Drafty Privacy Policy

This Privacy Policy explains how Drafty, operated by Drafty Prep ("Drafty," "we," "us," or "our"), collects, uses, shares, and protects your information when you use the Drafty application and website at draftyprep.com (collectively, the "Service"). Drafty is an independent study aid for the NCARB Architect Registration Examination (ARE 5.0); it is not affiliated with, endorsed by, or sponsored by NCARB. By using the Service you agree to the practices described here. If you have questions, contact us at hello@draftyprep.com.

Last updated: [Effective Date]. Operated by: [Company legal entity], [mailing address]. Governing jurisdiction: [Governing State].

Information We Collect

We collect the following categories of information:

Account information. When you create an account, we collect your name, email address, and password credentials managed through Firebase Authentication. If you sign in with Google or Apple, we receive identifiers from those providers (such as your Google account ID or Apple user identifier and the email address you authorize them to share). We do not receive or store your Google or Apple passwords.
Study data. We collect information about how you use the Service to power your learning experience, including lesson and division progress, missed topics, exercise and practice-exam results, streaks, hearts, XP, your public profile, and your leaderboard standing.
Purchase information. When you subscribe to Drafty Pro, payment is processed through RevenueCat together with Stripe (for purchases made on the website) or through the Apple App Store or Google Play (for in-app purchases). We receive subscription status, plan, transaction identifiers, and renewal information from these providers. Drafty does not collect or store your full credit or debit card numbers. Card and payment-method data are handled directly by Stripe, Apple, and Google.
Device, usage, and log data. We and our service providers automatically collect technical information such as device type, operating system, app version, language settings, IP address, general location inferred from IP, identifiers, crash reports, diagnostic data, and interaction logs (for example, features used and timestamps).
Communications. If you email us at hello@draftyprep.com, we collect the contents of your message and our correspondence with you.

How We Use Your Information

We use the information we collect to:

Create and manage your account and authenticate your sign-in;
Provide, personalize, and improve the Service, including tracking study progress, surfacing missed topics, and generating your personalized study guidance;
Operate gamified features such as streaks, hearts, XP, leagues, and the leaderboard, and display your public profile;
Generate and deliver spoken lesson audio (produced server-side via ElevenLabs) and cache it for performance;
Process and manage subscriptions, free trials, renewals, and billing through our payment providers;
Provide customer support and respond to your inquiries;
Monitor, secure, debug, and improve the Service, including analyzing usage and fixing crashes;
Send service-related communications, and, where permitted, product updates (you can opt out of non-essential messages);
Comply with legal obligations and enforce our terms.

Legal Bases for Processing

If you are in the European Economic Area (EEA) or the United Kingdom, we process your personal data under the following legal bases of the EU/UK General Data Protection Regulation (GDPR):

Performance of a contract - to create your account, deliver the Service, and process your subscription;
Legitimate interests - to secure, maintain, analyze, and improve the Service, prevent fraud and abuse, and operate features such as leaderboards, provided these interests are not overridden by your rights;
Consent - where we rely on your consent, for example for certain optional communications or non-essential cookies; you may withdraw consent at any time;
Compliance with a legal obligation - to meet tax, accounting, and other legal requirements.

How We Share Information and Our Sub-Processors

We do not sell your personal information. We share information only as described below, primarily with service providers (sub-processors) that perform functions on our behalf under contractual confidentiality and data-protection obligations:

Google Firebase (Google LLC) - authentication, Firestore database (account, study progress, missed topics, public profile, leaderboard), and Storage (cached audio);
RevenueCat - subscription management and entitlement processing;
Stripe - payment processing for website purchases;
Apple (App Store) and Google (Google Play) - in-app purchase processing and subscription management;
ElevenLabs - server-side generation of spoken lesson audio;
Vercel and Google Cloud / Firebase - website and application hosting and infrastructure.

We may also share information: (a) to comply with applicable law, legal process, or lawful government requests; (b) to protect the rights, property, safety, or security of Drafty, our users, or the public; (c) in connection with a merger, acquisition, financing, or sale of assets, in which case we will notify you of any change in ownership or use of your personal information; and (d) with your consent or at your direction. Information you choose to make public, such as your profile name and leaderboard standing, may be visible to other users.

Cookies and Local Storage

On our website we and our providers use cookies and similar technologies for essential functions (such as keeping you signed in and processing payments) and for analytics and performance. In the mobile app, we use local storage (including AsyncStorage and on-device caches) to store your session, settings, and cached content for offline and performance purposes. You can control cookies through your browser settings; disabling essential cookies may impair core functionality of the website.

Data Retention

We retain your personal information for as long as your account is active or as needed to provide the Service. We retain study progress, profile, and account data until you delete your account or request deletion. We retain transaction and subscription records for as long as necessary to comply with tax, accounting, and legal obligations. Cached audio and diagnostic logs are retained for limited periods consistent with their operational purpose. When information is no longer needed, we delete or anonymize it. Some residual copies may persist in backups for a limited time before being overwritten.

