Legal

Privacy Policy

Last updated: 8 November 2026

This Privacy Policy explains what personal data is processed when you use the Preppy app and the Preppy website, why it is processed, where it is stored, who receives it, and what rights you have. It applies to Preppy 3.0 and later, worldwide, wherever you use Preppy, and contains additional sections for users in specific countries and regions.

Preppy is a deeply personal app. It holds information about your HIV status, your medication, your test results, your sex life and the people you have sex with. We take that seriously, and we have written this policy to be specific rather than vague. If anything here is unclear, write to hello@preppy.health and we will answer.

With version 3.0, Preppy changed how it stores data. Everything you enter now lives on your device, and Preppy no longer needs an account. Backing up and syncing your data is optional. If you used Preppy 2, Section 8 explains what happened to your data during the update.

1. The Short Version

Before the detail, the essentials:

  • Preppy is not a medical device and does not replace a doctor. See Section 3.
  • Preppy works without an account. Everything you enter is stored on your device, and the app works fully offline. See Section 5.
  • Backup & Sync is optional and off by default. Only if you turn it on and give your explicit consent is your data stored in the cloud, with Supabase in Frankfurt, Germany. It is protected per account, but it is not end-to-end encrypted. See Section 7.
  • We do not sell your personal data. We never have and we will not.
  • We do not run advertising, retargeting, ad profiles or cross-app tracking, and we are not part of any advertising network.
  • We do not use your personal data to train AI models, and we do not send your content to AI providers.
  • Your health and sex data is never used for marketing.
  • Preppy no longer analyzes your entries centrally. The use of aggregated data for research, described in earlier versions of this policy, has ended. See Section 8.5.
  • If you used Preppy 2, the update brought your data from Google Firebase to your device once. The update does not delete the old copy at Firebase: it stays in the EU until we shut Firebase down, and you can ask us to delete it sooner. See Section 8.
  • The servers that hold app data (Backup & Sync, feedback, usage statistics and lesson content) are located in the European Union. See Section 13.
  • To see which features help, Preppy counts on your device how it is used and sends only anonymous daily totals to our server in Frankfurt: no identifier, no account, no content and nothing about which medication you take. You can turn this off in the settings under "Help Improve Preppy". Preppy no longer uses TelemetryDeck. See Section 9.17.
  • The app has a built-in lock (Face ID, Touch ID or passcode), and discreet lock screen texts so reminders on your lock screen do not give you away.
  • We process as little data as possible, and only for as long as necessary.

2. Controller and Contact

2.1 Controller

The controller responsible for the processing described here under the EU General Data Protection Regulation (GDPR) and equivalent laws is:

Kevin Waltz, Wiltbergstraße 50, 13125 Berlin, Germany. Email: hello@preppy.health

Further mandatory information is available in our Legal Notice.

2.2 Data Protection Officer

We are not legally required to appoint a Data Protection Officer under Art. 37 GDPR for the current scope of our processing. For all privacy matters, please contact hello@preppy.health directly.

2.3 EU / UK Representative

The controller is established in Germany, in the European Union, so no Art. 27 GDPR representative is required. For users in the United Kingdom, we can be reached at the address above.

3. Important Medical Notice

This section is central to understanding what Preppy is, and what it is not. Please read it carefully.

3.1 Preppy Is Not a Medical Device

Preppy is not a medical device, in-vitro diagnostic device, medical product or healthcare service within the meaning of Regulation (EU) 2017/745 (MDR), the German Medical Devices Implementation Act (MPDG), the UK Medical Devices Regulations 2002, the US Federal Food, Drug, and Cosmetic Act, or comparable legislation in other countries.

Preppy is not intended by its manufacturer for any medical purpose within the meaning of Art. 2(1) MDR. It is not intended for the diagnosis, prevention, monitoring, prediction, prognosis, treatment or alleviation of any disease, injury or disability. It is a personal self-tracking and organization tool: a place to record what you already know about yourself.

3.2 No Medical Advice, Diagnosis or Treatment Recommendation

Nothing in Preppy constitutes medical advice, a diagnosis, a prescription or a treatment recommendation. This includes, without limitation:

  • intake reminders, adherence streaks and pill supply counts for PrEP, ART or DoxyPEP,
  • the calculation and display of protection windows, intake schemes and DoxyPEP time windows,
  • the labelling of a logged activity as “risky” or of a partner as “trusted”,
  • check-up reminders, test result overviews and lab values such as CD4 count and viral load,
  • hints about when a test could make sense, shown with your symptoms,
  • the vaccination record and its dose schedules,
  • wellbeing check-ins and their trends,
  • the lessons in Learn and the lessons recommended next to your entries,
  • statistics, calendars, charts and summaries of any kind.

These are conveniences for organizing information you have entered yourself, or general information. They are calculated from your own inputs and are only as accurate as those inputs. They are not a clinical assessment.

3.3 Preppy Does Not Protect You

Preppy does not protect against HIV, other sexually transmitted infections, or pregnancy. Only correct use of PrEP, condoms, treatment and regular testing does. Logging a pill in the app does not mean you have taken it, and marking an activity as protected does not make it so.

3.4 Always Consult a Healthcare Professional

Always consult a qualified doctor, clinic, sexual health service or pharmacist regarding starting, changing, pausing or stopping PrEP, ART or DoxyPEP, regarding your HIV or STI status, regarding test results, side effects, kidney or liver values, and regarding any other health concern. Never delay seeking professional advice, and never disregard advice you have received, because of something displayed in Preppy.

3.5 Emergencies and PEP

Preppy is not suitable for emergencies and does not monitor you. In a medical emergency, contact emergency services immediately (112 in the European Union, 911 in the United States, 999 in the United Kingdom, or your local emergency number).

If you think you may have been exposed to HIV, post-exposure prophylaxis (PEP) is time-critical and must be started as soon as possible, ideally within a few hours and no later than 72 hours after exposure. Go directly to an emergency department, HIV clinic or sexual health service. Do not use Preppy to decide whether you need PEP.

3.6 No Liability for Health Decisions

Kevin Waltz accepts no liability for health decisions made on the basis of data tracked in, or information displayed by, Preppy. Use of the app is at your own risk. Statutory liability, in particular for injury to life, body or health and for intent and gross negligence, remains unaffected.

3.7 Why This Matters for Your Privacy

Because Preppy is not a healthcare service and we are not your healthcare providers, we cannot rely on the legal bases that hospitals, doctors and clinics rely on when they process health data. We are also not bound by medical confidentiality in the way a physician is. Instead, your health and sex data is processed on the basis of your explicit consent, which you can withdraw at any time. Section 10.1 explains this in detail. In practical terms, it means the decision to put a piece of health information into Preppy, and the decision to store it in the cloud, is always yours, and always reversible. Unless you turn on Backup & Sync, that information never reaches us at all.

4. What Data We Process

Depending on how you use Preppy, the following categories of personal data are processed. Unless you use Backup & Sync, almost all of it stays on your device and never reaches us. Section 5 explains where each kind of data lives.

