties whose contents depend on the event. Today they are: that you ran a query, that a query was graded and whether it passed, that you used a hint, and that you created a track, each grouped by a session id the app generates for that visit (or by your account id if it has none); plus, on an interview track, whether building a practice exercise succeeded or failed, grouped by that track's id. This is a set we add to as the product grows rather than a fixed list. We do not use third-party advertising or cross-site tracking.
  • Cookies and browser storage: see section 5.

We do not collect payment information (the beta is free), we do not ask for sensitive personal data, and we do not buy personal data from data brokers.

3. Your code stays in your browser

Your code is executed and graded locally in your own browser, inside a sandboxed worker - not on our servers. That holds for every language we support: SQL runs against a database that loads into the page, and Python, JavaScript and TypeScript run in in-browser sandboxes. When you press Run, nothing you typed is sent to us.

When a result is graded, the only things your browser reports back are which problem it was, whether it passed, that short label describing how it failed, and an id we use so the same result is not counted twice. We never receive, store or process the code itself, and we could not produce a copy of it if you asked us to. Drafts of your work are saved in your own browser (section 5) so you can come back to them; they are cleared when you solve the problem and when you sign out.

4. How we use your data, and our legal bases

We use your data to:

  • create and secure your account and sign you in, including emailing you a one-time code (to perform our contract with you);
  • run the core product - save your progress, record whether your work passed, and adapt practice to the mistakes you make (to perform our contract, and our legitimate interest in making the Service work);
  • turn the goal you type into a practice ladder, which means sending that text to the model provider named in section 6 (to perform our contract);
  • understand and improve the Service through first-party analytics (your consent, given separately from the rest of this notice by ticking the analytics box, and withdrawable on its own at any time);
  • communicate with you about the Service, including important changes (our contract); and
  • comply with law and protect the Service, our users, and our rights (legal obligation and legitimate interest).

Where we rely on your consent, you can withdraw it at any time in Settings in the app. Be clear about what that does: withdrawing the consent you gave at sign-in runs exactly the same erasure as "Delete my account". We delete your account and the data attached to it and sign you out; there is no lesser version that merely pauses processing. The separate analytics consent is the one you can turn off on its own, at any time, and everything else carries on unchanged. We do not sell your personal data, and we do not use it for third-party advertising. We do not train any model on your data.

5. Cookies and local storage

We use a small, deliberate set of cookies and browser storage, and no third-party advertising or cross-site tracking cookies. This section also serves as our cookie policy.

  • On our website (https://prepshotz.com): one functional item in your browser's local storage, named prepshotz-theme, that remembers your light or dark theme choice. Our pages also load Cloudflare Web Analytics from static.cloudflareinsights.com, a page-view counter that sets no cookie, writes nothing to your browser storage, and does not follow you to other sites.
  • In the app (https://app.prepshotz.com): a strictly necessary authentication cookie. It is scoped to .prepshotz.com because the app and our API sit on two different subdomains, and that parent scope is the only one a browser will send to both. There is no sign-in on our marketing website, and it never reads the cookie, but you should know that this scope means your browser sends it to https://prepshotz.com as well. Alongside it: the same prepshotz-theme item; one local-storage entry for each exercise you have opened, named play: followed by the id of the rung it sits on in your practice ladder, holding your working draft of its code; and one session-storage entry, ps.chunkReloadAt, a timestamp used once after a deployment to recover from a stale script load. The drafts stay on your device and are never sent to us.
  • Security: our infrastructure provider (Cloudflare) and its Turnstile bot-check, which guards the step where you ask for a sign-in code, may set strictly necessary tokens to tell humans from bots and protect the Service.
  • Analytics: the first-party product analytics described in section 2, which the app records only if you tick the analytics box when you accept this notice or switch it on later in Settings, and the cookieless page-view counter on our website, which runs on every visit and which we do not put behind a consent prompt.

You can clear or block cookies and local storage in your browser settings, but blocking strictly necessary cookies will stop sign-in from working. Signing out clears your saved drafts for you.

