Privacy Policy & Google API Data Disclosures

Welcome to Preptrova ("we", "our", or "the Platform"). Preptrova is an advanced lesson planning and educational productivity application engineered specifically for teachers, educational specialists, and schools. We are steadfastly committed to preserving the privacy and security of educators and school data.

1. Information We Collect & Google User Data

We collect only the minimum necessary information required to authenticate educators, enable lesson planning workflows, and export curriculum documents:

A. Information Provided Through Google Sign-In (Google OAuth)

When you log in to Preptrova using Google Sign-In, we request authorization to access your primary profile information through standard Google OAuth 2.0 scopes:

• OpenID & Profile (`openid`, `profile`): Your public Google display name, preferred language, and avatar URL to personalize your educator dashboard.
• Email Address (`email`): Your verified Google account email address, used to securely identify your account, send transaction receipts, and authenticate access.

B. Google Workspace Integration Scopes (Google Slides & Google Docs)

When you choose to export a generated lesson plan or presentation to Google Slides or Google Docs, Preptrova requests permission under the following limited scope:

• Google Drive File Scope (`https://www.googleapis.com/auth/drive.file`): This permission is used strictly and exclusively to create and upload the specific presentation or document you commanded the app to export into your personal Google Drive account.
• Strict Limitation: Preptrova DOES NOT access, read, scan, index, modify, or delete any other files or folders in your Google Drive. We have zero visibility into your existing files.

C. Educational Content & Curriculum Data

• Lesson Plans & Resources: Lesson objectives, differentiated teaching tasks, teaching timelines, and curriculum standards saved in your private teacher workspace.
• Textbook Excerpts: Text snippets or reference materials you upload or input into the Smart Resource Bank for lesson generation.

D. Technical & Subscription Records

• Account status, subscription tier, and quota utilization logs to maintain fair usage.
• Aggregated browser telemetry (browser version, OS, IP address, device type) for server security, error diagnostics, and session management.

2. How We Use Google User Data & Information

Preptrova utilizes the data collected strictly for the following educational purposes:

1. Account Authentication & Security: To establish and maintain your secure teacher profile via Firebase Authentication.
2. Lesson Plan Generation: To feed educator-provided prompts and textbook summaries into our AI processing engines to generate comprehensive 3-tier differentiated lesson plans.
3. Direct Google Workspace Export: To transmit your generated presentation directly into your Google Slides or Docs account upon your explicit click on "Export to Google Slides" or "Export to Google Docs".
4. Cloud Synchronization: To store your saved lesson plans in Google Firebase Firestore so you can access them across desktop and mobile devices.
5. Customer Support: To respond directly to support tickets or data deletion inquiries initiated by the account holder.

3. Absolute Protections: Zero Sale, Zero Advertising & No AI Training

4. Third-Party Service Providers & Data Disclosures

To deliver our educational services, Preptrova integrates with a limited number of trusted, enterprise-grade cloud service providers. All third-party providers are contractually bound by strict data processing and confidentiality agreements:

• Google Cloud Platform & Firebase: Provides secure infrastructure, Firebase Authentication, and Firestore database hosting. All user data is encrypted in transit and at rest within Google's enterprise data centers.
• Google Generative AI (Gemini API): Used solely to process teacher-authored lesson prompts and curriculum requirements into structured lesson plans. Under Google's enterprise API terms, customer inputs and generated outputs are not logged or used to train Google's base foundation models.
• PayPal Inc.: Handles subscription transactions securely. Preptrova never collects, views, or stores full credit card numbers or financial account details on our servers; all payments are processed directly through PayPal's PCI-DSS Level 1 compliant gateway.

We do NOT share your Google user data, Drive files, or personal information with any external advertising networks, data brokers, or analytics aggregators.

5. Data Storage, Security & Encryption

Preptrova deploys enterprise-grade security controls to protect teacher and student privacy:

• Encryption in Transit: All data exchanged between your browser and Preptrova servers is encrypted using modern Transport Layer Security (TLS 1.3 / HTTPS).
• Encryption at Rest: All database records, user profiles, and lesson archives are encrypted at rest using AES-256 encryption hosted within Google Cloud Platform (Google Firebase Firestore).
• Access Control: Granular database security rules prevent unauthorized access; each teacher can only read, write, or query their own private lesson plans.

6. Cookies, Local Storage & Session Management

Preptrova uses minimal, strictly necessary cookies and local storage tokens to ensure platform security and provide a functional user experience:

• Essential Session Cookies (`connect.sid`): HttpOnly, Secure session cookies used to maintain your authenticated login session across requests.
• Client Local Storage: Used exclusively to remember your localized interface preferences (e.g., Arabic or English language selection, dark or light mode theme).
• No Tracking Cookies: We do not employ third-party tracking cookies, pixel tags, or cross-site tracking scripts.

7. Data Retention, User Rights & Account Deletion

You have complete authority over your personal and educational data at all times:

• Data Retention: We store your data only for as long as your account remains active. If you delete your account, all associated lesson plans, preferences, and personal identifiers are immediately and permanently erased from our operational database.
• In-App Asset Deletion: You can delete individual lesson plans, uploaded notes, or textbook materials at any moment via the trash icon in your Resource Bank.
• Complete Account Deletion Request: You may request complete, permanent removal of your account and all associated records by sending an email to our compliance lead at edutrack91@gmail.com or support@preptrova.com. Requests are fulfilled within 24 to 48 hours.
• Revoking Google Access: You can revoke Preptrova’s access to your Google Account at any time directly through Google’s security controls at: https://myaccount.google.com/permissions.

8. International Privacy Rights (GDPR & CCPA / CPRA Compliance)

Regardless of your geographic location, Preptrova extends fundamental privacy rights to all registered educators:

• Right to Know & Access: You can request a summary of the personal information and Google user data Preptrova holds about you.
• Right to Rectification: You can correct or update any inaccurate profile or curriculum information at any time.
• Right to Erasure ("Right to be Forgotten"): You have the right to request the permanent deletion of your account and all associated records.
• Right to Data Portability: You can export your lesson plans at any time to standard formats including Google Docs, Google Slides, Word (.docx), PowerPoint (.pptx), and PDF.
• Non-Discrimination: We will never deny services, charge different prices, or provide a different level of quality to users who exercise their privacy rights.

9. Children & Student Privacy (COPPA & FERPA Compliance)

Preptrova is an educator productivity tool intended exclusively for teachers, instructional staff, and school administrators. Preptrova does not knowingly collect personal information directly from children under the age of 13. When educators generate lesson materials, no identifiable student personal records are required or stored, supporting compliance with the Children’s Online Privacy Protection Act (COPPA) and the Family Educational Rights and Privacy Act (FERPA).

10. Summary Table of Google Scopes & Data Usage

11. Modifications to this Privacy Policy

We may update this Privacy Policy periodically to reflect enhancements in our application features, legal requirements, or Google API policy adjustments. When updates occur, we will revise the "Effective Date" at the top of this document and provide a prominent notice on our website homepage or via email. We encourage educators to review this policy periodically.

12. Operator Identity & Contact Information

If you have any questions, compliance requests, or inquiries regarding this Privacy Policy or our handling of Google User Data, please reach out to: