Legal

Privacy Policy

Effective Date: October 16, 2026

Last Updated: November 4, 2026

Privacy Policy

This Privacy Policy describes how the individual developer or developers who own and operate TierOne Business Prep, also known as TierOne BizPrep (collectively, "we," "us," "our," or the "Developer"), collect, use, disclose, retain, and protect information about you when you access or use the TierOne Business Prep website, application programming interfaces, artificial intelligence features, and related services (collectively, the "Service").

This Privacy Policy is incorporated into and forms part of our Terms of Service. Capitalized terms not defined here have the meanings given in the Terms of Service. BY ACCESSING OR USING THE SERVICE, YOU ACKNOWLEDGE THAT YOU HAVE READ AND UNDERSTOOD THIS PRIVACY POLICY AND CONSENT TO THE COLLECTION, USE, AND DISCLOSURE OF YOUR INFORMATION AS DESCRIBED HEREIN. IF YOU DO NOT AGREE, YOU MUST NOT USE THE SERVICE.

TierOne Business Prep is a free, non-commercial educational project. Our practice is to collect only the information reasonably necessary to operate, secure, and improve the Service.

01. Scope

This Privacy Policy applies to information we collect through the Service. It does not apply to any third-party website, service, or application, including the third-party service providers described in Section 05, each of which is governed by its own privacy policy. "Personal Information" means information that identifies, relates to, or could reasonably be linked with a particular individual.

02. Information We Collect

Information You Provide Directly

When you register for and use an account, we collect:

Account information: your email address, display name, and password. We never store your password in readable form: we keep only a salted, one-way hash of it (created with the scrypt algorithm) in the Service's own database.
Account type: whether you registered as a student or as a teacher. Teacher accounts are available only to adults aged 18 and over.
Profile preferences: your selected competitive event track and any changes you make to your display name or track.
Leaderboard preferences: whether you have opted out of the weekly leaderboard, how much of your display name you have chosen to show on it, if you choose one, a leaderboard username, and which of your streak badges, if any, you have chosen to show next to your name (see Section 05, "Other Users: Weekly Leaderboard").
Eligibility information: your date of birth, which is used solely at the time of registration, and when you are asked to accept updated versions of our Terms of Service and this Privacy Policy, to confirm that you meet the minimum age requirement and to determine whether parental or guardian consent is required. We do not store your date of birth. We retain only your resulting age group (13 to 17, or 18 and over) and, if you are under 18, a record that you confirmed your parent or legal guardian reviewed and agreed to our Terms of Service and this Privacy Policy, together with the date of that confirmation.
Agreement records: the version of our Terms of Service and Privacy Policy that you most recently accepted and the date and time of your acceptance. When these documents are materially updated, you will be asked to review and accept the new versions before continuing to use the Service.
Inputs to AI features: the content you submit when using AI features, such as the event category and number of questions requested, business concepts you ask about, practice questions and answer choices submitted for explanation, the messages exchanged in chat-based practice quizzes, topics you request AI flashcards for, any images (PNG, JPEG, WebP, or GIF), PDF documents, or text files you attach to a concept explanation or chat-based quiz, the AI model and response speed you select, and, for teachers using the AI teaching tools described in Section 05, the study plan options and optional goal note they enter.
Classroom information: if you are a teacher, the names of the classrooms you create, their join codes, whether each classroom is closed to new students, the practice you assign (the students it is assigned to, the event category, number of questions, format, optional note to students, optional due date, and the date assigned, with the note and due date reflecting any later changes you make), and the announcements you post to a classroom (a title, a message, your display name as it was when you posted, the date and time of posting, and, if you edit an announcement, the date and time of your most recent edit). If you are a student, the classrooms you join with a join code, the date you joined each, whether you have marked an assigned practice as done yourself and when, and the time you last opened your Announcements page, which is used to show which announcements are new.
Study calendar: if you are a student, the practice sessions you plan on your calendar: the day and time (in your device's local time zone), the event category, number of questions, format, an optional note, and the reminder you choose, if any. When you finish a practice session opened from a plan, its score, total number of questions, and completion time are recorded on that plan; if you tick a plan off yourself, the time you did so is recorded.
Teacher calendar: if you are a teacher, the events you schedule on your calendar: a name, a type (such as a meeting, competition, or deadline), the day, the time or that it lasts all day, optional details, the reminder you choose, if any, and, if you share it, the classroom it is shared with.
Reminder settings: if you turn on calendar reminders in a browser, the push subscription that browser creates (a web address issued by your browser's push service and the encryption keys used to secure messages to it) and the date you turned reminders on. For each reminder still to be sent, we keep a record of when to send it and the details it will show (for a study plan, the event category, number of questions, format, and start time; for a teacher's event, its name and start time).
Communications: any information you provide when you contact us, such as your name, email address, and the content of your message.
Bug reports: when you submit a bug report, the summary, the part of the Service affected, the severity you select, the steps to reproduce, what you expected and what actually happened, and the device and browser you describe, together with your account identifier, the email address associated with your account, and the date and time of submission. Bug reports are used solely to investigate and fix problems with the Service.