4.1 Profile and Account Data

  • Your profile, stored on your device: optionally a display name and a profile picture, both of which you choose and can leave empty, the date you started using Preppy, your region and language code (used to format dates and select content), and your settings in the app
  • Only if you use Backup & Sync: a random account identifier generated by Supabase, and your sign-in method (Sign in with Apple, or email and password)
  • With an email account: your email address, and your password, which is stored only as a hash. We never see the password in plain text.
  • With Sign in with Apple: an identifier for your account from Apple. Preppy asks Apple for neither your name nor your email address, so we receive neither. We also store a token from Apple, so that Preppy's access to your Apple ID can be revoked later (Section 7.3).
  • The language of your app, stored with your account, so that sign-in emails reach you in your language
  • A record of your consent to Backup & Sync: the version of the consent text, when you gave it, and the platform and app version
  • A list of the devices that sync with your account: a random identifier for each installation, the kind of device (iPhone, iPad or Mac), the app version and when the device last synced
  • If your data came from Preppy 2: the identifier of your old Preppy 2 account at Firebase, so that we can find the old copy for a deletion request, for support and for the shutdown of Firebase (Section 8)

4.2 Health Data (Special Category Data)

  • Your HIV status (negative, positive, positive and undetectable, or unknown)
  • Whether you take PrEP, and under which scheme (daily or event-based / 2-1-1)
  • Whether you take antiretroviral therapy (ART)
  • Whether you use DoxyPEP
  • Every individual intake you log, with its exact date and time and the medication type
  • Your intake start and end dates, extensions and pauses
  • Your preferred daily intake time
  • Your pill supply: the refills you log, with their amount, and how many pills were left before
  • Check-ups and appointments: date, free-text notes, the place, and the appointment type, which may itself be revealing, since the available types include STI screening, PrEP, ART and DoxyPEP follow-ups, general practice, vaccination, dermatology, urology, proctology and mental health
  • Test results: for HIV, syphilis, chlamydia, gonorrhea, trichomoniasis, hepatitis A, B, C and AB, herpes simplex 1 and 2, HPV, mpox, mycoplasma, ureaplasma, kidney values, and any custom test you add yourself, each recorded as positive, negative or pending, and lab values for CD4 count and viral load
  • Symptoms: which symptom, how severe, when it started and ended, the body areas, notes, the activities and partners you link to it, and whether you think it is a side effect of PrEP, ART or DoxyPEP
  • Wellbeing: check-ins with how you feel, the feelings you pick, what they relate to, an optional note and, if you choose, the activity they belong to
  • Vaccinations: the vaccine, date, dose number, whether it was a booster, the schedule, product name, lot number, who gave it, the place, a linked appointment and notes, and vaccines you add yourself

4.3 Sex Life Data (Special Category Data)

  • Logged activities with partners, with start and end time and duration
  • The number of partners involved, which saved partners were linked, and the details you record for each partner in that activity
  • Whether protection was used
  • Kissing, the type of penetration (for example anal, vaginal, oral) and sexual positions
  • The number of orgasms
  • A personal rating
  • Free-text notes
  • Tags and kinks you add to an activity or a partner, substance use you add to an activity, and terms you create yourself
  • Solo activity entries
  • Whether an activity was classified as risky behaviour, derived from the above
  • Whether you chose to save an activity to Apple Health

4.4 Data About Other People (Partners)

For each partner you save, whatever subset of the following you choose to enter:

  • A name, or an anonymous placeholder if you use anonymous mode
  • Age, gender, trans status, pronouns, ethnicity, body type, sexual position
  • Anatomical details, including penis size and circumcision status
  • The partner's HIV status and vaccinations, as known or assumed by you
  • Tags, kinks, a rating and free-text notes
  • A profile photo and a photo gallery
  • Contact details and social media handles: phone number, Instagram, Snapchat, X/Twitter, Grindr, Romeo, OnlyFans, and a free-form handle
  • Whether the partner is archived, and whether the partner is marked as trusted

Section 11 deals specifically with this category, because it is data about people other than you.

4.5 Location Data

  • Places you save and attach to activities, check-ups or vaccinations: a title, a city and country line, exact latitude and longitude coordinates, and, where Apple provides one, a stable Apple Maps point-of-interest identifier
  • The position of your device while you use a map or add a place, if and only if you grant location permission

Location data attached to an activity is, in combination, sensitive: it records where you had sex and when.

4.6 Images

  • Your profile picture
  • Partner profile pictures and gallery images

4.7 Learning Progress

  • Which lessons and sections in Learn you went through, and when
  • Your answers to the questions in a lesson

On its own this is not health data, but the topics you read about may say something about your health.

4.8 Technical and Usage Data

  • App version, operating system version, device type, device model and language
  • Anonymous usage counts, described in Section 9.17
  • Error and diagnostic information generated when something goes wrong
  • Technical connection data, such as your IP address, when the app loads lessons, sends feedback or syncs, and server-side logs of the infrastructure providers we use

4.9 Communication Data

  • The content of feedback and support messages you send from the app, together with their type, app version, operating system version, device model and a debug flag, and, if your feedback is about a lesson, which lesson it was
  • Our replies, and the read status of those replies
  • The sign-in, confirmation, password reset and email change emails we send you for Backup & Sync
  • The content of any email you send us, and your email address

4.10 Device-Local Settings

Some preferences never leave your device, even with Backup & Sync, or are only shared between the app and its widgets on the same device. These include your chosen app icon, tab bar arrangement, app lock settings, notification schedules and lock screen text style, the identifiers of calendar events Preppy created, and cached widget snapshots.

Nothing you enter in Preppy is mandatory. Your name, your photo, every health field, every partner field, every location, every note: all of it is optional, and Preppy works if you leave all of it empty. Fields you do not fill in are not stored. Only Backup & Sync needs your sign-in details to work.

5. Where Your Data Lives

5.1 On Your Device

Preppy is built to work locally. Everything you enter is stored in a database on your device, in a container that only Preppy and its own widgets and extensions can read. Your photos are stored in the app's private container. The app works fully offline, and without Backup & Sync it never sends your entries anywhere. Other apps on your device cannot access any of this.

New users do not create an account. Preppy 3.0 no longer creates anonymous accounts either: the anonymous sign-in that Preppy 2 used has been removed.

Your device's own backups, such as iCloud Backup or a backup on your Mac or another computer, include Preppy's database; only the cached lessons are left out. These backups are not made or run by us: they are under your control and subject to Apple's terms and privacy policy.

5.2 In the Cloud, Only With Backup & Sync

If you turn on Backup & Sync, your entries are also stored with Supabase, so that they survive a lost device and stay in sync between your iPhone, iPad and Mac. Supabase Inc. acts as our processor. The project runs on Amazon Web Services (AWS) in the region eu-central-1, Frankfurt am Main, Germany. Photos are only uploaded if you also turn on “Back Up Photos”, and are then stored in Supabase Storage in the same region. Section 7 explains Backup & Sync in detail.

5.3 What Leaves Your Device Without Backup & Sync

A few things leave your device even without Backup & Sync, none of which contains your entries:

  • anonymous daily usage counts to our server at Supabase in Frankfurt, unless you turn them off (Section 9.17)
  • feedback you send from the app, stored with Supabase in Frankfurt (Section 9.19)
  • requests for lesson content to the content service of Ampullarium UG in Ireland (Section 9.11)
  • map searches to Apple (Section 9.9)

What Preppy writes to Apple Health or to your calendar stays there, under Apple's and your control (Sections 9.12 and 9.13).

5.4 Storage Region

Where Preppy's data is stored on servers, it is stored in the European Union: Backup & Sync, feedback and the anonymous usage statistics in Frankfurt, Germany, and lesson content in Ireland. The remaining Preppy 2 copy at Google Firebase is also stored in the EU (Section 8). Your health entries, activities, partner entries, places and images therefore live on European infrastructure, and are not stored in the United States. Section 13 explains the limited cases in which providers outside the EU may be involved.