6. Who we share data with

We do not sell your personal data. We share it only with:

  • Cloudflare, Inc., which provides almost all of our infrastructure: hosting and delivery for this website (Cloudflare Pages) and for our API (Cloudflare Workers), our database (Cloudflare D1), the queue that carries your sign-in email, our request logs (Workers Logs), our product analytics (Analytics Engine), the bot-check on sign-in (Turnstile), and the page-view counter on this website (Cloudflare Web Analytics);
  • Amazon Web Services, Inc., in three specific places. Amazon SES, in the AWS Asia Pacific (Mumbai) region, receives your email address so it can deliver your sign-in code. AWS Lambda, in the same region, runs the engine that turns a new track into a practice ladder. Amazon Bedrock receives the goal text you typed, inside a prompt, so a language model can map it onto our skill graph and, on an interview track, invent the fictional company your exercises are set in; it is not sent your email address, your account id, or anything else that identifies you. We cache the skill-graph mapping, so a goal we have already mapped is not sent again for that; the calls that build an interview track's exercises are not cached, and run each time one is needed;
  • other service providers strictly to operate the Service, under contracts that require them to protect your data and use it only on our instructions;
  • authorities or third parties where we are required by law, or to protect the rights, safety, and security of our users, the public, or Prepshotz; and
  • a successor entity, in connection with a merger, acquisition, or sale of assets - in which case we will tell you, and this policy will continue to protect your data.

7. Where your data is stored

Your account and practice data are stored in Cloudflare D1. The primary copy of that database runs in Cloudflare's Singapore region, which is outside India - Cloudflare D1 offers no India region, so we cannot host it here. Our API is deliberately run close to that primary, so it too executes outside India for most requests, and Cloudflare's request logs and our product analytics sit on Cloudflare's global infrastructure.

Amazon SES and AWS Lambda run in the AWS Asia Pacific (Mumbai) region, in India. The Amazon Bedrock call is made from that Lambda, but we will not promise you it stays in India. Which model we call is set per deployment, and where a model is reached through one of AWS's geographic inference profiles the request can be routed to, and processed in, any AWS region that profile covers. Treat the goal text you type as leaving India.

So your personal data is processed and stored outside India as a normal part of running the Service. India's Digital Personal Data Protection Act, 2023 permits personal data to be transferred outside India except to territories the Central Government restricts by notification. Wherever your data goes, it stays with the providers named in section 6, under contracts that require them to protect it and use it only on our instructions, and we remain answerable to you for it.

8. How long we keep it

  • A sign-in code expires five minutes after it is issued; asking for another code inside that window refreshes the same code rather than minting a new one. The sign-in record is deleted when you delete your account; if you asked for a code and never signed in, there is no account to delete, so email us and we will remove it.
  • The counters that hold your email address for sign-in rate limiting are deleted by a nightly job once they are more than a day old.
  • A session expires seven days after you last used it, and signing out ends it and deletes its record straight away. An expired session's record is cleared the next time that same browser presents it. Nothing sweeps the ones that are never presented again, so if you simply stop using a device, that record - and the IP address and user-agent in it - stays until you delete your account.
  • Product analytics events are kept by Cloudflare Analytics Engine for around 90 days and then dropped.
  • Request logs are kept by Cloudflare Workers Logs for the retention window that service applies and are then deleted automatically. We keep no separate copy.
  • Your account and practice data are kept for as long as your account exists. We do not currently delete accounts for inactivity, so an account you walk away from stays until you or we delete it. If you want it gone, delete your account (section 9) or email us and we will do it.

When you delete your account we remove your rows from our database straight away, except where we must keep limited records to comply with law, resolve disputes, or enforce ourTerms. Deleting your account does not reach three things. Two of them are outside our database and append-only: usage events already written to Cloudflare Analytics Engine, and entries already written to Cloudflare's request logs. Both age out on the schedules above. The third is in our own database: the cached result of mapping a goal onto our skill graph. It is stored against a fingerprint of the goal text rather than against you, and holds only the list of skills the model matched, but no part of the app and no account deletion removes it. It expires 90 days after it was written, and is cleared by a sweep that runs when that cache is next written to rather than on a timer, so a long quiet spell can leave an expired entry in place until the next person builds a track.