Information Generated Through Your Use of the Service

We create and store the following information as you use the Service:

Practice history: for each completed practice session, the score, the total number of questions, the event category, and the date and time of completion.
Assignment results: if you are a student in a classroom and complete practice that your teacher assigned to you, the score, the total number of questions, and the date and time of completion are recorded on that assignment for your teacher. A later attempt replaces an earlier one.
Performance statistics: cumulative questions answered, accuracy, current and longest daily practice streak, the days you practiced in the last week, the streak badges you have earned and the date you earned each, the date of your most recent practice, and topic-level performance metrics derived from your practice history.
Weekly study totals: the number of practice questions and practice sessions you have logged in the current week (Monday through Sunday), and the number of questions logged on the current day, which is used to apply the daily limit on questions that count toward the weekly leaderboard.
Leaderboard entries: if you have not opted out of the weekly leaderboard, a record for the current week containing your leaderboard name (the portion of your display name you chose to show, or your leaderboard username), your weekly question and session totals, the streak badge you chose to show, if any, and the time it was last updated.
Usage counters: the amount of AI usage by your account on the current day (counted in units that depend on the AI model used for each request) and the number of files you have attached to AI requests that day, used to enforce daily usage limits.
Account records: a unique account identifier, the date your account was created, and, for accounts created on or after October 16, 2026, a keyed one-way hash of the network address used at registration (see "Network information" below), which is used solely to anonymize registration-limit records when you delete your account and is never displayed to you or sent to your browser.
Session records: the date and time of your most recent sign-in, together with a one-way cryptographic hash of the network address (IP address) used for that sign-in.

Information Collected Automatically

When you access the Service, certain technical information is collected automatically:

