Privacy Policy

This policy describes how TaroPrep handles personal data. We collect as little as we can to run accounts, practice, and support.

Data we collect

• Account: name, email, password hash (we never store a raw password), Google/X identity if you use those buttons.
• Study data: attempts, saves, notes, planner tasks, test sessions, vocab boxes, class membership.
• Support: bug reports, AI messages you send to Taro, device/browser basics, IP on security events.
• Payments: if a processor is connected later, they handle card numbers. We store plan flags, not PAN.

How we use it

To run the product, score practice, personalize the planner, prevent abuse, fix questions, and email you about your account. We do not sell personal data. We do not use your answers to train public models without a separate notice.

Sharing

Infrastructure providers (hosting, auth broker for Google/X, AI inference when you ask Taro). Class teachers see what you join. Staff see what they need to support you. We share if the law requires it.

Retention

Account data lasts until you delete the account, plus a short backup window. Security logs may last longer where we must keep them. You can export planner ICS and review saved items in-app.

Your rights

Depending on where you live (including GDPR and US state laws), you may access, correct, delete, or export data, and object to certain processing. Use the contact form. We will not discriminate against you for exercising a privacy right.

Children

The service is aimed at high-school test takers. If you are under 13 in the US (or under the digital-consent age where you live), do not create an account. Parents who create an account for a teen are responsible for that use. Contact us to delete a child's account.

Security

Passwords are hashed by our auth library. Sessions use HttpOnly cookies. Server functions check the signed-in user and scope rows to that user. No method is perfect. Tell us about a vulnerability through the contact form.

International

Servers may be in the United States. By using the service you understand your data may be processed there.