Privacy policy

AntiPreppy is a test-prep website for kids preparing for NYC admissions tests (SHSAT, Hunter, TACHS, ISEE, SSAT) and the SAT. Most of our players are under 13, so we built it the way the Children's Online Privacy Protection Act (COPPA) expects: a parent creates the account and controls everything, kids never give us an email address or a password, and there are no ads or tracking scripts anywhere on the site.

The short version

• We collect the least we can: a parent's email, each kid's first name, and what they do in the app.
• No ads. No third-party trackers. We don't sell or rent data, and we never will.
• A parent can see or delete everything about their kids, any time, and ask us to correct anything.
• Questions or a deletion request: [email protected] or (201) 430-5361.

What we collect

From parents. When you sign in with Google, we receive your email address and name from Google. You can also sign in with a one-time link we email you. We use your email to identify your family's account and to contact you about it. We don't receive your Google password or access your Google data. If you answered “How did you hear about AntiPreppy?” when setting up (we no longer ask), we keep that answer with your account, only to learn which places bring families.

Students 13 and older with their own account. A student signing up answers one question, their birth month and year, so we know whether a parent has to set them up. We don't store either. For 13 or older, only that answer stays, in a cookie on their device for two hours, so signing in can make their account; for under 13, nothing is kept. A student account holds the student's email, the first name they choose, and what they do in the app, used only to run their practice. No ads, nothing sold or shared, and the student can delete the account and everything in it from Me → Your account. A student can also share a read-only progress link with a parent: we keep that parent's email only to send the link, and the student can stop it any time. That parent can pay for the student's Family plan from the link: Stripe takes the payment and gets the parent's email for receipts, never anything about the student. A student under 13 can ask us to email a parent: we keep the parent's email (and the child's first name, if given) only to send that one email, and delete them after 14 days.

Test-prep centers. If a center asks us to tell it when AntiPreppy for Centers opens, we keep the center's name and the email it gives, only to send that note. Ask us and we'll remove it.

The waitlist. AntiPreppy is open to its first 50 families. If you sign in after they're taken, we keep only your email address, to send you one note now and one when a spot opens. Ask us and we'll remove it. (If you joined the earlier beta list, we kept your email and the tests you picked, for the same purpose.)

About kids, entered by a parent. A first name (a nickname is fine) and, if the parent chooses, which test the kid is preparing for. Kids never enter an email address, a last name, a photo, a school or a location.

What kids do in the app. The questions they answer, whether they got them right, how long they took, their coins, levels, pets and prize requests, and any “something looks wrong with this question” reports they send. This is what powers practice, score estimates and the parent reports.

Written responses. Some Hunter and SAT practice includes writing. When writing practice is available, a kid's essay is graded by an AI model (Anthropic's Claude) against a rubric, and the parent can read it and override the score. The AI provider receives the prompt and the essay text only (never a name or email) and does not use it to train its models. Writing practice is currently turned off.

Essays that raise a safety concern. Every essay is checked for content that needs an adult: strong language, threats, or a sign that a child may be hurting themselves or being hurt. Most flagged essays go to the parent to read. If an essay suggests a child may be harmed by someone at home, or it isn't clear who, it is not shown to the parent, because the parent could be the person involved. A member of the AntiPreppy team reads it instead and may contact child-protective services or emergency services. Our team reads flagged essays only to keep children safe, and every time an essay is opened it is logged.

Questions and tests kids write (Teach it back and the Test Maker). These features are rolling out to families on the Plus plan; before a kid can use them, we ask a parent to agree to this notice again.

• Teach it back: after answering 100 practice questions, a kid can write their own multiple-choice question (the question, the answers and why the right one is right). It's graded by an AI model (Anthropic's Claude), which receives the topic, the test, the kid's grade and the question, never a name or email. The kid sees a score and a tip; their parent sees the question and the score.
• The Test Maker: a parent, or a kid after 100 practice questions, can build a test. Before anyone outside the family can take it, it's checked by an AI model and, when the AI is unsure or something looks unsafe, by a member of our team. A test is shared only by a code or link the maker hands out: there's no search or browsing. A kid's test can be taken outside their family only if a parent switches that on.
• What we block: we refuse questions, tests and prizes that contain names, schools, addresses, phone numbers, emails, links or social media handles, and words that aren't allowed. The same safety checks as essays apply: anything that suggests a child may be unsafe goes to our team, and if it points at someone at home it isn't shown to the parent.
• What other families see: the test itself, and nothing about who made it. The maker sees only totals for takers outside their family (how many took it, average scores, which answers were picked), never their names; names show only for takers in the maker's own family. Kids can't comment on a test or message anyone. A taker can report a question; the maker sees how many people reported it, never what they wrote.
• Prizes: a test can offer coins from the maker's own coins (at most 100 to one taker, never inside the maker's family, and a parent can switch coin prizes off) or a prize the maker offers outside AntiPreppy. For that kind, the winner gets a claim code to show the maker in person, so no names or contact details pass between families through us. We don't deliver or guarantee those prizes.