Network information: your IP address is processed in server memory to apply rate limits, concurrency limits, and abuse protections. For accounts created through the Service, a keyed one-way cryptographic hash (HMAC-SHA256) of the IP address used at registration is stored, together with the associated account identifier and registration time, to enforce limits on the number of accounts created per network. We do not store raw IP addresses in our database for this purpose.
Server and security logs: our servers record operational and security events, which may include the domain portion (but not the full address) of an email address rejected at registration, account identifiers, error messages, the names of the technical signals that caused a browser security check to be flagged (see "Browser security check" below), and timestamps. Our application does not write raw IP addresses to its logs. Where a security event must reference a network (for example, when a network is temporarily blocked for suspicious activity), the log records only a truncated, keyed digest generated with a random key that exists solely in server memory, is never stored, and is replaced whenever the server restarts. Our hosting and infrastructure providers may independently record IP addresses and request metadata in accordance with their own policies.
Device and browser information: as with any website, standard information transmitted by your browser, such as browser type, operating system, and referring page, may be received by our servers and our hosting and content delivery providers.
Browser security check: to protect the Service from automated abuse, before you sign in, register, use an AI feature, save a practice score, join a classroom, or submit a bug report, the Service runs an automated check in your browser. Your browser solves a small computational puzzle and sends our server a report of technical characteristics: your browser's user-agent string, platform, and language settings, screen and window size, number of processor cores, graphics hardware vendor and model, number of browser plugins, estimated network round-trip time, whether browser automation tools are present, and summary counts and timing patterns of mouse movements, clicks, key presses, touches, and scrolling on the page. The report never includes which keys you pressed, what you typed, or where you clicked. The server turns the report into a risk score in memory and immediately discards the report; it is never stored in our database or written to our logs. If the score suggests automation, or if there are repeated failed sign-in attempts for an email address or network, you are asked to solve a visual puzzle (a captcha). So that a passed check works only where it was issued, the server keeps in memory a random check identifier, a keyed digest of your user-agent string and the network portion of your IP address, and the times of your recent protected requests, for up to two hours, and counts of failed sign-in attempts for an email address or network for 15 minutes. All of this is discarded when it expires or the server restarts, and none of it is linked to your account in our database. Your browser keeps the check identifier only in the page's memory.
Aggregate usage statistics: we count use of the Service with our own tool; we do not use any third-party analytics service. When a page of the Service is shown, your browser sends us the page's general name (for example, "a classroom page," never which classroom), whether you arrived from another website, and, if you did, that website's domain name only (for example, "google.com," never the address of the page you came from or any search terms). Our server adds the general browser family (such as Chrome or Safari), operating system family (such as Windows or iOS), and device type (desktop, mobile, or tablet), worked out from your browser's user-agent string, which is then discarded. These values are only added to daily totals: we do not record individual page views, and the totals are not linked to you, your account, your IP address, or your device. The tool does not use cookies or browser storage, does not assign you any identifier, does not count unique visitors, and does not track you across websites. Your browser does not send these statistics if it signals Global Privacy Control or Do Not Track. Your IP address is used only in server memory, to limit how many page views a single network can add. We use these totals solely to understand how much the Service is used and to improve it.

Information We Do Not Intentionally Collect

We do not intentionally collect government identification numbers, financial account or payment card information, precise geolocation, biometric information, or information about racial or ethnic origin, religious beliefs, health, or sexual orientation. You must not submit such information through the Service, including in any Input to an AI feature.

03. Browser Storage and Cookies

The Service stores limited information in your browser's local storage to operate: your authentication session token, your account identifier, and your account type (student or teacher, so that the right layout is shown right away); your choice of light or dark theme; the AI model and response speed you selected and whether you have turned on side-by-side model comparison; the options you last used to set up a practice session or a calendar plan and, for teachers, to assign practice; the account identifiers of accounts that have turned calendar reminders on in that browser (so that reminders resume when the same account signs in again); the identifiers of site announcements you have dismissed in that browser (so that a dismissed announcement banner stays hidden); and, if a visitor indicates at registration that they do not meet the minimum age requirement, a flag that prevents further registration attempts from that browser. Your session token, account identifier, and account type are removed when you sign out; the rest remains on your device until you clear your browser storage. Your preferences and your list of dismissed announcements are not linked to your account and are not stored on our servers, although your selected AI model and response speed are sent with each AI request. We do not record which news posts or announcements you open or dismiss.

The Service also stores the following only in your browser's IndexedDB storage, each record labeled with your account identifier so that other accounts signed in on the same browser do not see it: your AI chat history (the messages exchanged in chat-based practice quizzes, concept explanations, and previews of any images you attached); the AI flashcard decks you create or import; and your review list of practice questions you missed or flagged (each question, its answer choices and correct answer, the answer you chose, its explanation, and how many times you missed it). This information is never stored on our servers, and is sent to us only when you submit it to an AI feature as described in Section 06. It remains on your device after you sign out until you delete it in the Service (on the AI chats page, the Learn page, or the Practice page), delete your account from that browser, or clear your browser storage. Chats and flashcard decks can be exported to a file and imported on another device, and flashcard decks can be downloaded for use in other study apps. You are responsible for keeping any exported or downloaded file secure.