5.5 What Never Leaves Your Device

The following are never uploaded to our servers, with or without Backup & Sync:

  • Your device passcode, Face ID or Touch ID data. Biometric authentication is handled entirely by Apple; we only ever receive a yes-or-no result.
  • Data Preppy reads from Apple Health. It is shown in Preppy and never stored or synced.
  • Calendar events Preppy creates on your device.
  • Your live position. Preppy uses it only while you use a map or add a place. Only a place you deliberately save is stored.
  • Your photo library. Preppy only receives the individual images you pick, and uploads them only with “Back Up Photos”.
  • The device-local settings listed in Section 4.10.

6. How Your Data Is Stored and Protected

This section explains our storage architecture, because it materially affects your privacy.

6.1 A Local Database on Your Device

Your entries are stored in a SQLite database in Preppy's App Group container on your device. Only Preppy and its own widgets and extensions can read this container. On iPhone and iPad, the database is protected by iOS Data Protection: the system stores it encrypted and makes it readable after you unlock your device for the first time after a restart, so that Lock Screen widgets and controls keep working. Your photos are stored in the app's own container.

As long as you use Preppy without Backup & Sync, this database is the only copy of your entries, apart from your own device backups. We have no access to it.

6.2 One Row per Entry, Locked to Your Account

If you use Backup & Sync, each entry is stored as its own row in a table for its kind, such as intakes, activities or partners. Every row carries the random identifier of your account, and none carries your name or your email address. If you sign in with email, your email address is held only by the sign-in service, not in your entries.

Access is controlled by row-level security in the database: a signed-in account can only read and write rows that carry its own identifier. Your photos are stored in a private folder for your account, under the same rule. These rules are enforced on the server by the database itself, not in the app, so they cannot be bypassed by a modified or reverse-engineered client. A request for a row belonging to a different account is rejected.

No user of Preppy can see another user's data. There is no social layer, no discovery, no matching between users, no messaging and no public profile. Preppy never connects you to other Preppy users.

6.3 What We Can See

Without Backup & Sync, we cannot see your entries at all: they are on your device, not with us.

With Backup & Sync, your data is encrypted in transit and stored encrypted by our provider, but it is not end-to-end encrypted. As the operator, we technically have administrative access to the database, as any operator of such a service does. We do not look at your entries. We access data only where it is needed for support you ask us for, for the security of the service, or where the law requires it.

7. Backup & Sync

7.1 What It Does

Backup & Sync is optional and off by default. If you turn it on, Preppy keeps a copy of your data in the cloud, so that it survives a lost or replaced device, and keeps your iPhone, iPad and Mac in sync in both directions. You can turn it on during onboarding, during the update from Preppy 2, or later in Settings › Backup & Sync. Preppy syncs while you use it and, where the system allows, in the background.

7.2 Your Consent Comes First

Before anything is uploaded, Preppy asks for your explicit consent. You tick: “I consent to Preppy storing my data, including health data, for Backup & Sync.” Without that consent, nothing leaves your device. We record the version of the consent text and the time you gave it, on your device and in our database, together with the platform and app version. If the consent text changes, Preppy asks you again.

This consent is the legal basis for storing your health and sex life data in the cloud, Art. 9(2)(a) GDPR, in conjunction with Art. 6(1)(a) GDPR. You can withdraw it at any time by deleting your cloud data: “Delete Account & Cloud Data”, or “Delete All Data” while Backup & Sync is on, deletes the copy in the cloud (Section 7.6). Signing out is not a withdrawal by itself: it only stops syncing on that device, and your data stays in the cloud. Withdrawal does not affect the lawfulness of processing carried out before it.

7.3 Signing In

Backup & Sync needs an account, so that your data can be matched to you on every device. You can choose between two sign-in methods, and you can add email to an account you created with Apple:

  • Sign in with Apple. Preppy requests neither your name nor your email address from Apple, so Apple only gives us an identifier for your account. We store a token from Apple on the server, so that Preppy's access to your Apple ID can be revoked when you delete your account or remove Apple as a sign-in method.
  • Email and password. Creating an account, resetting your password and changing your email address are confirmed with a 6-digit code that we send to you by email. Supabase stores your password only as a hash; we never see it in plain text.

Sign-in and accounts are provided by Supabase Auth, part of the same Supabase project in Frankfurt. The emails with codes are sent through Brevo, a service of Sendinblue SAS, France, which acts as our processor. Brevo receives your email address, the code and the language of the email, which is the language of your app.

We do not offer social logins such as Google or Facebook, and we do not use phone number verification, so no third-party social network learns that you use Preppy.

Legal basis: performance of a contract, Art. 6(1)(b) GDPR, for running your account, and our legitimate interest in securing the sign-in process, Art. 6(1)(f) GDPR.

7.4 What Is Synced

With Backup & Sync on, the following is stored in the cloud and synced between your devices:

  • your profile and settings
  • intakes, intake schemes and pill refills
  • activities, with partners and solo
  • partners and places
  • tags, kinks and terms you create yourself
  • check-ups, appointments and test results
  • symptoms, wellbeing check-ins, vaccinations and vaccines you add yourself
  • your progress in Learn
  • the device list and the app language described in Section 4.1

Photos are only included if you turn on “Back Up Photos” (Section 7.5). Data Preppy reads from Apple Health is never synced, and the device-local settings in Section 4.10 stay on each device.

When you delete an entry, its content is removed from the cloud at the next sync. A marker without content, made of the entry's random identifier and the time of deletion, stays so that your other devices remove the entry too.

7.5 Photos

Profile and partner photos are only backed up if you turn on the separate setting “Back Up Photos”. Without it, photos stay on your device. With it, they are stored in Supabase Storage in Frankfurt, in a private folder that only your account can access. If you turn the setting off, Preppy offers to delete the photos already in the cloud.

7.6 Signing Out and Deleting Your Account

  • Sign Out stops Backup & Sync on this device. Everything stays in the cloud, and you choose whether to keep or remove the data on this device. Signing out does not delete anything in the cloud and does not by itself withdraw your consent.
  • Delete Account & Cloud Data deletes your account and all your data in the cloud, for all your devices. The data on this device stays.
  • Delete All Data deletes everything on this device and, if Backup & Sync is on, first your account and all cloud data.

Section 15 explains exactly what each of these deletes.

8. Preppy 2 and Firebase

8.1 What Preppy 2 Stored

Preppy 2 stored your account and entries in Google Firebase: Cloud Firestore for your entries, Firebase Storage for your images and Firebase Authentication for your sign-in, including anonymous accounts. Firebase is provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, acting as our processor. Cloud Firestore runs in Google's Europe multi-region, which replicates the database across data centres inside the EU, and Firebase Storage is likewise located in the EU.

8.2 The One-Time Import

On the first launch of Preppy 3.0, the app downloads your data and photos from Firebase once and saves them on your device. If Preppy 2 still had changes waiting to be uploaded, they are sent to Firebase first, so that nothing is lost. If you are offline, Preppy can start from the copy Preppy 2 kept on your device and completes the import once you are online.

When the import is done, Preppy writes one note to your Preppy 2 record at Firebase: that your data has moved, the date, the app version, the backup method you chose (Apple, email or none) and the kind of device (iPhone, iPad or Mac), never its name. This lets your other devices know that your data has already moved and how to get it. After that, Preppy clears the copy Firebase kept on your device and never reads or writes Firebase again.

If you used Preppy 2 with Sign in with Apple and your data has not been imported yet, you can also bring it to a new device with “Bring Over Preppy 2 Data”: you sign in with Apple once, and the same import runs. This is possible until Firebase is shut down.