Emails. Once email is switched on, we send parents sign-in links, Parent Zone PIN resets, progress emails (a daily summary, one after each session, or none: you choose in Settings), trophy notes and, if an essay needs you, a note to read it. These include your kid's first name. Kids never get email. Our records of emails sent keep a scrambled form (a hash) of the address, not the address itself.

Device information. We set a cookie that remembers that a browser belongs to your family (so kids can play without signing in each time), cookies that keep parents signed in, and a setting for light or dark mode. Our hosting and network providers keep standard server logs (IP address, browser type, pages requested) for security and troubleshooting.

What we don't do

• We don't show ads, and there are no advertising, analytics or social-media scripts on the site.
• We don't sell, rent or trade personal information.
• We don't let kids chat with anyone, comment, post anything publicly, or contact other users. A test a kid makes reaches other families only by a code, only after it's been checked, only if a parent allows it, and never with the kid's name.
• We don't ask kids for more information in exchange for rewards.

How we use it

To run the practice itself (choosing the next question, estimating scores, keeping streaks and rewards), to show parents their kids' progress, to answer support requests, to keep the service secure, and to fix questions kids report as wrong. We use aggregate, non-identifying numbers (for example, how many sessions ran this week) to decide what to build.

Who else handles it

We use a few service providers, each only to run AntiPreppy and under their own privacy and security commitments:

• Fly.io hosts the website and its database in the United States.
• Google provides sign-in for parents.
• Cloudflare provides our domain's DNS, and site traffic passes through its network (it protects the site and shows a notice if we're down).
• Backblaze stores backups of the database, in a private storage bucket in the United States.
• Resend delivers our emails to parents (the address and the email's contents).
• Anthropic grades written responses when writing practice is on (prompt and essay text only, not used for training), and grades and checks the questions and tests kids and parents write (their text, the topic, the test and a kid's grade; no names; not used for training).
• Stripe will process payments when paid plans start on January 1, 2027. We never see or store card numbers.

We may disclose information if the law requires it, or to protect the safety of a child or the security of the service.

Parental consent

Before a parent adds a kid, we ask them to confirm they're the kid's parent or legal guardian and to agree to this notice. We then email them a copy right away, and a second email a day later so that anyone who didn't agree (for example, a kid using a parent's email on a shared computer) can withdraw. If this notice changes in a way that affects kids' information, we ask again.

Parents' rights and choices

A parent can, at any time:

• see their kids' activity and reports in the Parent Zone;
• delete a kid and all of their activity (Parent Zone → Kids → ⋯ → Delete), or ask us to correct a kid's name;
• ask for a copy of their family's data, or for the whole family account to be deleted, by emailing [email protected] from the account's email address (we do these by hand and confirm when it's done);
• withdraw consent (Parent Zone → Settings → Withdraw consent), which stops all collection and deletes every kid in the family, or stop collection for one kid by deleting them.

We'll respond within 30 days. Deleted data is removed from the live service right away. Copies in our backups are deleted as those backups expire.

How long we keep it

For as long as the family account is open. Questions and tests a kid wrote are deleted with the kid, including their text in the history of anyone who took the test. If a family cancels a paid plan, we keep the account for 12 months so it can be reopened, then delete it unless the parent asks us to keep it. A parent can ask for deletion sooner at any time.

One exception: if an essay raised a concern about a child's safety, our record of that safety case (including the essay) and our log of what our team did are kept even after the kid or the family is deleted, so a child-protection report can be followed up. A safety case is deleted three years after it's closed.

Security

Connections are encrypted (HTTPS). Kid pages only work on a device the family has set up: one a parent signed in on, or one a kid joined with a code or a link from a parent. Parent pages require the parent's sign-in, and a kid's device can never open the Parent Zone. Access to the database is limited to the people who run AntiPreppy, and every support change is logged.

Changes

If we change what we collect or how we use it, we'll update this page and its date, and for anything significant we'll email parents before it takes effect.

Contact

AntiPreppy, 248-25 Northern Blvd, Suite 1-J PMB 2028, Little Neck, NY 11362 · [email protected] · (201) 430-5361. See also our terms of service.