We do not use cookies, advertising or cross-site tracking technologies, or behavioral advertising tools. Our aggregate usage statistics (see Section 02) store nothing in your browser. The Service does not load scripts, styles, fonts, or images from other websites, so other websites do not learn that you visited the Service, although the hosting and content delivery providers described in Section 05 handle your requests.

If you turn on calendar reminders, the Service asks your browser for permission to show notifications and installs a service worker, a small script your browser runs in the background to display reminders when the Service is not open. The service worker only displays the reminders we send and opens the Service when you click one; it does not cache content, read other websites, or track your browsing. Signing out, or turning reminders off, stops reminders reaching that browser. You can also revoke notification permission at any time in your browser's site settings.

If your browser sends a Global Privacy Control or "Do Not Track" signal, we do not count your page views in our aggregate usage statistics. Because we do not engage in cross-site tracking and do not sell or share Personal Information, these signals do not otherwise change how the Service works.

04. How We Use Your Information

We use the information we collect for the following purposes:

To create, authenticate, and maintain your account, and to enforce single-session sign-in.
To provide the Service's features, including generating practice questions, quizzes, scores, and explanations through AI features.
To record and display your practice history, statistics, streaks, and topic-level analytics.
To operate classrooms, including letting students join with a join code, showing teachers their roster and the results of the practice they assigned, showing students their teachers' announcements, assignment due dates, and shared calendar events, and, at a teacher's request, generating AI study plans and class insights from those results.
To operate the study and teacher calendars, including showing your plans and events, recording the results of planned practice, and, if you turn reminders on, sending reminder notifications to your browser at the times you choose.
To show signed-in users news and announcements about the Service, such as new features, changes, or planned maintenance, as a banner and on the News page.
To operate the weekly leaderboard, including calculating weekly totals and rankings and displaying your leaderboard name and weekly totals to other signed-in users, unless you have opted out.
To enforce rate limits, daily AI usage and upload limits, registration limits, and other technical safeguards, and to tell people apart from automated programs through the browser security check described in Section 02.
To screen AI Inputs for prohibited or manipulative content before they are transmitted to an AI provider.
To detect, investigate, and prevent fraud, abuse, security incidents, and violations of our Terms of Service.
To maintain, troubleshoot, and improve the reliability, security, and performance of the Service, including through the aggregate usage statistics described in Section 02.
To respond to your inquiries and requests, including privacy requests.
To comply with applicable law, legal process, or enforceable governmental requests, and to establish, exercise, or defend legal claims.

We do not use your Personal Information to build advertising profiles, and we do not use automated decision-making that produces legal or similarly significant effects concerning you. Leaderboard rankings are calculated automatically from weekly practice totals for motivational purposes only, carry no prize, reward, or official standing, and do not produce legal or similarly significant effects. Apart from the leaderboard information and the classroom information described in Section 05, your practice scores, statistics, and study calendar are generated for your own study use only and are not shown to other users. AI study plans and class insights are suggestions for a teacher to consider; they are not grades, and the Service does not use them to make any decision about a student.

05. How We Disclose Your Information

We do not sell, rent, or trade your Personal Information, and we do not share it for cross-context behavioral advertising. We disclose information only as described below.

Other Users: Weekly Leaderboard

The Service includes a weekly leaderboard that ranks students by the number of practice questions they have answered during the current week. Student accounts are included on the leaderboard by default. You may opt out at any time in Account Settings, and you may opt back in later. Teacher accounts start opted out and may opt in.