8.3 The Copy That Remains at Google

The update does not delete your data at Firebase, and neither does “Delete All Data” or deleting your Backup & Sync account. The copy stays at Google in the EU until a planned shutdown, when we delete all Preppy 2 data at Firebase: the database, the stored photos, the accounts and the backup exports. The shutdown will happen on 31 December 2027 at the latest, possibly sooner. Until then, the Firebase database continues to be exported weekly to a private, access-restricted storage bucket in the EU, so that it can be restored after a failure.

You do not have to wait for the shutdown. Write to hello@preppy.health, and we will delete your Firebase copy by hand. If you use Backup & Sync, the identifier of your old account is stored with your account, which helps us find the copy. For an anonymous Preppy 2 account, there may be nothing that proves the copy is yours; Section 19.1 explains what that means.

Legal basis: the import brings your own data to your device at your request, Art. 6(1)(b) GDPR, and is covered by the explicit consent you gave for that data in Preppy 2, Art. 9(2)(a) GDPR. The Firebase copy continues to be stored on the basis of that consent until the shutdown, so that devices not yet updated can still bring their data over. You can withdraw that consent at any time by asking us to delete the copy. The note about the move is based on our legitimate interest in moving your data reliably across your devices, Art. 6(1)(f) GDPR.

8.4 What Remains of Firebase in the App

Preppy 3.0 still contains the Firebase SDK (Authentication, Firestore and Storage), only for this import. It is only started on devices that used Preppy 2, and it is not needed after the shutdown. Preppy does not use Firebase Analytics, Crashlytics, Remote Config or Cloud Messaging.

8.5 What Has Been Retired

Earlier versions of this policy described the use of aggregated, anonymized data for scientific research. With Preppy 3.0, this has ended. The export of Firebase data to Google BigQuery and the server-side aggregation that supported it have been retired, and Preppy no longer analyzes your entries centrally. We do not use your entries for research or statistics.

9. What We Do With Your Data, Feature by Feature

Each feature below works on your device. Where data leaves your device, we say so. If you use Backup & Sync, the entries described here are also stored and synced as described in Section 7.

9.1 Health Profile

Your HIV status, PrEP scheme, ART and DoxyPEP usage are stored in your profile and drive what the app shows you. Every one of these fields is optional and every one can be hidden from the Health tab and from your Profile independently, or cleared entirely.

Legal basis: your explicit consent, Art. 9(2)(a) GDPR, in conjunction with Art. 6(1)(a) and (b) GDPR.

9.2 Intake Tracking, Pill Supply and Reminders

Each pill you log is stored as an individual entry with a date, a time and a medication type. Intake schemes record when you started, extended, paused or ended PrEP, ART or DoxyPEP. If you track your pill supply, each refill is stored with its amount.

Legal basis: your explicit consent, Art. 9(2)(a) GDPR.

9.3 Activities

Activities, with partners or solo, are stored as individual entries with the details listed in Section 4.3. From them the app derives whether an activity counts as risky behaviour, which in turn drives DoxyPEP windows, calendar warnings and symptom hints. Every field beyond the date is optional, and you can hide fields you never use from the entry form entirely, so they are never even offered.

Legal basis: your explicit consent, Art. 9(2)(a) GDPR.

9.4 Partners

Partner profiles are stored as individual entries. Activities reference partners by identifier rather than repeating their details. Marking a partner as trusted changes how risk is calculated for activities involving only that partner. Archiving keeps a partner out of your active list without deleting the entry. See Section 11 for the specific obligations that come with storing data about other people.

Legal basis: your explicit consent, Art. 9(2)(a) GDPR, and, as regards the partner as a third party, Section 11.

9.5 Check-Ups and Test Results

Check-ups are stored with their date, type, notes and place. Test results are stored within the check-up, each with a test type and a result, including a pending state for results you are still waiting on. If you take ART, you can also record lab values such as CD4 count and viral load.

Legal basis: your explicit consent, Art. 9(2)(a) GDPR.

9.6 Symptoms

You can log symptoms with the details listed in Section 4.2. Based on your symptoms and your activities, Preppy can show a general hint that a test could make sense. This hint is calculated on your device, and nothing about your symptoms is sent anywhere for it. It is general information, not a diagnosis.

Legal basis: your explicit consent, Art. 9(2)(a) GDPR.

9.7 Wellbeing

Wellbeing check-ins record how you feel, the feelings you pick, what they relate to and an optional note, and can be linked to an activity. You can log them in the app, after an activity or from a widget.

Legal basis: your explicit consent, Art. 9(2)(a) GDPR.

9.8 Vaccinations

Your vaccination record stores the vaccinations you add, with the details listed in Section 4.2, and vaccines you add yourself. It is for your own overview.

Legal basis: your explicit consent, Art. 9(2)(a) GDPR.

9.9 Places and Maps

When you attach a place to an activity, a check-up or a vaccination, Preppy stores a title, a city and country line and exact coordinates as a separate place entry, so that a place you use often is stored once. Map display, search and address lookup are provided by Apple's MapKit. Requests to Apple's mapping services carry your device's IP address and the search terms you type, and are processed by Apple under its own privacy policy. We do not send Apple any account identifier, your health data or the reason you are searching.

If you grant location permission, Preppy uses your position only while you use the app: to centre the map, and when you attach a place to an activity. Preppy never tracks your location in the background, and your live position is never stored or sent to us. Only places you deliberately save are stored, on your device and, with Backup & Sync, in the cloud.

Legal basis: your consent for the device permission, Art. 6(1)(a) GDPR, and your explicit consent for the resulting entry, Art. 9(2)(a) GDPR, since a place attached to an activity reveals information about your sex life.

9.10 Images

Preppy only uses images you pick yourself with the system photo picker, so it has no access to the rest of your photo library. Images are compressed and stored in the app's private container. They are only uploaded if Backup & Sync and “Back Up Photos” are both on (Section 7.5). If you save an image from Preppy to your photo library, Preppy only asks for permission to add photos, not to read them. Deleting an image deletes it on your device and, with “Back Up Photos”, in the cloud.

Legal basis: your explicit consent, Art. 9(2)(a) GDPR.

9.11 Learn

The lessons in Learn are provided by Ampullarium UG (haftungsbeschränkt), Oberwallstr. 7, 10117 Berlin, Germany. Preppy downloads lesson texts and images from Ampullarium's content service, which is hosted on Supabase in Ireland (eu-west-1). These requests carry the app's public content key, the language you want the lessons in, and the technical data any request carries, such as your IP address and the app's user agent. They contain no entries and no account identifier. Ampullarium processes this technical data to deliver the content.

Lessons are stored on your device and can be read offline. Your progress, including your answers to questions, is stored on your device and, with Backup & Sync, synced. It is never sent to Ampullarium.

Next to your intake, symptoms, test results and vaccinations, Preppy can recommend lessons under “More on this”. These recommendations are picked on your device from the stored lessons, and nothing about your entries is sent anywhere for them.

Legal basis: our legitimate interest in providing educational content in the app, Art. 6(1)(f) GDPR, for the requests to the content service, and your explicit consent, Art. 9(2)(a) GDPR, for your progress, where it says something about your health.

9.12 Apple Health

If you choose to, Preppy writes to Apple Health:

  • activities, as “Sexual Activity”, including whether protection was used. You choose whether an activity is saved there: ask each time, always or never.
  • symptoms, as Apple Health symptom entries, where Apple Health has a matching type
  • wellbeing check-ins, as State of Mind

Preppy also reads State of Mind from Apple Health, to show your entries from there in Preppy's wellbeing trend. Data read from Apple Health is never stored in Preppy, never synced with Backup & Sync and never reaches our servers. Permission is managed by iOS and can be revoked at any time in the Health app or in Settings. When you use “Delete All Data”, entries Preppy wrote to Apple Health stay there and are managed in the Health app.

