Privacy at Prepward

1. Who controls the data

For the website and learner service, the organisation responsible for the personal data described in this notice is Baroze Labs Ltd.

This notice covers the public website, the web learner experience, and the supported mobile application. A payment provider, app store, identity provider, or other third party may also process information under its own notice when you use its service.

2. Information we collect

Account and authentication

• your email address and learner account identifier;
• one-time-code challenge information, expiry, attempt, and abuse-prevention metadata; and
• verified Google identity information when you choose Google sign-in, limited to what is needed to authenticate the account.

Study profile and learning activity

• your intended exam date, selected daily study minutes, and time zone;
• diagnostic and practice attempts, responses, scores, rationales viewed, answer history, bookmarks, and question status;
• daily plans, task completion, progress, mastery, readiness, trends, and review schedules; and
• notes and flashcards that you choose to create in the study tools.

Access, payment and support

• verified access grants, product and store identifiers, transaction references, purchase dates, expiry dates, refund or chargeback events, and applicable promotion information;
• feedback category, message, optional question reference, feature, platform, route, and investigation status; and
• referral, beta, experiment, and privacy-safe learning events when the relevant feature is enabled.

Technical and device information

• IP address and request metadata used for sign-in rate limits, abuse prevention, security, and operational diagnosis;
• browser session-cookie data on the web; and
• mobile platform, push-notification token, app state, offline package, and queued answer information when you use those features and grant the relevant device permission.

We do not ask learners to provide patient health information and we do not intend the learner service to collect it. If you submit information by mistake, contact support promptly and do not include the sensitive material in your follow-up.

3. How we use information

We use the information above to:

• create and authenticate your account, send one-time codes, and maintain a secure session;
• build your diagnostic, daily study plan, practice queue, progress views, and review schedule;
• sync learning activity across supported web and mobile experiences and reconcile eligible offline answers;
• verify payments and store receipts, grant or revoke time-limited access, and prevent duplicate or fraudulent transactions;
• send optional study reminders when you enable them and register a supported device;
• respond to feedback, investigate unclear or potentially incorrect questions, and improve content quality;
• measure privacy-safe product usage, referrals, experiments, reliability, and security; and
• meet legal, accounting, security, fraud-prevention, dispute-resolution, and enforcement obligations.

Where UK GDPR or a similar law applies, the relevant basis may be performance of a contract, our legitimate interests in operating and securing the service, compliance with legal obligations, or your consent for optional features such as push reminders. We do not use learner answers to make decisions about employment, licensing, or access to healthcare.

4. Cookies and device storage

Web session cookie

The web learner experience uses a strictly necessary authentication cookie named prepward_session. In production it is issued as HttpOnly, Secure, and SameSite=Lax, and it is used to keep the authenticated learner session connected to the account. The application does not put the web bearer session token in localStorage. A legacy session-cookie name may be cleared during migration.

Sign-in and external services

When Google sign-in is enabled and you choose it, the page may load Google Identity Services. Google may set or read its own cookies and process information under Google's terms and privacy notice. We do not control those third-party cookies.

Mobile storage and notifications

The mobile app may use platform secure storage for the session token, an offline study package, and answers waiting to synchronise. If you grant notification permission, a device push token and platform are registered so that an enabled reminder can be delivered. You can turn reminders off in the app or in device settings.

The current core public pages do not use advertising cookies to deliver the study service. If we add non-essential analytics or marketing cookies, we will update this notice and provide the choices required by applicable law.

5. Sharing and service providers

We do not sell or rent learner personal information. We may share the minimum information needed with:

• transactional email providers for one-time sign-in codes and service messages;
• Google identity services when you choose Google sign-in;
• Stripe Checkout for enabled web payments and payment verification;
• Apple App Store, Google Play, and store-reconciliation services such as RevenueCat when mobile purchase verification is enabled;
• hosting, database, storage, backup, security, monitoring, and error-diagnosis providers that support the service; and
• professional advisers, regulators, law-enforcement bodies, courts, or a successor organisation where disclosure is required or legally permitted.

Providers may process data in countries different from where you live. They are expected to protect the information under their own agreements and applicable requirements. We disclose only what is reasonably needed for the stated purpose.

6. Retention and account deletion

We keep information for as long as it is needed to provide the account and study service, verify access, resolve support and payment issues, secure the platform, analyse permitted product events, and meet legal obligations. Short-lived sign-in challenges expire quickly; other categories have different retention periods.

You can request account deletion from Settings in the authenticated learner experience. When the request is accepted, learner access is disabled, the account is marked for deletion, and most personal account data is queued for purge within 30 days. The purge covers account-linked learning, profile, plan, device, usage, feedback, and access data held in the active system, subject to the operational process.

Some information may remain longer when it is needed for a payment dispute, fraud or security investigation, accounting or tax record, legal claim, regulatory obligation, or a protected backup and disaster-recovery cycle. Where retention is required, we limit access and use it only for that reason. Deleting the Prepward account does not delete records held independently by Stripe, an app store, Google, an email provider, or another third party; you must contact that provider under its own process.

7. Your choices and rights

Depending on where you live and the law that applies, you may have the right to:

• ask for a copy of personal information we hold about you;
• ask us to correct inaccurate or incomplete information;
• ask us to delete information, or restrict how it is used;
• object to processing based on legitimate interests;
• receive certain information in a portable format;
• withdraw consent for an optional feature, such as reminders, without affecting earlier lawful processing; and
• complain to the privacy regulator or supervisory authority in your country.

Send a request to privacy@barozelabs.com. We may need to verify that the request relates to you and may ask for clarification. We aim to respond within the period required by applicable law. You can also use in-app controls to turn off reminders, sign out, delete notes or flashcards, or request account deletion.

8. Security and international processing

We use reasonable technical and organisational safeguards appropriate to the service, including signed sessions, HttpOnly web cookies, request and CSRF protections, rate-limited one-time codes, server-side access verification, and platform secure storage for mobile session and offline data. No online service or transmission can be guaranteed to be completely secure.

The company is registered in England and Wales, while service providers may operate in the UK, European Economic Area, United States, Australia, or other locations. Where applicable, we use appropriate contractual or legal safeguards for international transfers and provide information about relevant safeguards on request.

Children

Prepward is designed for learners preparing for a professional nursing examination and is not directed to children. If you believe a child has provided personal information, contact us at privacy@barozelabs.com so we can review and remove it where appropriate.

9. Changes and contact

We may update this notice when our features, providers, security practices, or legal obligations change. The updated date at the top of this page shows the current version. If a change is material, we will take reasonable steps to highlight it.

For privacy, data-access, correction, objection, or deletion requests, email privacy@barozelabs.com. For account or payment support, email support@barozelabs.com. Please do not send passwords, one-time codes, payment-card details, or patient information.

Prepward is an independent educational tool. It is not affiliated with or endorsed by the NCLEX, NCSBN, or a licensing authority.