One more gap worth naming: the sign-in rate-limit rows are stored against the plain form of your address, while deletion matches the address on your account. If your provider treats a dot or a +tag as the same mailbox and you wrote your address with one, the deletion misses that row and the nightly job removes it instead, within a day.

9. Your rights and choices

Under India's Digital Personal Data Protection Act, 2023, and other laws that may apply where you live, you have rights over your data. For everyone, we offer:

  • Access and portability - "Export my data" in Settings downloads a file holding your profile, your consent record, your attempts, your progress and streak, your tracks and their rungs, your review scheduling state, your session metadata, any practice content generated for your tracks, your sign-in rate-limit records, and your analytics events;
  • Correction - your display name is the one detail you can correct yourself, in Settings. Your email address is also your sign-in identity, and there is no way to change it in the Service: the routes that would do it are switched off. If the address on your account is wrong, export your data, delete the account, and sign up again with the right address;
  • Deletion - "Delete my account" in Settings deletes your account and the data attached to it, subject to the limits in section 8;
  • Withdraw consent - "Withdraw consent" in Settings. It runs the same erasure as deleting your account, and signs you out. To turn analytics off without closing your account, use the analytics switch in the same place;
  • Nominate - the Act gives you the right to name someone who may exercise these rights for you if you die or cannot exercise them yourself. We should be straight with you: there is nowhere in your account to store a nominee today, so we cannot offer this as a control in the app. Write to our Grievance Officer (section 11) and we will handle a nomination outside the Service;
  • Grievance redressal - raise a concern and have it addressed (section 11).

To exercise any of these, use the controls in Settings in the app or email us atinfo@prepshotz.com. We will respond within 30 days. Using these rights is free, and we will not discriminate against you for it.

10. Children and minors

Prepshotz is for adults. You must be 18 or older to create an account, and there is no under-18 route: we have no way to obtain and verify a parent's or guardian's consent, so we do not offer the Service to children at all and we do not knowingly process a child's personal data. Before you can use the app you have to tick a box confirming you are 18 or older, and our server refuses to record your consent without it. We never ask for your date of birth, so that tick is a declaration you make, not something we can verify. We record the moment you made it, alongside your consent record, and it is deleted with the rest of your account. We do not profile children or serve targeted advertising to anyone. If you are a parent or guardian and believe a child has created an account, email us at info@prepshotz.com and we will delete the account and its data.

11. How we protect your data, and your Grievance Officer

We protect your data with encryption in transit (HTTPS), storage on infrastructure our providers encrypt at rest, access controls, a bot-check on the step where you ask for a sign-in code, rate limits on both steps of sign-in, and sandboxed in-browser code execution, so your code stays on your device during grading. We never write your sign-in code to a log. No method of transmission or storage is ever completely secure, but we work to protect your data and to notify you and the authorities of a breach where the law requires.

In line with India's Digital Personal Data Protection Act, 2023 and the Information Technology Act, 2000, you can contact our Grievance Officer for any data protection concern:

  • Grievance Officer: Sahil Mune
  • Email: info@prepshotz.com
  • Post: Grievance Officer, Prepshotz Edutech Private Limited, Akola, Maharashtra 444005, India (our full registered address is on the MCA register against the CIN in section 1)

We will acknowledge your complaint and tell you the outcome within 30 days of receiving it. If you are not satisfied, you may complain to the Data Protection Board of India.

12. Changes to this policy

We may update this policy as the Service evolves. We will change the "last updated" date above and, for material changes, give you clearer notice. Continuing to use the Service after a change means you accept the updated policy.

13. Contact

Questions about this policy or your data? Email Prepshotz Edutech Private Limited atinfo@prepshotz.com.