Legal

Privacy Policy

Last updated: 10 September 2026

Most of this page is a list of things that do not happen. Every one of them was checked against what the site actually sends rather than assumed, and it is checked again whenever the site changes.

1. Who is responsible

Steer Prep is operated by [registered legal name], [postal address]. Questions about anything on this page go to [address for privacy enquiries].

2. What we collect

There are two things, and this is all of them.

Your account. When you sign up we keep:

• the email address you sign up with, which is how you log in and how we reach you
• the first name or nickname you type, which is only used to greet you in the app and does not have to be your real name
• your password, which is stored as a hash rather than as the password itself, so neither we nor anybody with access to the database can read it
• when the account was made, when the email address was confirmed, and when you last signed in

Your practice history. Each time you answer a question we keep one row holding:

• which question it was
• where that question now sits on the repetition ladder, which is a single number saying how long it will be before you see it again
• when you answered it, and when it is next due

That is the entire record. We do not keep what you picked, how long you took, what you got wrong, or any note or working. The ladder position is all the app needs to decide what to hand you next, so it is all that is written down.

3. What we do not collect

• No analytics. We do not count visits, record sessions, watch how far you scroll, or build a profile of what you read. There is no Do Not Track setting to honour here, because there is nothing running to switch off.
• No advertising, and no sale of anything. There are no ad trackers, no advertising pixels, and no data broker. We do not sell or rent personal information to anybody, and we do not share it for anybody else's marketing.
• No cookies of our own. Neither site sets one. The app keeps your sign-in token in your browser's local storage, which is what stops you having to log in on every page. It is strictly necessary for the app to work at all, it never leaves your device except to prove to us that it is you, and clearing your browser data removes it and signs you out.
• No third-party fonts, scripts, or embeds. Everything the pages load comes from our own servers. Opening a page on steerprep.com contacts nobody else.
• No date of birth, address, phone number, school, or payment details.Nothing asks for any of them.
• No model provider. The parts of Steer Prep that ask a language model anything are used by our own team to write and check questions before they are published. Nothing a student does reaches a model, and nothing a student has written or answered is ever sent to one.

4. Why we hold what we hold

The account exists so you can log in and so we can reach you about the account. The practice history exists so that the next question you are given is the right one; a practice tool that forgets what you have done is a list of questions in a random order. We do not use either for anything else.

5. Who else can see it

Three, and no others.

• Supabase holds the account database and the practice history, and runs the sign-in system. It is a service provider acting on our instructions, and the data sits in [Supabase project region].
• Resend sends the handful of automatic emails the account generates: confirming your address, resetting a password, and the like. It sees the email address it is sending to and the contents of that message.
• [Hosting provider] runs the server the sites are served from, in [server location]. Its logs record the ordinary things a web server records: the requesting address, the time, what was asked for, and the browser making the request.

Beyond those, information is disclosed only where the law requires it. There is no advertising network, no analytics company, and no partner receiving anything.

6. If you are under 18

Steer Prep is a study tool for a test taken mostly by people in high school, so many of the people using it are minors. That is expected, and it is why the account asks for as little as it does: an email address, and a name you can make up.

[Whether accounts are open to children under 13, and how a parent's consent would be obtained and recorded if they are, has to be settled before this section can be finished. The United States Children's Online Privacy Protection Act sets specific requirements for that age group, and a sentence saying we do not knowingly collect from them is only true if something actually prevents it.]

A parent or guardian may ask what we hold about their child's account, and ask for it to be deleted, by writing to [address for privacy enquiries].

7. How long it is kept

The account and its practice history are kept while the account exists. Server logs are kept for [log retention period] and are not joined to anything else.

8. Keeping it safe

Both sites are served only over an encrypted connection. Passwords are hashed rather than stored. Every row of practice history is behind a database rule that lets an account reach its own rows and nothing else, so one student cannot read another's history even by asking the database directly.

No system is beyond going wrong. If we ever believe an account's information has been exposed, we will say so by email to the address on it rather than leave it in a notice nobody reads.

9. What you can do

• Clear your practice history. The app has a button for it. It deletes your rows, and the next question you are given is decided as though you had just arrived.
• Get a copy of what we hold, or have it corrected. Write to [address for privacy enquiries].
• Close the account and have it deleted. Write to the same address. Deleting the account deletes the practice history with it.

Depending on where you live you may have further rights, under a state privacy law in the United States or under the General Data Protection Regulation in Europe, including the right to object to processing and to complain to a regulator. We apply the access, correction and deletion process above to everybody who asks, wherever they are, rather than checking first whether a particular law compels it.

10. Changes to this policy

The date at the top says when this last changed. A change that materially affects an existing account is sent to the email address on it, not merely posted here.