What other users see: while you are included and have logged at least one practice session in the current week, other signed-in users of the Service can see your leaderboard name, your rank, and the number of practice questions and sessions you have logged that week. If you choose to show a streak badge, they can also see that badge, which indicates that you have practiced on at least that many consecutive days. No badge is shown unless you choose one.
Your leaderboard name: you choose how you appear: your full display name, your first name and last initial (the default), your first name only, your initials only, or a username you choose. A username must be unique on the Service and should not contain your real name, email address, or other personal information.
What other users do not see: the leaderboard never shows your email address, account identifier, accuracy, individual scores, practice history, current streak, other badges, event track, age group, or any other information about you.
Who can see it: the leaderboard is available only to users who are signed in to the Service. It is not published on any public page, and we do not provide it to search engines or third parties.
Opting out: when you opt out, your entry is removed from the current week's leaderboard immediately and you are not added to future leaderboards. We continue to keep your weekly study totals privately so that your standing is accurate if you opt back in.

Other users may view, remember, or record what is displayed to them on the leaderboard, and we cannot control what they do with it. If you do not want your name shown, choose initials or a username, or opt out.

Other Users: Classrooms

Teachers may create classrooms on the Service, and students may choose to join a classroom by entering the join code their teacher provides. Students are never added to a classroom without entering its code themselves. A teacher may close a classroom to new students at any time; while it is closed, its join code cannot be used to join, and students already in the classroom are not affected.

What your teacher sees: when you join a classroom, the teacher who created it can see your display name, your email address, the date you joined, and, for each practice session they assign to you, whether you have completed it and your score, total number of questions, and completion time, or, if you have not completed it, whether and when you marked it as done yourself. On their calendar, a teacher sees each assignment's due date and how many of the assigned students have completed it.
What your teacher does not see: your other practice history, overall accuracy, streak, statistics, event track, age group, leaderboard settings, AI chat history, study calendar, planned practice, reminder settings, or whether you have read their announcements.
What students see: students in a classroom see its name, the teacher's display name, the practice assigned to them and its due date, the announcements the teacher posts to the classroom, and the calendar events the teacher shares with the classroom (each event's name, type, day, time, and details, but not the teacher's reminder setting). Announcements and shared events are visible to every student in the classroom, including students who join after they were posted. Students do not see the classroom roster or other students' results.
Announcements and shared events: an announcement shows the teacher's display name as it was when the announcement was posted. A teacher can edit an announcement after posting it; students then see only the edited version, marked as edited, and earlier versions are not kept. A teacher can likewise change the due date or note of practice they have assigned, and students see the current version. A teacher can delete an announcement or event at any time, after which students no longer see it. Students who leave or are removed from a classroom no longer see its announcements or events. Teachers should not include students' personal information in announcements or shared events, because every student in the classroom can see them.
AI teaching tools: teachers may ask an AI feature to write a study plan for their classroom or for one student in it, or to summarize the classroom's strengths, gaps, and students who may need support. To do this, the Service sends the AI provider a summary of the classroom's assignment results (event categories, scores, and which assignments have not been started). In that summary, students are identified only by temporary labels such as "S1" and "S2"; student names, email addresses, and account identifiers are not sent to the AI provider. The Service replaces the labels with students' display names in the response before showing it to the teacher. These tools are available only to the teacher who owns the classroom, and their output is shown only to that teacher.
Leaving a classroom: you may leave a classroom at any time on the Classes page, and a teacher may remove you. Either way, your results are removed from that classroom's assignments and the teacher can no longer see them. Results that a teacher previously viewed, copied, or included in an AI study plan they saved outside the Service may remain with that teacher, and we cannot control what they do with them.