Legal basis: your explicit consent, Art. 9(2)(a) GDPR.

9.13 Device Calendar

If you choose to, Preppy adds a check-up to your device calendar and updates it when you change the date. Preppy stores only the calendar event identifier, on your device, so that it can find and update the same event later; it is not synced. The event is created on your device through Apple's EventKit and syncs wherever your calendar syncs, which may be iCloud or a third-party account you have configured, outside our control. Be aware that a calendar event may be visible to anyone with whom you share that calendar. Permission is managed by iOS and can be revoked at any time.

Legal basis: your consent, Art. 6(1)(a) GDPR.

9.14 Notifications

Preppy uses local notifications only. Reminders for intakes, DoxyPEP windows and check-ups are scheduled and delivered entirely on your device. We do not operate a push server, we do not use Firebase Cloud Messaging or the Apple Push Notification service, we do not store a device token, and no notification content ever passes through our systems. Notification permission is managed by iOS and can be revoked at any time.

You can choose how reminders appear on your lock screen: Standard, or the discreet styles Household, Plants and Errands, which do not reveal what the app is for or what medication you take. Widgets can use the same text styles.

Legal basis: your consent, Art. 6(1)(a) GDPR.

9.15 Widgets, Live Activities and Controls

Preppy's widgets, Live Activities and Control Center controls read the data they show from Preppy's App Group container on your device. Entries you log from a widget, a control, a Shortcut or Siri are saved on your device. Nothing is sent to us for this. Keep in mind that widgets and Live Activities on your Lock Screen can be seen by anyone who sees your device; the discreet text styles help here.

Legal basis: your explicit consent, Art. 9(2)(a) GDPR, as for the entries they show.

9.16 App Lock

You can lock the app behind Face ID, Touch ID or your device passcode, so that someone with physical access to an unlocked device still cannot open Preppy. Authentication is performed by Apple's LocalAuthentication; Preppy receives only a success or failure result and never any biometric data. Biometric templates never leave Apple's Secure Enclave and are never accessible to us.

Legal basis: our legitimate interest and yours in protecting highly sensitive data on a shared or lost device, Art. 6(1)(f) GDPR.

9.17 Anonymous Usage Statistics

To see which features help and where Preppy gets in the way, the app counts on your device how it is used, e.g. how often a dose was logged or a lesson finished. Once a day, the first time you open it, Preppy sends these numbers to our server.

The message carries no identifier, no account and no content: no names, notes or entries, not which medication you take and not which lesson you read. It contains:

  • the counts of the days since the last message
  • whether this is the first use this week or this month
  • the calendar week and month you first opened Preppy 3, and whether you came from an earlier version
  • app version, device type (iPhone, iPad or Mac), major operating system version and app language
  • once a week, coarse settings, e.g. whether Backup & Sync, widgets or reminders are on
  • for Learn, totals only: how often lessons were opened, started, left before the end (with a progress span: up to 25%, 25 to 50%, 50 to 75%, over 75%) and finished; the reading time per finished lesson as a span (up to 2, 2 to 5, 5 to 10, 10 to 20, over 20 minutes) and as summed seconds, counting at most ten minutes per step; and whether answers were right or wrong, by question type (single choice, multiple choice, true or false, matching, cloze) and by whether the question came in the lesson or in the quiz. Never which lesson or question it was, and never the answer itself.
  • if the Preppy 2 import or a sync failed: the technical error code or the failed step (Section 9.18)

Our server, at Supabase in Frankfurt, Germany (Section 12), adds every message to daily totals right away and doesn't store the message itself. Afterwards nothing can be traced back to you or your device, not even by us. We don't store IP addresses. Supabase technically logs every request with IP address, approximate location and time, and deletes these logs after 7 days. We don't analyse these logs.

Counting only starts once the setup or the update is complete. You can turn it off any time in Settings › Privacy › Help Improve Preppy. Preppy then deletes the counts on your device right away and sends nothing more. The counts stay on your device until the next daily message; counts older than 35 days are discarded without being sent.

Preppy 2 used TelemetryDeck (TelemetryDeck GmbH, Germany) for product analytics. Preppy 3.0 sends nothing to TelemetryDeck. Versions of Preppy 2 that have not been updated keep sending their signals to TelemetryDeck until you update.

Legal basis: the daily totals are anonymous and are not personal data. Where personal data briefly comes up when a message is sent, such as your IP address when the connection is made, this is based on our legitimate interest in using a few basic numbers to see which features are used and where errors occur, so that we can improve the app, Art. 6(1)(f) GDPR. The messages contain no identifier and no health data. You can object at any time by turning off “Help Improve Preppy”, Art. 21 GDPR.

9.18 Error Reporting

When an operation fails, the app records the technical error on your device so that problems can be diagnosed. If the Preppy 2 import fails, its technical error domain and numeric error code (e.g. "NSURLErrorDomain" and "-1009") are counted in the anonymous usage statistics (Section 9.17); if a sync fails, the name of the step that failed is counted. Neither comes with an error message or an identifier. We do not use Firebase Crashlytics, Firebase Analytics, Firebase Performance Monitoring or any comparable third-party crash reporting service. Apple provides us with aggregated, anonymized crash and performance statistics through App Store Connect if you have enabled sharing of analytics with developers in your device settings; this is controlled by Apple and can be switched off under Settings › Privacy & Security › Analytics & Improvements.

Legal basis: our legitimate interest in a stable and secure app, Art. 6(1)(f) GDPR.

9.19 Feedback and Support

When you send feedback from within the app, it goes through a server function to our Supabase project in Frankfurt and is stored there with its type, text, status and timestamps, together with technical context: app version, operating system version, device model and whether it was a debug build. If your feedback is about a lesson, we also store which lesson it was. Our replies are stored alongside your message.

If you use Backup & Sync, your feedback is linked to your account. Otherwise, it is linked to a random token that Preppy creates for this installation and keeps in your device's Keychain; we only store a SHA-256 hash of that token. This lets you see our replies in the app without an account.

Feedback threads from Preppy 2 are brought to your device with the import and shown read-only.

Please do not include health details, partner names or other sensitive information in feedback unless it is genuinely necessary to describe the problem.

Legal basis: performance of a contract, Art. 6(1)(b) GDPR, and our legitimate interest in providing working support, Art. 6(1)(f) GDPR.

9.20 App Store Distribution and Review Prompts

Preppy is distributed through the Apple App Store. Apple operates the download and the store account, and is an independent controller for that processing under its own privacy policy. Preppy is free and contains no in-app purchases or subscriptions, so there is no payment processing at all.

The app may occasionally ask you to rate it using Apple's standard StoreKit review prompt. This prompt is displayed and handled by iOS. We do not learn whether you rated the app or what you wrote.

Legal basis: our legitimate interest in distributing and improving the app, Art. 6(1)(f) GDPR, and your consent for TestFlight participation, Art. 6(1)(a) GDPR.

9.21 Website

Our website at www.preppy.health provides information about the app and hosts this policy, our Terms of Use and our Legal Notice. It is a static website: it sets no cookies and uses no analytics, no tracking, no third-party embeds and no external fonts; it uses the fonts already on your device. Links to the App Store and to Instagram are plain links, so these services only learn about your visit if you follow them.

The website is hosted on Firebase Hosting, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. When you visit it, Google processes your IP address, the time of access, the page requested, your browser's user agent and the referring page in order to deliver the site. Google also uses the IP addresses to detect abuse. Google delivers the website through its worldwide infrastructure, so this data may also be processed outside the EU (Section 13). We do not analyse any access data ourselves.

