Privacy Policy

Last updated: 16 October 2026

NavIsh Prep is a practice and assessment app for families. A parent or legal guardian holds the account and adds a child profile for each child who practices. This policy explains exactly what we store, why, who else processes it, and how to delete it.

What we collect

From the parent

• Email address — used to sign in and to send the diagnostic report after a practice session.
• Password — handled by our authentication provider, Supabase. We never see or store it.
• State — chosen from a list when you pick a test, so we can serve the standards your state uses. Not an address, and not a location: the fifty-two entries in that list are the whole of what we know.
• Subscription status — whether a subscription is active, and when it last changed.

About the child

• First name (or nickname) and grade level, plus the profile icon chosen. The name is only shown back to your family and used in the report.
• Practice activity — which questions were answered, the option chosen, whether it was correct, the concept behind a wrong answer, how long each question took, idle time before the first tap, hints requested, and whether a question was left unanswered. This is what produces the diagnostic report.

We do not ask children for an email address, phone number, photograph, precise location, or any other contact information, and there is no way for a child to enter free text that reaches us. Only a parent can create an account, add a child, reach account settings or make a purchase; those actions sit behind a parental check.

If you joined the waitlist

If you gave us your email address on navishprep.com to be told when the app launches, we store that address and the date you gave it, and nothing else. No name, no tracking pixel in the message, and it is never sold, rented or shared. We use it once: to tell you the app is available. Write to privacy@navishprep.com and we will delete it the same day, and we keep it no longer than twelve months if we have not launched by then.

Technical

• IP address — used transiently to limit automated abuse of question generation. It is not stored alongside your account or used to build a profile.

What we do not do

• No advertising, and no advertising or tracking SDKs in the app.
• No analytics or behavioral profiling products.
• We do not sell or rent personal information, and we never have.
• We do not use your family's data to train AI models.

Authentication

Sign-in is handled by Supabase Auth. Your password is stored by Supabase in hashed form; it never reaches our servers. A signed token identifies you to our API, which verifies it cryptographically on every request. You can reset your password by email at any time from the sign-in screen.

Payments

Subscriptions are sold through Apple's In-App Purchase and managed with RevenueCat. Payment is handled entirely by Apple: card numbers and billing details go to Apple, not to us, and we never see or store them. RevenueCat tells our server when a subscription starts, renews, or ends, so we know whether your account is active. Cancel or manage a subscription in Settings → Apple ID → Subscriptions. Deleting your NavIsh Prep account does not cancel an App Store subscription — cancel it with Apple as well.

Who else processes data for us

• Supabase — authentication and the database holding accounts, child profiles and practice history.
• Render — hosts our API.
• RevenueCat and Apple — subscription purchases and status.
• Resend — delivers the diagnostic report email to the parent.

These providers process data on our instructions to run the service. Each of them is a processor, which is a narrower thing than a third party: they act on our instructions, for our purposes, and none of them may use what they hold for their own. We disclose nothing to anyone for their own purposes — not to advertisers, not to data brokers, not to schools or districts, and not to anyone who would build a profile. Because there are no such disclosures, there is nothing for a parent to be asked to consent to separately; if that ever changes we would ask first, and the honest version of asking is a question you can answer no to. We do not share personal information with anyone else, except where the law requires it.

How long we keep it

Written as a schedule rather than as “while your account exists”, because an open-ended answer is not a retention policy and a child’s practice history is not something to keep by default.

• Practice history and reports — 24 months after the last sitting, then deleted. Long enough to show a year-on-year picture; not indefinite.
• Child profiles (first name, grade) — for as long as the parent keeps the profile, and removed immediately when they remove it.
• Account details — until the account is deleted.
• Dormant accounts — if nobody signs in for 24 months we write to the parent, wait at least 30 days for a reply, and then delete the account and everything in it. A person reviews each one rather than a scheduler deleting it unattended, so no family loses their history to a timing error.
• Subscription records — kept for financial reconciliation after deletion, with the link to the account removed. They contain no name and no email.

Deleting your data

Open Parent Portal → Delete account in the app. This permanently removes your account, every child profile, and all practice history and reports. It happens immediately and cannot be undone. You can also write to us at customer-support@navishprep.com and we will do it for you.

Your rights

You can ask us for a copy of the personal information we hold about your family, to correct it, or to delete it. Parents may review or delete their child's information and refuse further collection, either in the app or by writing to us. Depending on where you live, you may have further rights under laws such as the GDPR or the CCPA; contact us and we will honor them.

Your rights under US state privacy laws

Several states give residents specific rights over personal information — among them the California Consumer Privacy Act as amended by the CPRA, the Texas Data Privacy and Security Act, the Virginia Consumer Data Protection Act, and the Minnesota Consumer Data Privacy Act. Three of those laws turn on practices we do not have, so the answers are short:

• We do not sell personal information, as any of those statutes define a sale, and we never have. There is no opt-out link here because there is nothing to opt out of.
• We do not share personal information for cross-context behavioral advertising, and we show no advertising of any kind.
• We do not use personal information for targeted advertising or profiling that produces legal or similarly significant effects.

Whatever state you live in, you may ask us to confirm what we hold about your family, give you a copy of it, correct it, or delete it — and a parent may do all of those on behalf of their child. Most of it you can do yourself, immediately, from the Parent Portal; for anything the app cannot do, write to us and we will respond within 45 days. We will not charge you for exercising these rights and will not treat you differently for doing so.

Children's privacy

The account is the parent's. A child's information is provided by the parent, limited to a first name and grade level, and used only to run practice sessions and produce the parent's report. We do not collect contact information from children, do not show them advertising, and do not allow them to share anything publicly. This is how we meet our obligations under the Children's Online Privacy Protection Act (COPPA).

Tracking

We do not track anyone, and that is a commitment rather than a legal minimum. There is no analytics service, no advertising network, no third-party tag and no cookie. The app talks to our own interface and to Supabase, which holds the account, and to nothing else. The iOS privacy manifest declares no tracking and no tracking domains, which is why the app never asks for tracking permission — there is nothing to ask about.

Fonts and images are served from our own servers for the same reason. A font that loads only when a child turns on the high-legibility setting is not a neutral request: it happens for some children and not others, and where it goes would say something about the child who made it.

An automated test runs against the app and fails the build if any screen contacts a host outside that list, sets a cookie, or loads a known analytics script. We would rather be stopped by a test than rely on remembering.

How we protect it

One named person is responsible for security here. We review what we collect and who processes it when anything changes and at least once a year, keep the number of people who can reach production data to the minimum, and delete what the schedule above says to delete. Access to the database requires an encrypted, certificate- verified connection, and every request to our interface is checked against a signed token so one family can never read another’s data.

Security

Traffic between the app and our API uses HTTPS, and our connection to the database is encrypted and certificate-verified. Every request is checked against your signed token, so one family can never read another's data.

Changes

If this policy changes we will update the date at the top of this page, and tell you in the app or by email when the change is significant.

Contact

Questions about privacy, or a request about your data: privacy@navishprep.com.

NavIsh Prep is an independent educational platform. FastBridge®, CogAT®, STAAR® and other standardized testing names are trademarks of their respective owners. These entities are not affiliated with, do not endorse, and are not associated with NavIsh Prep.