Privacy Policy

• Use student initials only. PrepPal never asks for student names.
• Your caseload stays in your browser. If you turn on saving it to your account, it's encrypted in your browser with a passphrase only you know first, so we can't read it.
• We collect only what we need to run your account: your name, email, plan, saved work, the devices you sign in on, and simple records of which features you use.
• We don't sell your information, and we don't use advertising or tracking cookies.
• Our AI providers process your requests to create materials, and don't use them to train their models.

Account information. Your name, email address and password. Your password is stored securely by our login provider; we never see it in plain text.

Billing information. Your plan and subscription status. Payments are handled by Stripe, which collects your card details directly. We never see or store your full card number.

Device information. To keep accounts to two devices at a time, we record a random device identifier stored in a cookie, a short description such as "Chrome on Mac", and when each device was last used.

Your saved work. Materials, word lists and game packs, folders, stories and core boards you save, so they're available on any device you sign in on. Saved goals and treatment plans are included. Student initials are replaced with “[Student]” before anything is saved to our servers; the initials stay only in your browser.

What you type to generate content. The goals, targets, themes and settings you enter are sent to our AI providers to create your material. Any student initials are swapped for a placeholder in your browser first, so they are never sent.

How you use PrepPal. Simple records of which features you use, such as which pages you open, what kind of material you make and how many new pictures are drawn, along with the date. We use these to understand which features are useful, keep costs in check and spot shared logins. They never include your students' information.

Messages you send us, if you contact us.

Your caseload (students' initials, grades, goals, schedules, school details, session data, notes, service log and meetings) and your student roster are stored in your web browser. They are not uploaded to our servers unless you turn on “Save to my account” on the Caseload page. Then your browser encrypts the whole caseload (AES-256) with a key made from a passphrase only you know, before anything is sent. We store only the encrypted copy plus when and from which kind of device it was saved. We can't read it, and we can't reset a forgotten passphrase. Your passphrase is never sent to us. When you ask PrepPal to suggest caseload groups, only the details needed for grouping (grade, school name, target area, goals and service time) are sent to our AI provider, never students' initials. Clearing your browser data deletes this information, so keep your own records.

• to run PrepPal: sign you in, save your work, generate materials and pictures
• to process payments and manage your subscription
• to keep accounts secure, including the two-device limit and new-device codes
• to email you codes and important account or billing messages
• to answer your questions and improve PrepPal

We share information only with the providers that help us run PrepPal, and only what each one needs:

• Supabase: login and database (account, devices, saved work)
• Vercel: website hosting
• Stripe: payments and billing
• Resend: sending sign-in codes and account emails
• Anthropic (Claude): generating text for materials, games and stories
• OpenAI: generating pictures from single words (for example "rabbit")

We may also share information if the law requires it, or to protect the safety and rights of our users and PrepPal. We don't sell or rent personal information.

We use only the cookies needed for PrepPal to work: keeping you signed in, recognizing your device, and confirming your password during sign-in. We also use your browser's local storage to keep your work and caseload on your device, and, if you turn on encrypted caseload saving, its built-in database to remember the locked key on that device. We don't use advertising or analytics cookies.

• Account and saved work: while your account is active.
• After a subscription ends: saved work is kept for 30 days in case you come back, then deleted.
• If you ask us to delete your account, we delete your account and saved work within 30 days, except billing records we must keep for tax and legal reasons.

You can view and update your information in PrepPal, delete saved items anytime, and sign out other devices from your Account page. To get a copy of your information or to delete your account, email us at support@preppaltherapy.com. Depending on where you live, you may have additional rights, and we'll honor them.

PrepPal is for adult professionals and isn't directed at children. We don't knowingly collect personal information from children. Students may play PrepPal games during a session, but they don't have accounts and we don't collect information about them. If you believe a child's personal information was entered into PrepPal, contact us and we'll delete it.

We use encrypted connections (HTTPS), secure login with emailed codes for new devices, and access rules so each account can only reach its own data. No system is perfectly secure, so please use a strong password and keep it private.

If we change this policy in an important way, we'll let you know by email or in the app. Questions? Email support@preppaltherapy.com or use the contact page.