Legal basis: our legitimate interest in a secure and functioning website, Art. 6(1)(f) GDPR.

10.1 Health and Sex Life Data

Most of what Preppy stores is special category personal data under Art. 9(1) GDPR: data concerning health, and data concerning a natural person's sex life and sexual orientation. Processing this data is prohibited by default and requires a specific exception.

As long as your data stays on your device, it is processed by the app on your device and does not reach us. Where processing is attributable to us, above all when your data is stored with Backup & Sync, we rely on your explicit consent under Art. 9(2)(a) GDPR. This is a deliberate choice. We do not rely on Art. 9(2)(h), the exception for the provision of health care, because we are not healthcare providers and Preppy is not a healthcare service; Section 3 explains this. We do not rely on Art. 9(2)(i) or on any public interest ground.

Practically, this means:

  • Consent is granular in effect: every health and sex field is optional, and choosing not to enter something means it is never processed. Nothing is pre-filled and nothing is inferred.
  • Consent is given by a deliberate act on your part. Each piece of health or sex life information exists in Preppy because you chose to type it in, for a purpose that is visible to you at the moment you do it.
  • Before your data is stored in the cloud, you give a separate, explicit consent to Backup & Sync, which we record with its version and time (Section 7.2).
  • You can withdraw consent at any time, for everything or for a particular area: by deleting the relevant entries, by clearing the relevant fields, and, for Backup & Sync, by deleting your account and cloud data with “Delete Account & Cloud Data”, or with “Delete All Data” while Backup & Sync is on. Signing out alone only stops syncing on that device and leaves your data in the cloud. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
  • If you withdraw consent for the core health functions, we can no longer provide those functions. The app cannot track PrEP adherence without knowing that you take PrEP.

Under German law, § 22 BDSG additionally applies, and we implement the safeguards required by § 22(2) BDSG, which are described in Section 16.

10.2 Other Data

Where processing does not concern special category data, we rely on:

  • Art. 6(1)(b) GDPR, performance of the contract of use, for the Backup & Sync account, sync, feedback and support
  • Art. 6(1)(f) GDPR, legitimate interests, for security, abuse prevention, stability, the delivery of lesson content and of the website, and improvement of the app
  • Art. 6(1)(a) GDPR, consent, for device permissions and for optional features
  • Art. 6(1)(c) GDPR, legal obligation, where we are required to retain or disclose data

11. Data About Other People

Preppy lets you record information about other people: names, ages, photos, anatomical details, contact details, social media handles, their vaccinations and their HIV status. This is other people's personal data, and much of it falls into more than one special category at once. A partner's HIV status is health data. Their sexual position, anatomical details and the activities they appear in are data concerning sex life. Their gender and trans status may reveal gender identity or sexual orientation. Their ethnicity is data revealing racial or ethnic origin. Together with a name, a photo, a phone number and a Grindr handle, a single partner entry can be one of the most sensitive documents a person could hold about someone else. This section sets out how we handle it and what we expect from you.

11.1 Your Role

If you use Preppy purely for your own personal purposes, your own processing of partner data is generally covered by the household exemption in Art. 2(2)(c) GDPR, so the GDPR does not impose controller obligations on you personally. That exemption is narrow: it does not apply if you use the data for professional or commercial purposes, publish it, or share it outside a purely personal context. If you fall outside the exemption, you are the controller for that data and responsible for complying with data protection law.

Partner data that stays on your device never reaches us. Where you store it with Backup & Sync, we are the controller for hosting and storing it, and we apply everything in this policy to it. Partner photos are only uploaded if you turn on “Back Up Photos”.

11.2 What We Expect From You

  • Enter only what you actually need. Use anonymous mode, which stores a partner without a personal name, whenever a name is not necessary. Hide the partner fields you never use so the app stops asking for them.
  • Do not upload photos of other people without their agreement, and never upload intimate images without their explicit and current agreement. Sharing intimate images without consent is a criminal offence in many countries.
  • Treat another person's HIV status as the most sensitive thing you can write down. In several jurisdictions, disclosing someone's HIV status without their consent is unlawful and can be prosecuted.
  • Do not enter data about children.
  • Keep in mind that a note about someone else is still about them, and they may have rights over it.

11.3 Rights of the People You Record

If someone believes their data is stored in Preppy by another user and contacts us, we will handle the request under applicable law. There are practical limits we should be honest about. Most partner data never reaches us, because it stays on the user's device, where we have no access. Partner data stored with Backup & Sync sits in the user's own account and is not linked to the partner's identity, so we have no reliable way of locating a specific person's data across all users, and we cannot confirm whether they appear in anyone's app. Where we can identify the data, and where we are legally required to act, we will. Requests go to hello@preppy.health.

11.4 Deletion

Deleting a partner deletes the partner entry and its images, on your device and, with Backup & Sync, in the cloud. Activities that referenced that partner remain, but no longer point to an existing profile.

12. Recipients of Your Data

We disclose personal data only where it is necessary to provide the service, where you have consented, or where we are legally required to.

Processors, acting on our documented instructions under Art. 28 GDPR:

  • Supabase Inc., with hosting by Amazon Web Services in Frankfurt, Germany: Backup & Sync, sign-in, feedback and the anonymous usage statistics
  • Sendinblue SAS (Brevo), France: emails for sign-in, confirmation, password reset and email change in Backup & Sync
  • Google Ireland Limited, Ireland, and Google LLC, United States: Firebase Authentication, Cloud Firestore and Firebase Storage, for the remaining Preppy 2 copy until the shutdown (Section 8)
  • Google Ireland Limited, Ireland, and Google LLC, United States: Firebase Hosting for www.preppy.health

Lesson content:

  • Ampullarium UG (haftungsbeschränkt), Berlin, Germany: provides the lessons in Learn and receives the technical data of these requests (Section 9.11)

Independent controllers, processing under their own privacy policies:

  • Apple Inc. and Apple Distribution International Ltd.: App Store distribution, Sign in with Apple, TestFlight, MapKit, iCloud calendar sync and App Store Connect analytics. Apple Health and your device backups are under Apple's and your control.

We may also disclose data to courts, law enforcement or public authorities where we are legally obliged to do so, and to legal or tax advisors bound by professional confidentiality where necessary to establish, exercise or defend legal claims. We will resist overbroad requests and, where legally permitted, notify you.

We have no advertising partners, no data brokers, no marketing agencies and no analytics resellers.

An up-to-date list of processors is available on request at hello@preppy.health.

13. International Data Transfers

The servers that hold Preppy's data are located in the European Union: Supabase in Frankfurt, Brevo in the EU, Ampullarium's content service in Ireland and the remaining Firebase copy in the EU. There is no routine transfer of your health entries, activities, partner entries, places or images to any third country.

Some contact with providers outside the EEA is nevertheless possible, and we would rather name it than imply it never happens. Supabase Inc. is not established in the EU, and Supabase and its sub-processors may access data from outside the EEA in limited circumstances, such as support and maintenance of the platform. The same applies to Google's parent company in the United States for the Firebase copy. Google delivers our website through its worldwide infrastructure, so the data of your visit, such as your IP address, may also be processed outside the EU, including by Google LLC in the United States. Apple processes data in the United States for the services described in Section 9, such as Sign in with Apple, App Store distribution, TestFlight and map search, which involve identifiers and technical data rather than the contents of your entries.