Service Providers

We disclose information to third-party service providers that perform services on our behalf, solely as necessary for them to perform those services, including:

Backup storage provider: your account information, profile, practice history, statistics, leaderboard preferences and entries, classroom information, assignment results, announcements, calendar plans and events, reminder settings, and security records are stored in a database on a server operated by the Developer. Passwords are stored only as salted, one-way hashes. Once a day, a compressed copy of that database is encrypted on our server with a key held only by the Developer and then uploaded over an encrypted connection to a private storage bucket provided by Backblaze, Inc. (Backblaze B2 Cloud Storage), which keeps it so the service can be restored after a failure. Backup copies are deleted automatically after a limited retention period.
Browser push services: if you turn on calendar reminders, each reminder is delivered through the push service operated by the company that makes your browser, such as Google for Chrome and Edge, Mozilla for Firefox, Apple for Safari, or Microsoft. We send the push service your browser's push address, the time the message should expire, and the reminder itself, encrypted so that only your browser can read it; the push service cannot read the reminder's content. The push service can see that a message was sent to your browser and when.
Artificial intelligence providers: when you use an AI feature, your Inputs, including any files you attach, together with system instructions and reference study material, are transmitted over an encrypted connection to OpenRouter, Inc., an AI routing service, which forwards them to a provider that hosts the AI model used for the request. You may choose among the following models: Minimax M3.1 Flash, developed by MiniMax; GPT 6 Luna, developed by OpenAI; and MiMo v2.6 Flash, developed by Xiaomi. A model may be hosted by the company that developed it or by another hosting provider that OpenRouter selects. AI flashcards always use GPT 6 Luna, and in side-by-side comparison your request is sent to both models you choose. Every request we send instructs OpenRouter to use only hosting providers covered by its Zero Data Retention policy, which have committed not to store prompts or responses, and never a provider that may store or train on them. If no such provider is available for a model, the request fails rather than being sent to a provider that retains data. When a teacher uses the AI teaching tools, the request also includes the pseudonymous classroom results summary described above. Your account email address and display name, and those of the students in a classroom, are not included in requests sent to AI providers, but anything you type into or attach to a request is sent as you provided it.
Hosting and content delivery providers: providers that host the Service's servers and deliver its web resources.

Service providers process information subject to their own terms and privacy policies, which, except as described above for AI requests, may permit them to retain data for limited periods, for example for abuse monitoring or legal compliance. We do not control and are not responsible for the data practices of any third-party provider.

Legal Requirements and Protection of Rights

We may disclose information if we believe in good faith that disclosure is reasonably necessary to (a) comply with any applicable law, regulation, subpoena, court order, or other legal process; (b) respond to a lawful request by a public authority; (c) enforce our Terms of Service or investigate potential violations; (d) detect, prevent, or address fraud, security, or technical issues; or (e) protect the rights, property, or safety of the Developer, our users, or the public.

Transfer of the Service

If the Service, or responsibility for operating it, is transferred to another person or entity, including through a sale, gift, merger, or change in the individuals operating the Service, information about users may be transferred as part of that transaction, subject to this Privacy Policy or a policy providing materially equivalent protection.

With Your Consent

We may disclose information for any other purpose with your consent.

06. AI Processing and Zero-Log Practice

We have configured the Service so that the content of AI Inputs and AI Output is not written to the application's logs, files, or database during normal operation. AI Inputs are processed in server memory solely to fulfill your request. Chat-based quiz conversations and concept explanations are saved only in your browser (see Section 03), and quiz conversations are resubmitted with each message; they are not stored in our database, logs, or files, so we cannot recover them if they are deleted from your browser. Files you attach are processed in server memory and sent to the AI provider with your request; they are not stored in our database, logs, or files (a preview of an attached image is saved with the chat in your browser). AI flashcard decks are returned to your browser and saved only there. The only information retained from an AI-assisted practice session is the resulting practice history described in Section 02 (score, number of questions, category, and timestamp) and your daily usage and upload counts. AI study plans and class insights are generated on request from the classroom data already described in Section 02; they, and any goal note a teacher enters for them, are not stored in our database, logs, or files, or in the teacher's browser storage, and are lost when the teacher leaves or reloads the page unless the teacher copies them. Each such request counts toward the teacher's daily AI usage count. Study calendar plans, teacher calendar events, reminders, and announcements are not sent to AI providers. The Developer may temporarily enable content-free diagnostic logging to investigate service incidents.

