Privacy Policy
Last updated: 4 August 2026
1. Who we are
PrepSparrow is operated by Mart van der Lugt, based in the Netherlands ("we", "us"). For privacy matters, contact us at privacy@prepsparrow.com. We act as the data controller for all personal data described in this policy.
2. Data we collect and why
We collect only what is necessary to provide the service. The legal bases below refer to Article 6 of the GDPR / AVG.
| Data | Purpose | Legal basis |
|---|---|---|
| Name, email address, profile picture (from Sign in with Apple) | Create and identify your account | Performance of contract (Art. 6(1)(b)) |
| Exam files you upload and the text extracted from them | Generate practice questions | Performance of contract (Art. 6(1)(b)) |
| An internal account identifier shared with RevenueCat (not your name or email) | Enforce plan limits and fulfil your subscription | Performance of contract + legal obligation (Art. 6(1)(b) and (c)) |
| Session tokens | Keep you securely signed in | Legitimate interest — security (Art. 6(1)(f)) |
We do not use your data for advertising, and we never sell it to third parties.
3. Third-party processors and international transfers
To operate PrepSparrow we share data with the following processors. All are located in the United States; data transfers are covered by Standard Contractual Clauses (SCCs) or the EU–US Data Privacy Framework adequacy decision where applicable.
- Apple Inc. — authentication (Sign in with Apple) and in-app payments
- RevenueCat Inc. — subscription and entitlement management
- Cloudflare Inc. — infrastructure, file storage (R2), and AI Gateway
- OpenAI LLC — AI-powered question generation, accessed via Cloudflare AI Gateway
4. How long we keep your data
- Account data (name, email, profile picture) is kept for as long as your account is active or until you request deletion.
- Exam files and extracted text are deleted when you remove the exam from the app.
- Session tokens expire automatically per our session configuration.
5. Your rights
You can delete your account and all associated data at any time from within the app: Account → Delete Account. This is the fastest way to exercise your right to erasure.
Under the GDPR / AVG you also have the right to: access the personal data we hold about you; have inaccurate data corrected; restrict or object to processing; and receive your data in a portable format. To exercise any of these rights, email privacy@prepsparrow.com. We will respond within 30 days.
If you believe we are handling your data unlawfully, you have the right to lodge a complaint with the Dutch supervisory authority: Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl).
6. Children
PrepSparrow is not directed at users under 16. If you are under 16, please obtain parental or guardian consent before using the service (Article 8 GDPR / AVG).
7. Changes to this policy
We may update this policy from time to time. Material changes will be communicated via the app or email. Continued use of PrepSparrow after the effective date constitutes acceptance of the updated policy.
8. Contact
Questions about this policy? privacy@prepsparrow.com