Where personal data does reach a country outside the European Economic Area that has not received an adequacy decision, in particular the United States, we rely on:

  • certification under the EU-US Data Privacy Framework, where the provider is certified (Google LLC and Apple Inc. are certified, and equivalent extensions apply for the UK and Switzerland); and
  • the European Commission's Standard Contractual Clauses under Art. 46(2)(c) GDPR, supplemented by additional technical and organizational measures including encryption in transit and at rest.

You may request a copy of the relevant safeguards at hello@preppy.health.

14. Retention

We keep personal data only as long as necessary:

  • Data on your device: until you delete it, use “Delete All Data”, or delete the app. Copies in your own device backups follow your backup settings.
  • Backup & Sync data, including backed-up photos: for as long as your account exists, or until you delete the individual entry, or turn off “Back Up Photos” and choose to delete the photos.
  • Entries you delete in Backup & Sync: the content is removed at the next sync; the content-free deletion marker described in Section 7.4 stays until your account is deleted.
  • Consent records and the device list: for as long as your account exists.
  • Backups of the Backup & Sync database: Supabase keeps daily backups of the database for 7 days. Backups are not used for any other purpose than restoring data after a failure. Because a backup is a snapshot, data you have deleted can remain in it until it expires, and a backup cannot be edited selectively to take out an individual entry.
  • The Preppy 2 copy at Firebase, including its weekly backup exports: until the shutdown of Firebase, on 31 December 2027 at the latest, or until you ask us to delete it sooner (Section 8.3). We do not apply a fixed expiry to the weekly exports, so data deleted on request can remain in an existing export until that export is removed.
  • Anonymous usage statistics: the daily totals hold no personal data and are kept without a time limit. On your device, the counts stay until the next daily message; counts older than 35 days are discarded without being sent.
  • Feedback and support messages: until the matter is resolved, and thereafter as required by statutory retention obligations for business correspondence. Feedback linked to your Backup & Sync account is deleted with your account, and “Delete All Data” deletes the feedback sent from that device.
  • Email correspondence: until the matter is resolved, subject to statutory retention periods.
  • Server logs: Supabase records every request the app makes to our servers with IP address, approximate location, user agent and time, and deletes these logs after 7 days. Google says it keeps the IP addresses from visits to our website for a few months to detect abuse. Longer only where needed to investigate a specific security incident.
  • Cached lessons: on your device until they are updated or you use “Delete All Data”.

15. Deleting Your Data

15.1 Deleting Individual Entries

You can delete any single intake, activity, partner, check-up, symptom, wellbeing check-in, vaccination, place or image from within the app at any time, and you can clear any health field. With Backup & Sync, the deletion reaches the cloud and your other devices at the next sync. This is the most granular control you have, and we encourage you to use it freely.

15.2 Delete All Data

“Delete All Data” in Settings deletes everything Preppy stored on your device: the database, photos, widget data, settings, cached lessons, scheduled notifications and your Backup & Sync session. It also deletes the feedback sent from this device on our server.

If Backup & Sync is on, Preppy first deletes your account on the server. This removes your photos from storage, revokes the Apple token, deletes your consent records, your device list and the feedback linked to your account, and finally deletes the account itself, which deletes every synced entry with it. If this fails, for example because you are offline, nothing is deleted, neither on the server nor on your device, and you can try again.

Entries Preppy wrote to Apple Health stay in Apple Health and are managed there. Copies in your own device backups are not affected; they follow your backup settings. The Preppy 2 copy at Firebase is not affected either (Section 15.4).

15.3 Delete Account & Cloud Data

In Settings › Backup & Sync, “Delete Account & Cloud Data” deletes your account and all your data in the cloud in the same way, for all your devices, and keeps the data on this device.

15.4 Your Preppy 2 Copy at Firebase

None of the above deletes the Preppy 2 copy at Firebase. It is deleted when Firebase is shut down. If you want it deleted sooner, write to hello@preppy.health (Section 8.3).

15.5 Deletion on Request

You can also ask us to delete your data by writing to hello@preppy.health. We will verify that the request comes from the account holder and act without undue delay, and in any case within one month. Data that exists only on your device is out of our reach; you delete it in the app.

15.6 Limits

We may retain data where we are legally required to, or where it is necessary to establish, exercise or defend legal claims. Data in backups is removed when the backup expires or is removed (Section 14).

16. Security

We apply technical and organizational measures appropriate to the sensitivity of the data, including:

  • a local database protected by the system's Data Protection, in a container that only Preppy and its own widgets and extensions can read
  • encryption of all data in transit using TLS, and encryption at rest by our infrastructure providers
  • row-level security enforced on the server, so that one account can never read another account's entries (Section 6.2)
  • entries in Backup & Sync that carry a random account identifier, not your name or email address
  • passwords stored only as a hash, and Sign in with Apple without your name or email address
  • an explicit consent before any upload, and photos uploaded only with a separate setting
  • an optional app lock using Face ID, Touch ID or your passcode, which can be applied to the whole app or to individual sections
  • storage of images in the app's private container, inaccessible to other apps
  • data minimization by design: every sensitive field is optional, and unused fields can be hidden from the interface so they are never collected
  • restricted administrative access, used only where strictly necessary
  • regular review of dependencies and security configuration

Backup & Sync is not end-to-end encrypted. Section 6.3 explains what that means.

No system is perfectly secure. If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority within 72 hours under Art. 33 GDPR and, where the risk is high, notify you directly under Art. 34 GDPR.

We also recommend that you enable the app lock, use a device passcode, keep your system up to date, use a strong password for Backup & Sync, and think carefully before sharing your screen or your device.

17. No Automated Decision-Making

We do not carry out automated decision-making, including profiling, that produces legal effects concerning you or similarly significantly affects you within the meaning of Art. 22 GDPR.

Preppy does compute things from your entries: protection windows, adherence streaks, DoxyPEP windows, a risk classification for individual activities, hints about when a test could make sense, and lesson recommendations. These calculations happen on your device and are displayed to you, and only to you. They are arithmetic on your own inputs, they produce no decision about you, they are never shared with anyone, and they are explicitly not a medical assessment. See Section 3.2.

18. Children

Preppy is not intended for children. The app carries an age rating in the App Store reflecting its content, and you must meet that age requirement and the age requirement of your App Store account to use it. We do not knowingly collect personal data from children.

If you believe a child has provided us with personal data, contact hello@preppy.health and we will delete it without delay.

19. Your Rights

19.1 Rights Under the GDPR

If you are in the European Economic Area, the United Kingdom or Switzerland, you have the right to:

  • access the personal data we hold about you and receive a copy (Art. 15 GDPR)
  • have inaccurate or incomplete data corrected (Art. 16 GDPR)
  • have your data erased (Art. 17 GDPR)
  • restrict processing (Art. 18 GDPR)
  • receive your data in a structured, commonly used, machine-readable format and have it transmitted to another controller (Art. 20 GDPR)
  • object to processing based on legitimate interests (Art. 21 GDPR)
  • withdraw consent at any time, with effect for the future (Art. 7(3) GDPR)
  • not be subject to automated decision-making (Art. 22 GDPR)
  • lodge a complaint with a supervisory authority (Art. 77 GDPR)

Access, correction and erasure you can exercise directly in the app: every entry is visible, editable and deletable by you at any time, which is the fastest route and requires no request to us.

If you use Preppy without Backup & Sync, we hold none of your entries, so there is nothing we could show, export or delete for you: everything is on your device. Portability works differently with Backup & Sync. The app does not currently offer a self-service export, so if you want a machine-readable copy of your cloud data under Art. 20 GDPR, email hello@preppy.health and we will produce one for you as a structured file.