Security

We use technical and organizational measures designed to protect your information, including encryption in transit, access controls, and reliance on established infrastructure providers such as Google Firebase, Stripe, and Vercel. Payment-card data is handled directly by Stripe, Apple, and Google and is not stored by Drafty. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. Please protect your account credentials and notify us at hello@draftyprep.com if you believe your account has been compromised.

Your Rights and How to Exercise Them

Depending on your location, you may have the right to access, correct, update, delete, or export (receive a portable copy of) your personal information, to object to or restrict certain processing, and to withdraw consent where processing is based on consent. You may exercise these rights by emailing us at hello@draftyprep.com. You can also update certain account and profile information directly in the app. We will respond within the timeframes required by applicable law and may need to verify your identity before acting on a request. We will not discriminate against you for exercising your rights. If you are in the EEA or UK and believe we have not addressed your concerns, you may lodge a complaint with your local data protection authority.

Children's Privacy

The Service is intended for users preparing for a professional licensing examination and is not directed to children under 13. We do not knowingly collect personal information from children under 13 (or the higher minimum age required in your jurisdiction). If you believe a child has provided us personal information, contact us at hello@draftyprep.com and we will take steps to delete it.

GDPR Notice (EEA and UK)

If you are located in the EEA or the UK, the data controller for your personal information is [Company legal entity], [mailing address]. We process your data on the legal bases described in the "Legal Bases for Processing" section, and you have the rights described in "Your Rights and How to Exercise Them," including the rights of access, rectification, erasure, restriction, portability, and objection, as well as the right to lodge a complaint with a supervisory authority. Where we transfer personal data outside the EEA or UK, we rely on appropriate safeguards as described in "International Data Transfers." To exercise your rights or contact our representative, email hello@draftyprep.com.

CCPA / CPRA Notice (California)

If you are a California resident, the California Consumer Privacy Act, as amended by the California Privacy Rights Act (CCPA/CPRA), gives you rights regarding your personal information. In the preceding 12 months we have collected the categories of personal information described in "Information We Collect" (identifiers, account and purchase information, internet and device activity, and inferences). You have the right to know and access the personal information we collect, the right to request correction or deletion, and the right to opt out of the sale or sharing of personal information, subject to legal exceptions.

We do not sell your personal information, and we do not share it for cross-context behavioral advertising. We will not discriminate against you for exercising your CCPA/CPRA rights. You may submit a request by emailing hello@draftyprep.com, and you may use an authorized agent to do so. We will verify your request as required by law.

International Data Transfers

Drafty is operated from, and relies on service providers located in, the United States and other countries. If you access the Service from outside these regions, your information may be transferred to, stored in, and processed in countries whose data protection laws may differ from those of your jurisdiction. Where required, we use appropriate safeguards for such transfers, such as the European Commission's Standard Contractual Clauses and equivalent UK mechanisms. By using the Service, you understand that your information may be processed in these locations.

Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date above and, where appropriate, provide additional notice (such as in-app or by email). Your continued use of the Service after the changes take effect constitutes acceptance of the revised policy.

Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or your personal information, contact us at:

Email: hello@draftyprep.com
Operated by: Drafty Prep, [Company legal entity]
Mailing address: [mailing address]

Drafty is an independent study aid and is not affiliated with, endorsed by, or sponsored by NCARB. "ARE," "Architect Registration Examination," and "NCARB" are trademarks of their respective owners.

Additional Provisions

Add a short subsection (e.g., under 'How We Share Information' or as a new 'Automated Processing and Voice Generation' section): 'Voice generation. To produce spoken lesson audio, our servers send lesson text (not your personal account data) to ElevenLabs solely to synthesize and cache the audio. We do not authorize ElevenLabs or any other provider to use this content to train their models, and we do not sell or share your personal information for advertising. Automated decision-making. We do not use your personal information to make decisions that produce legal or similarly significant effects about you within the meaning of Article 22 of the GDPR. Features such as missed-topic review and personalized study guidance are study aids generated from your own activity and do not have legal or similarly significant effects.' Add to the 'Cookies and Local Storage' section: 'On our website, non-essential analytics and performance cookies are used only where permitted — in the EEA and UK, only after you consent through our cookie banner, which lets you accept or reject non-essential cookies and change your choice at any time. Essential cookies (for sign-in and payment processing) are always active because the website cannot function without them. We use [analytics provider(s), e.g., Firebase/Google Analytics] for usage analytics; you can opt out of non-essential cookies through our cookie banner or your browser settings.' (Replace the bracketed provider with the actual analytics tool in use.) Add to the 'CCPA / CPRA Notice (California)' section: 'Sources and purposes. We collect personal information directly from you (account creation, study activity, communications), automatically from your device and use of the Service, and from our service providers (such as our authentication, payment, and analytics providers). We collect and use each category for the business purposes described in “How We Use Your Information,” including providing and securing the Service, processing subscriptions, and customer support. Retention. We retain each category of personal information for the periods described in “Data Retention,” based on how long it is needed for the purpose collected and to meet legal, tax, and accounting obligations. Sensitive personal information. We do not use or disclose sensitive personal information for purposes that would trigger the right to limit under the CPRA. Financial incentives. We do not offer financial incentives in exchange for the collection, sale, or sharing of personal information.'