Privacy, in plain English

Last updated: 7 October 2026

This policy covers the MarvelPrep app on iPhone, iPad and Android, and this website. The short version: we collect what the app needs to work, we never sell your data, there are no ads or ad trackers, and you can delete your account from inside the app at any time.

At a glance

No ads, no selling. We never sell your data or use it for advertising. The app has no advertising or analytics trackers.
No outside AI. Your answers are marked on our own servers. We don't send them to any AI company.
Your journal stays private. We don't save anything you type in the Calm Center journal or worry dump.
Delete any time. In the app, go to Settings, then Delete account. Your account closes straight away and is permanently deleted after 30 days.
Age 13 and up. If you're under 16, you need a parent or guardian's permission.

Who we are

MarvelPrep is run by Marvel Prep, LLC, which is responsible for your personal data under this policy (in data protection terms, the "controller").

Marvel Prep, LLC
1065 SW 8th St. PMB 5847
Miami, FL 33130
United States
info@marvelprep.com

Email us about anything in this policy and a founder will read it.

What the app collects

Your account: Your name, email address and password. We store the password only as a one-way hash, so nobody at MarvelPrep can read it.
Your studying: The courses you pick, your answers to practice questions (including what you type for written questions), your marks, flashcard reviews, XP, streaks, badges and progress.
Calm Center: Which breathing or calming exercise you completed, and when. We don't save anything you type in the journal or worry dump, and we never ask for a stress score.
Your subscription: Your plan, your free-trial and renewal status, and a purchase reference from Apple or Google. Apple or Google takes the payment. We never see your card details.
Parent links: If you create a link to share your progress with a parent, we store the link and the label you give it.
Your device: Device model, operating system, app version, IP address, and crash and error reports. If you allow notifications, a notification token so Apple or Google can deliver them.
Messages to us: Anything you send us by email.

What we don't collect: your location, contacts, photos, camera, microphone or advertising ID. We don't track what you do in other companies' apps or websites.

How we use it

UK and EU data protection law asks us to name a legal basis for each use, so we've included it.

Running the app: Your account, marking your answers, and tracking your progress and streaks.Legal basis: contract. We need this to provide the service you signed up for.
Subscriptions: Managing your plan and free trial.Legal basis: contract.
Safety and fixes: Keeping MarvelPrep secure, preventing misuse, and finding and fixing errors and crashes.Legal basis: legitimate interests in keeping the service safe and working.
Emails: Account emails, such as password reset codes, and study reminders. You can stop reminders at any time by emailing us.Legal basis: contract for account emails, legitimate interests for reminders.
Support: Answering your messages.Legal basis: legitimate interests, or contract if it's about your account.
Legal: Meeting our legal obligations and protecting our users.Legal basis: legal obligation, or legitimate interests.

We don't use your data for advertising, we don't sell it, and we don't build marketing profiles of students.

Marking and AI

Written answers are marked automatically on MarvelPrep's own servers, by checking them against the mark scheme for that question. The mark only affects your practice score and progress in the app.

We don't send your answers, or any other personal data, to an outside AI company. If we add a feature that would, we'll update this policy first, explain it in the app, and ask for your permission before any of your data is sent.

We share personal data only with the service providers below. They handle it for us, under contract, and only for the job we give them. They can't use it for their own purposes.

Laravel Cloud: Hosts our servers and database, where your account and study data is stored.
Square1: Our app developer. Builds and maintains the app and our servers, and accesses data only when it's needed to fix a problem.
Sentry: Receives error reports from our servers so we can fix bugs. Reports are set up to leave out passwords and the content of your answers.
Firebase Crashlytics (Google): Receives crash reports from the app: device model, operating system, app version and what went wrong.
Mailgun: Sends our emails, so it receives your email address, your name and the email itself.
RevenueCat: Keeps track of whether your subscription is active, using a purchase reference from Apple or Google and your MarvelPrep account ID.
Apple and Google: Run the app stores, take payment and deliver notifications, under their own privacy policies.

Parent links. Anyone with a parent link can see your name, your subjects, your progress and your streak. They never see your answers or anything from the Calm Center. Messaging apps such as WhatsApp may show your name in the link preview. You can switch a link off in the app at any time.

Schools. If your school is a MarvelPrep partner, we don't receive pupil data from the school, and the school can't see your account or progress.