For anything else, write to hello@preppy.health. Requests are free of charge and answered within one month, extendable by two months for complex requests, in which case we will tell you. We must verify your identity before acting. For a Preppy 2 copy from an anonymous account, there is by design nothing that proves the account is yours, so we may be unable to verify you and may have to decline the request under Art. 11(2) GDPR. This is the trade-off that came with an account we cannot link to you.

19.2 Right to Object

You have the right to object at any time, on grounds relating to your particular situation, to processing based on Art. 6(1)(f) GDPR. We will stop the processing unless we can demonstrate compelling legitimate grounds that override your interests, or the processing is needed to establish, exercise or defend legal claims. An informal email to hello@preppy.health is enough.

19.3 Supervisory Authority

Our lead supervisory authority is:

Berliner Beauftragte für Datenschutz und Informationsfreiheit, Alt-Moabit 59-61, 10555 Berlin, Germany, www.datenschutz-berlin.de

You may also complain to the supervisory authority in your country of residence or place of work. In the United Kingdom, that is the Information Commissioner's Office (ico.org.uk); in Switzerland, the Federal Data Protection and Information Commissioner (edoeb.admin.ch).

20. Additional Information for Users in the United States

This section applies to residents of US states with comprehensive privacy laws, including California, Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Delaware, Iowa, Nebraska, New Hampshire, New Jersey, Tennessee, Minnesota, Maryland and others as they take effect. Where it conflicts with the rest of this policy, this section governs for those residents.

20.1 We Do Not Sell or Share Your Data

We do not sell your personal information, and we do not share it for cross-context behavioral advertising, as those terms are defined under the California Consumer Privacy Act as amended by the CPRA and under comparable state laws. We do not engage in targeted advertising. We have not sold or shared personal information in the preceding twelve months, and we do not sell the personal information of minors under 16.

20.2 Sensitive Personal Information

Preppy processes sensitive personal information as defined by California and other state laws, specifically personal information concerning health and personal information concerning sex life or sexual orientation. Most of it stays on your device; what we do process, for example with Backup & Sync, we use solely to provide the service you requested. We do not use or disclose sensitive personal information for the purpose of inferring characteristics about you, and we do not use it for any purpose that would trigger the right to limit under Cal. Civ. Code § 1798.121. Nonetheless, you may direct us to limit its use at any time by contacting us.

20.3 Your Rights

Depending on your state, you have the right to know and access the personal information we hold, to correct inaccuracies, to delete it, to obtain a portable copy, to opt out of sale, sharing, targeted advertising and certain profiling (none of which we do), to limit the use of sensitive personal information, and not to be discriminated or retaliated against for exercising any of these rights. Some states require consent before processing sensitive data; where that applies, we rely on the explicit consent described in Section 10.1.

To exercise your rights, email hello@preppy.health. We will verify your identity and respond within 45 days, extendable once by a further 45 days where necessary. You may use an authorized agent, with proof of authorization. We honor Global Privacy Control signals where technically applicable.

If we deny a request, we will explain why. California residents may appeal by replying to our response; residents of states with a statutory appeal right may appeal within the period their law provides, and if the appeal is denied may contact their state Attorney General.

20.4 Health Data Laws

Preppy is not a HIPAA covered entity or business associate, so HIPAA does not apply to the data you enter. Where state consumer health data laws apply, in particular the Washington My Health My Data Act and the Nevada consumer health data law, we process consumer health data only with your consent as described in Section 10.1, we do not sell it, and you may withdraw consent and request deletion at hello@preppy.health.

21. Additional Information for Users in Brazil

This section applies under the Lei Geral de Proteção de Dados (LGPD) and prevails over conflicting provisions for users in Brazil.

Health data and data concerning sex life are sensitive personal data under Art. 5(II) LGPD. We process them on the basis of your specific and highlighted consent under Art. 11(I) LGPD.

You have the right to confirmation of processing, access, correction of incomplete, inaccurate or outdated data, anonymization, blocking or deletion of unnecessary or excessive data, portability, deletion of data processed on consent, information about data sharing, information about the consequences of refusing consent, withdrawal of consent, and review of automated decisions. Requests go to hello@preppy.health and we respond within 15 days for full disclosure requests. You may lodge a complaint with the Autoridade Nacional de Proteção de Dados (ANPD).

International transfers are made on the basis of your consent, standard contractual clauses, or the other grounds permitted by Art. 33 LGPD.

22. Additional Information for Other Regions

Canada. We process personal information under PIPEDA and applicable provincial laws, including Quebec's Law 25. Health and sexual information is sensitive information requiring express consent, which is the basis described in Section 10.1. You may access and correct your information and complain to the Office of the Privacy Commissioner of Canada or your provincial commissioner.

United Kingdom. The UK GDPR and the Data Protection Act 2018 apply in equivalent terms to the GDPR provisions described above. Your supervisory authority is the Information Commissioner's Office.

Switzerland. The revised Federal Act on Data Protection (revFADP) applies. Health and sexual data are sensitive personal data requiring explicit consent. Your supervisory authority is the Federal Data Protection and Information Commissioner.

Australia. We handle personal information in accordance with the Privacy Act 1988 and the Australian Privacy Principles. Health information and information about sexual orientation or practices are sensitive information collected only with your consent. You may complain to the Office of the Australian Information Commissioner.

Other countries. Where local law grants you rights beyond those described here, those rights apply and you may exercise them at hello@preppy.health. Where local law imposes stricter requirements than those described here, we comply with them.

23. Cookies and Tracking Technologies

The Preppy app uses no cookies, no advertising identifiers, no IDFA, no fingerprinting and no cross-app or cross-device tracking. We do not participate in App Tracking Transparency because we do not track you across apps or websites owned by other companies, and we therefore never present that prompt.

The app stores technically necessary information on your device: your local database, your preferences, your widget data, cached lessons, the feedback token and, with Backup & Sync, your session. Under § 25(2)(2) TDDDG in Germany and Art. 5(3) of the ePrivacy Directive, this does not require consent because it is strictly necessary to provide the service you requested.

The website sets no cookies at all and uses no analytics, tracking or advertising technologies, and therefore displays no cookie banner.

24. Changes to This Policy

We update this policy when our features, our providers or the legal requirements change. The current version is always available on our website, in English and in German, and in the app under Settings.

Where a change concerns processing based on your consent, such as what Backup & Sync stores, Preppy asks for your consent again. For other changes, continued use after a change constitutes acceptance of that change.

25. Definitions

  • Personal data: any information relating to an identified or identifiable natural person.
  • Special category data: data revealing health, sex life, sexual orientation, racial or ethnic origin, and the other categories listed in Art. 9(1) GDPR.
  • Pseudonymous: data that cannot be attributed to a specific person without additional information kept separately. Entries stored with Backup & Sync are pseudonymous: they carry a random account identifier, not your name or email address.
  • Anonymized: data that can no longer be attributed to any person by any means reasonably likely to be used. Anonymized data is not personal data.
  • Backup & Sync: Preppy's optional feature that stores your data in the cloud and syncs it between your devices. See Section 7.
  • Row-level security: a rule in the database that lets each signed-in account read and write only the rows that carry its own identifier. See Section 6.2.
  • Controller: the party that determines the purposes and means of processing. For Preppy, that is Kevin Waltz.
  • Processor: a party that processes personal data on behalf of the controller, under contract.
  • Usage data: information collected automatically, such as app version, operating system version, device model, language and the anonymous usage counts described in Section 9.17.

26. Contact

For any privacy question, request or complaint:

hello@preppy.health

We read every message and answer within one month, usually much sooner.

Preppy is not a medical device and does not replace contact with a healthcare professional. The app is a companion for personal use and does not protect against HIV infection. Use at your own risk.