Each request we send instructs OpenRouter to route it only to Zero Data Retention providers, as described in Section 05, and asks that the request and response not be stored for later retrieval, review, or model evaluation. The zero-log practice described above covers our own systems. For OpenRouter and the hosting providers, we rely on their Zero Data Retention commitments, which are governed by their own terms and privacy policies; we do not control their systems and cannot guarantee how they handle information. Accordingly, you must not include any personal, sensitive, or confidential information in any Input.

07. Data Retention

We retain information for as long as reasonably necessary to fulfill the purposes described in this Privacy Policy, unless a longer retention period is required or permitted by law. In general:

Leaderboard entries exist only for the current week. Entries for a completed week are deleted automatically after the weekly reset (Monday at midnight, server time), generally within a few hours. Your entry is removed immediately when you opt out or delete your account. A leaderboard username remains reserved to your account until you change it or delete your account.
Classroom information and assignment results are retained while the classroom exists. A student's results and done marks are deleted from a classroom when the student leaves or is removed from it, when the teacher withdraws or deletes the assignment, or when the student deletes their account. Announcements are retained until the teacher deletes them. When a teacher edits an announcement or changes an assignment's due date or note, only the latest version is retained; the earlier wording or date is overwritten and not kept. A classroom, with its roster, assignments, results, announcements, join code, and the calendar events shared with it, is deleted when the teacher deletes it or deletes their account.
Study calendar plans and teacher calendar events are retained, including after their date has passed, until you delete them or delete your account.
Reminder records exist only until the reminder is sent, or until the plan or event is completed, changed so that it no longer needs a reminder, or deleted. A reminder that cannot be delivered is retried a limited number of times and then discarded. Push subscriptions are retained until you turn reminders off in that browser, the push service reports that the subscription no longer exists, you turn reminders on in more than ten (10) browsers (the oldest is then removed), or you delete your account.
Bug reports are retained until the problem has been investigated and addressed, or until you delete your account, whichever comes first.
Account, profile, practice history, statistics, and session records are retained for as long as your account remains active. When you delete your account through Account Settings, these records and your authentication account are permanently deleted at that time. Records are likewise deleted following a verified deletion request or our termination of your account, subject to the exceptions below.
Registration-limit records (hashed network address, account identifier, and registration time) are retained for the duration of the registration-limit window, currently thirty (30) days, so that deleting and re-creating accounts cannot be used to evade registration limits. When you delete your account, we remove your account identifier from the corresponding record where we are able to locate it, leaving only the hashed network address and registration time, which are not linked to you. Expired records are disregarded and are pruned when the record for that network is next updated.
In-memory security data, such as rate-limit counters keyed by IP address and the browser security check data described in Section 02, is held only temporarily in server memory and is discarded on a rolling basis (browser checks within two hours) or when the server restarts.
Aggregate usage statistics are daily totals that are not linked to any individual; each day's totals are deleted automatically after approximately thirteen (13) months.
Server and security logs are retained for a limited period consistent with the retention settings of our hosting environment.

Notwithstanding the foregoing, we may retain information to the extent reasonably necessary to comply with legal obligations, resolve disputes, enforce our agreements, prevent fraud or abuse, or maintain security. Residual copies of deleted information may persist in backup or provider systems for a limited period before being overwritten.

08. Your Rights and Choices

Access and Correction

You may view your practice history and statistics, and update your display name and event track, through your account settings at any time.

Leaderboard Choices

You may opt out of or back into the weekly leaderboard, change how much of your name is shown on it, or set or change a leaderboard username, at any time through Account Settings, and choose, change, or remove the streak badge shown next to your name at any time on your Dashboard. Changes take effect on the current week's leaderboard immediately, although another user who already has the leaderboard open may continue to see the earlier version until their page refreshes.

