Your learning is personal.
We treat it that way.

This policy explains how DDStepUp handles information when you visit the public website, create an account, complete a diagnostic or workout, or use an authorized content-administration feature.

It covers the DDStepUp website and API. Services operated by X, Google, Facebook, Supabase, or other providers have their own privacy terms.

Account information. When you use email sign-in, Supabase Auth processes your email address and password credentials. DDStepUp does not store your plaintext password in its business database. When a social sign-in method is enabled, that provider may supply an identifier, email address, and basic profile information according to the permissions shown during sign-in.

Learning information. We store assigned questions and their frozen versions, selected answers, response times, task progress, results, recommended focus, presentation history, and timestamps. This lets a saved task resume consistently and supports the feedback shown to you.

Discussion information. If you comment, like a comment, save a question, or follow another learner, we store that activity with a public display name, handle, and optional bio. Other learners who have also finished that question can read the comment. Your email, scores, diagnostic results, response times, and whether an answer was correct stay private and are not shown on your profile.

Information kept on your device. Theme preference, active session references, and the optional target-score and test-date note use browser storage. The target note currently stays in that browser and does not change training recommendations.

Technical information. Our infrastructure may process IP address, browser or device information, request paths, timestamps, and error details to deliver, secure, and troubleshoot the service. OAuth callback query strings are excluded from the production Nginx access log.

Authorized content operations. Administrators may upload source images and create or review question drafts. Successful imports, provenance, review events, and operational AI-call status may be stored for audit and content production.

We use information from an enabled X, Google, or Facebook sign-in only to authenticate you and associate that identity with a DDStepUp account. The current integrations do not request permission to post for you, read posts or friend/following lists, or use social-provider data for advertising.

DDStepUp’s callback transfers only the resulting Supabase access and refresh tokens into the application session. Provider access tokens are not persisted by the DDStepUp application.

If a provider returns the same verified email as an existing Supabase account, Supabase may automatically link the identities and preserve the existing account UUID. A different or unavailable email may result in a separate account.

You can revoke DDStepUp’s access from your social-provider account settings. Revocation may stop that sign-in method, but it does not automatically delete learning records already stored by DDStepUp. Signed-in users can delete the DDStepUp account from the Account page.

• Authenticate accounts and keep learning progress recoverable.
• Deliver diagnostics, targeted workouts, explanations, transfer checks, and learning records.
• Prevent accidental question repetition and preserve the integrity of unseen checks.
• Protect the service, investigate failures, enforce access controls, and maintain audit records.
• Operate authorized content-review and question-production workflows.
• Meet legal obligations and respond to valid requests.

We do not currently run third-party advertising or product-analytics trackers. Student answers are not sent to a generative-AI provider in the current product.

We use service providers where needed to run DDStepUp. They may process information for us under their own contractual and security obligations:

• Supabase for authentication and the PostgreSQL data service.
• X when you choose X sign-in.
• Google or Facebook when you choose an enabled sign-in method from either provider.
• Hosting, network, and email providers for delivery, security, and account messages.
• An AI-processing provider for authorized Admin content-production tools. Current student answers and learning records are outside those calls.
• Paddle as the intended merchant of record for paid subscriptions, subject to product eligibility and account approval. Paid checkout is not live yet.

Comments, likes, saved-question lists, and follow lists are visible to other signed-in learners only to the extent described above. A learner who has not finished a question cannot read its comment text from your profile. We do not sell personal information. We may disclose information when required by law, to protect users or the service, during a business reorganization, or with your direction.

Paid subscriptions are planned but are not currently active. Paddle is the intended merchant of record, but it has not yet confirmed product eligibility or approved the account. If Paddle is activated, it will process payment and billing information under its own privacy notice and buyer terms.

If Paddle is activated, DDStepUp may send it the information needed to create and manage a transaction, such as an account reference, email address, selected subscription plan, and entitlement information. Paddle may return customer, transaction, subscription, payment-status, tax, refund, and dispute information so DDStepUp can provide paid access, billing support, fraud prevention, and required records.

DDStepUp will not receive or store a complete payment-card number. This section will be reverified against the implemented checkout and data flow before paid subscriptions are activated.

Account and learning records are retained while needed to provide recoverable progress, maintain content and security integrity, resolve disputes, or meet legal obligations. Operational logs and backups may remain for a limited period after the primary record changes.

If paid subscriptions launch, an account that finishes a free trial without becoming paid, or whose paid access ends, may continue to receive whatever free features DDStepUp makes available at that time. Free access is not guaranteed. DDStepUp may retain the former trial or subscription account and its associated learning data for a grace period of at least 90 days after trial or paid access ends.

After that grace period, an inactive account may be deactivated or deleted, and its associated learning data may be deleted or anonymized at any time. DDStepUp may not send a separate email or other individual notice before doing so. Users should not rely on DDStepUp as permanent storage for learning records, and deleted data may not be recoverable.

Signed-in users can permanently delete their account from the Account page. This removes the Supabase Auth identity, saved diagnostic and workout sessions and answers, saved questions, follows, comment likes, uploaded Admin source images and their import records, and actor-linked AI-operation records. Comments you wrote may remain so the thread stays readable, with the author shown as “Deleted learner.” Shared question-production records may remain with the actor identifier anonymized so published or reviewed product content is not destroyed.

A pseudonymous account UUID security marker blocks already-issued access tokens for up to 24 hours and is removed by later authenticated API traffic after it expires. Transaction, security, fraud-prevention, dispute, tax, audit, operational-log, and backup records may remain for a limited period or where law or legitimate security and audit needs require it.

• Use the public homepage and example without creating an account.
• Choose an available sign-in method and revoke a social connection with its provider.
• Clear local browser storage to remove device-only preferences and notes.
• Permanently delete your account and saved learning record from the signed-in Account page.
• Ask for access, correction, deletion, or an explanation of your information.
• Exercise additional privacy rights available in your region.

To make a privacy request, email privacy@ddstepup.com. We may need to verify that the request concerns your account before acting on it.

DDStepUp uses encrypted network connections, signed authentication tokens, restricted database roles, row-level security, and server-side ownership checks. Administrative access uses a separate UUID allowlist. No security measure can eliminate every risk, so keep your sign-in methods secure and contact us if you suspect unauthorized access.

DDStepUp is designed for people preparing for law-school admission tests and is not directed to children under 13. If local law requires parental permission for a younger user, that permission is required. Contact us if you believe a child provided personal information without appropriate consent.

DDStepUp and its service providers may process information in countries other than the one where you live. Privacy laws and government-access rules may differ. We use service providers and safeguards appropriate to the operation of the service and applicable obligations.

We may update this policy when the product, providers, or legal requirements change. We will revise the effective date and provide additional notice when a change materially affects how we handle personal information.

Privacy questions or requests: privacy@ddstepup.com. Product and account support: support@ddstepup.com. You can also read the Terms of Service and Refund Policy.