Your Child's Privacy on SolPrep — What We Collect, What We Don't, and Why
April 27, 2026 · 6 min read
When a parent in a community group asked about privacy before sharing SolPrep, we thought: that's exactly the right question to ask. You should scrutinize every app your child uses. This post is our answer — specific, plain-language, no marketing spin.
The short version: SolPrep collects the minimum information needed to work, never sells or mines it, and you can delete everything yourself at any time with one click.
Your child never creates an account
This is the most important design decision we made. Children do not sign up, log in, or enter any personal information on SolPrep. Only parents create accounts. Parents then add child profiles, which contain exactly two things: a first name (or a nickname — we strongly suggest using one) and a grade level.
No email address. No phone number. No date of birth. No school name. No photo. A child profile on SolPrep is as anonymous as you choose to make it — you can call your child "Star" and grade 4 and we'll never know the difference.
This design follows COPPA(the Children's Online Privacy Protection Act), the U.S. federal law that governs how apps may collect data from children under 13. We follow its principles for all children on the platform, not just those under 13.
What the parent account stores
When you sign up, we store your email address. That's it. We don't ask for your name, address, phone number, or any payment information (SolPrep is free, forever).
During practice sessions we record which questions your child answered, whether each answer was correct, and how long it took. This is the data that drives the progress charts on your dashboard — it exists only to help you see how your child is doing.
We do not sell, share, or mine your data
SolPrep has no advertisers and no business model that involves your data. We are not a venture-backed company optimizing for engagement metrics. SolPrep was built by a Virginia parent, for Virginia parents. The only revenue model that may ever exist here is an optional donation (the "Buy me a coffee" button in the footer).
Your child's practice history is never aggregated into any profile sold to third parties. It is never used to serve ads anywhere on the internet. It never leaves our database except when your dashboard fetches it to display to you.
How passwords are protected
SolPrep never stores passwords. Authentication is handled entirely by Supabase, a SOC 2 Type II certified platform, using bcrypt — the industry-standard algorithm for password hashing. Bcrypt is deliberately slow to compute, making brute-force attacks impractical, and it stores a salted hash — not the password itself.
In practical terms: even we cannot see your password. If you forget it, the only option is a reset email — because there is nothing to look up. If our database were ever compromised (it hasn't been), an attacker would get bcrypt hashes that are computationally infeasible to reverse.
If you sign in with Google, no password is stored at all — authentication happens entirely on Google's servers via OAuth 2.0.
Where your data lives
All data is stored in Supabase, hosted on AWS infrastructure in the United States. Data is encrypted at rest (AES-256) and in transit (TLS 1.2+). Supabase is SOC 2 Type II certified, meaning an independent auditor has verified their security controls. The SolPrep website itself is hosted on Vercel, which also holds SOC 2 Type II certification.
We use Google Analyticsto understand aggregate usage — things like "how many people visit the homepage" or "which grade is most popular." This data is anonymized and never linked to individual accounts. You can opt out via Google's Analytics opt-out browser extension.
You can delete everything, yourself, right now
We recently added self-service account deletion. Go to Settings → Delete Account, type DELETE to confirm, and every record associated with your account — parent profile, all child profiles, all session history, all progress data — is permanently removed from our database within seconds. No email required, no waiting period, no dark patterns.
Prefer to request deletion by email? See our Privacy Policy for contact details.
Independent verification: A+ security rating
We ran SolPrep through Mozilla Observatory, an independent security scanner used by security professionals to audit website HTTP headers, content policies, and transport security. SolPrep scored A+— the highest possible grade. The scan checks for things like whether the site can be embedded in a phishing frame (it can't), whether scripts can be injected by attackers (blocked by a strict Content Security Policy), and whether the connection is always encrypted (yes, enforced with a 2-year HSTS header).
You can run the scan yourself at observatory.mozilla.org/analyze/solprep.app.
The honest summary
✅ Children never create accounts — only parents do
✅ Child profiles contain only a nickname and grade — no contact info
✅ Passwords are bcrypt-hashed and never stored in readable form
✅ No ads, no data selling, no third-party profiling
✅ Data hosted on SOC 2 Type II certified infrastructure
✅ Full self-service deletion, no hoops to jump through
✅ COPPA principles followed for all children on the platform
✅ A+ rating on Mozilla Observatory independent security scan
If you have a question this post doesn't answer, visit our Privacy Policyfor the full details and contact information. We're a small team and we respond personally.