Anything else. We'll disclose data if the law requires it, or to protect someone's safety. If MarvelPrep is ever sold or merged, your data would move to the new owner under the same promises, and we'd tell you first.

Where your data is stored

Our providers store data in the European Union, the UK or the United States. Sentry, Google, Mailgun and RevenueCat are based in the United States. When personal data from the UK or EU goes to a country without equivalent protection, we rely on the safeguards the law provides, such as the European Commission's standard contractual clauses, the UK addendum to them, or the EU-US Data Privacy Framework.

How long we keep it

Account, answers and progress: For as long as your account is open. When you delete your account, it closes straight away and everything is permanently deleted after 30 days.
Backups: 7 days, then overwritten.
Error and crash reports: Up to 90 days.
Server logs: Up to 30 days. These include IP addresses.
Security audit records: 12 months. These contain only an account number, never your name, email or answers.
Subscription records: Deleted with your account. Apple and Google keep their own records of your purchases.
Emails with us: Up to 2 years after our last message, unless you ask us to delete them sooner.

Deleting your account

In the app: go to Settings, tap Delete account, enter your password and confirm. Your account closes straight away: it's hidden and nobody can sign in to it. After 30 days it's permanently deleted, and this can't be undone.

Without the app: email info@marvelprep.com from the email address on your account, with the subject "Delete my account". We'll close the account and confirm by email, usually within a few days. It's then permanently deleted 30 days later, the same as deleting in the app. A parent or guardian can ask on a child's behalf the same way.

What's deleted: your name, email, password, courses, answers, marks, progress, XP, streaks, badges, flashcard history, Calm Center history, parent links and subscription records.

What we keep: backup copies until they're overwritten (up to 7 days after permanent deletion), and security audit records that contain only an account number (12 months). Neither includes your answers or study history. Apple and Google keep their own records of your purchases under their own privacy policies.

Your subscription: deleting your account doesn't cancel a subscription, so cancel it first. On iPhone or iPad, open Settings, tap your name, then Subscriptions. On Android, open the Google Play Store, tap your profile picture, then Payments and subscriptions, then Subscriptions.

Students and parents

MarvelPrep is for students aged 13 and over, and most of our students are under 18. We design for that:

If you're under 16, you need a parent or guardian's permission to use MarvelPrep.
No ads, no selling data and no marketing profiles.
No public profiles, and no messaging between students.
We follow the principles of the UK Age Appropriate Design Code (the Children's Code).

Parents and guardians can ask what we hold about their child, ask us to correct it, or ask us to delete the account. Email info@marvelprep.com. We'll check the request is genuine before acting on it, usually by confirming it with the email address on the account.

If we learn that a child under 13 has created an account, we'll delete it.

Your rights

You can ask us to:

give you a copy of your data
correct anything that's wrong
delete your data
stop or limit how we use it
withdraw any permission you've given

Email info@marvelprep.com and we'll reply within one month. These rights come from UK and EU data protection law (the GDPR), and we apply them to everyone. If you live in a US state with its own privacy law, such as California, you have similar rights. We don't sell or share personal data for advertising as those laws define it.

If you're unhappy with how we've handled your data, you can complain to your data protection authority, for example the ICO in the UK, the AEPD in Spain, the CNPD in Portugal or the CNIL in France. We'd be grateful for the chance to put it right first.

Keeping it safe

Data travels between the app and our servers encrypted (HTTPS). In our database, your name and email address are encrypted, and passwords are stored only as one-way hashes. Access to student data is limited to the people who need it to run and fix MarvelPrep. No system is perfect, so we also keep what we collect to a minimum. If a breach ever affected your data, we'd tell you and the authorities as the law requires.

This website

marvelprep.com is hosted by Vercel, which keeps short-lived technical logs, such as IP addresses and the pages requested, for security and to keep the site working.

The site loads its typefaces from Google Fonts, so your browser requests those files from Google, which receives your IP address to serve them.

The website sets no advertising cookies and runs no analytics trackers. If you email us, we keep the conversation so we can reply. If any of this changes, we'll update this page first and ask for consent where the law requires it.

Changes and contact

If we change this policy, the new version appears here with a new date. If a change matters for account holders, we'll tell you in the app or by email before it takes effect.

Questions? Email info@marvelprep.com, or write to Marvel Prep, LLC, 1065 SW 8th St. PMB 5847, Miami, FL 33130, United States.