Privacy Policy

PrepPair is operated by CresMD in Calgary, Alberta, Canada. This page says plainly what we collect, why we hold it, who else sees it, and how to get it deleted.

What we collect

• Your account: email address and a hashed password. We never store the password itself.
• Your profile: display name, exam or coursework focus, target date, timezone, study hours, preferred formats and styles, languages, country of origin if you give one, and the circumstances you choose to tick. Most of this is optional.
• Your activity: messages you send to other members, sessions you book, and whether a session happened.
• Payment records: if you subscribe, we keep your plan and its status. Card details go to Stripe and never touch our servers.
• Technical data: a session cookie to keep you signed in, and standard server logs including IP address, used to rate-limit abuse.

We do not use advertising trackers, and we do not sell your data to anyone, ever.

Why we hold it

• To match you with study partners, which is the service you signed up for.
• To let you message and meet those partners.
• To send you account email: password resets, address verification, and session reminders.
• To take payment and manage subscriptions.
• To keep the service safe, by limiting abuse and acting on reports.

What other members see

Members matched with you see your profile: display name, focus, timeline, timezone, intensity, study preferences, and any circumstances you ticked. They see messages you send them. They never see your email address unless you choose to tell them.

Who processes data for us

• Railway hosts the app and the database.
• Stripe handles payments and holds card details.
• Resend delivers account email.
• Daily.co runs the video rooms. Calls are not recorded by us.

Each is bound to use the data only to provide its service to us. Some of them operate servers outside Canada, which means your data may be processed abroad.

How long we keep it

For as long as your account exists. Delete your account and we remove your profile, matches, sessions, and messages. Payment records are kept as long as tax and accounting rules require. Server logs are kept briefly and then discarded.

Your rights

You can see and edit your profile at any time from your account page, and delete your account from the same place. You can ask us for a copy of what we hold about you, or ask us to correct or erase it, by emailing preppair@cresmd.co. We answer within 30 days.

Security

Passwords are hashed with bcrypt. Traffic is encrypted in transit. Sessions are held in an httpOnly cookie that scripts on the page cannot read. No system is perfect, and if a breach ever affects your data we will tell you.

Children

PrepPair is for adults. We do not knowingly collect data from anyone under 18.

Changes

If this policy changes materially, we will tell you by email or in the app before it takes effect.