Privacy Policy

Effective: June 12, 2026

Prepify is operated by Aptivo Ltd, trading as Prepify (“we”, “us”), a JAMB exam preparation app for Nigerian students. This policy explains what data we collect, why, and your rights under the Nigeria Data Protection Regulation (NDPR) and Nigeria Data Protection Act 2023.

1. Who is responsible for your data

The data controller is Aptivo Ltd, a company registered in Nigeria, trading as “Prepify”. For any privacy request or question, contact privacy@prepify.ng

2. What we collect

• Account data — email address and password (stored hashed), collected when you create an account. Legal basis: consent.
• Profile data — a username you choose and your Nigerian state, used for leaderboards. Legal basis: consent.
• Study data — XP, coins, streaks, session history, questions you answered incorrectly, and your exam date if you set one. Used to run the app's learning features (spaced repetition, score prediction, leaderboards). Legal basis: contract (providing the service you signed up for).
• Push notification subscription — only if you explicitly opt in to reminders. You can turn this off any time in Settings. Legal basis: consent.
• Anonymous usage analytics — basic product events (e.g. “session completed”) with no advertising identifiers, no session recordings, and no autocapture. Used solely to improve the app.

We do not collect your real name, phone number, precise location, photos, or contacts. We never sell your data and never use it for advertising.

3. Students and minors

Prepify is designed for JAMB candidates, who are typically 15+ years old. You must be 13 or older to use the app, or have a parent or guardian's permission. We do not use minors' data for profiling beyond the app's own study features, for advertising, or share it with third parties for their own purposes.

4. Where your data lives

• Supabase (database & authentication) — data hosted in their cloud infrastructure, protected under GDPR-grade safeguards.
• Google Cloud (Vertex AI) — when you tap “Ask AI Tutor”, the question text is sent to Google's AI service to generate an explanation. No account identifiers accompany it.

5. How long we keep it

Your data is kept while your account is active. Accounts inactive for 2 years are purged. You can delete everything immediately at any time (see below).

6. Your rights

• Erasure — delete your account and all data instantly from Profile → Settings → Privacy & data → Delete account. Deletion is immediate and permanent.
• Access & rectification — your profile data is visible and editable in the app; for a full export, email us.
• Withdraw consent — turn off notifications in Settings; stop using the app and delete your account to withdraw all processing.
• Complain — you may lodge a complaint with the Nigeria Data Protection Commission (NDPC).

We respond to all requests within 30 days as the NDPR requires.

7. Notifications

Push reminders are strictly opt-in, capped at one per day, and silent between 11 PM and 7 AM. Disable them any time in Settings → Notifications, or via your browser/device settings.

8. Security & breaches

Data is encrypted in transit (TLS) and at rest. Access is protected by row-level security so each student can only read and write their own records. If a breach affecting your personal data occurs, we will notify the NDPC within 72 hours and affected users within 7 days.

9. Changes

If this policy changes materially, we will show a notice in the app before the change takes effect. The effective date above always reflects the current version.