Deletion

You may permanently delete your account and associated Personal Information at any time through the Account Settings page of the Service. To protect your account against unauthorized deletion, you must confirm your current password. Deletion immediately signs out all active sessions and permanently removes your authentication account, profile, practice history, statistics, leaderboard entries and username, calendar plans and events, pending reminders, push subscriptions, bug reports, and session records, and anonymizes registration-limit records as described in Section 07. Deleting a student account also removes you from every classroom and deletes your assignment results; deleting a teacher account also deletes every classroom you created, together with its roster, assignments, results, and announcements. Deletion cannot be undone.

If you cannot access your account, you may instead request deletion by contacting us as described in Section 15. To protect your account, we may require you to verify your identity, for example by sending the request from the email address associated with your account. Upon verifying a request, we will delete or de-identify your Personal Information within a reasonable period, subject to the exceptions in Section 07.

Classroom Choices

Joining a classroom is optional. Students may leave a classroom at any time on the Classes page, which immediately removes their results from it, as described in Section 05. Teachers may close a classroom to new students, or reopen it, at any time on the classroom's page, and may get a new join code if a code has been shared with anyone who should not have it.

Calendar and Reminder Choices

The study and teacher calendars are optional. You may edit or delete any plan or event at any time on the Calendar page; deleting a shared event also removes it from the calendars of the students in that classroom. Reminders are off until you turn them on, and only in the browser where you do so. You may turn them off at any time on the Calendar page, or block notifications for the Service in your browser's settings.

Signing Out and Browser Storage

Signing out invalidates your session token and stops calendar reminders reaching that browser. You may also clear information stored in your browser at any time through your browser settings.

Additional Rights

Depending on where you live, you may have additional rights under applicable law, such as the right to know what Personal Information we hold about you, to obtain a copy of it, to request its correction or deletion, to restrict or object to certain processing, or to withdraw consent. To exercise any such right, contact us as described in Section 15. We will respond within the time required by applicable law and will not discriminate against you for exercising any privacy right. We may decline requests that are manifestly unfounded, excessive, or that we cannot verify, or where an exception under applicable law applies.

09. Children's Privacy

The Service is not directed to children under the age of thirteen (13), and we do not knowingly collect Personal Information from children under 13. Our registration process requires each user to provide a date of birth. If the date of birth indicates that the user is under 13, registration is refused, no account is created, and no information submitted in that registration attempt is stored or logged by us. Users under the age of majority in their jurisdiction may use the Service only with the consent and supervision of a parent or legal guardian, as described in our Terms of Service. If we learn that we have collected Personal Information from a child under 13 without verifiable parental consent, we will promptly delete that information and terminate the associated account. Users aged 13 to 17 are included on the weekly leaderboard on the same terms as other users and may opt out or show only their initials or a username at any time, as described in Section 05; we encourage minors and their parents or guardians to review these choices together. A parent or legal guardian may also ask us to remove a minor from the leaderboard. Teacher accounts are available only to adults. A minor's classroom information is shared only with the teachers of classrooms the minor chooses to join, a minor's study calendar is never shown to teachers or other users, and AI teaching tools never send a minor's name or email address to an AI provider; a minor may leave a classroom at any time, and a parent or guardian may ask us to remove a minor from a classroom. A parent or guardian who believes that a child under 13 has provided Personal Information to the Service, or who wishes to review or request deletion of their minor child's information, should contact us as described in Section 15.

10. Data Security

We implement reasonable administrative, technical, and organizational safeguards designed to protect information against unauthorized access, disclosure, alteration, and destruction. These measures include encrypted transmission of data, verification of cryptographically signed session tokens, revocation of prior sessions on new sign-in, on sign-out, and on account deletion, password re-confirmation before account deletion, keyed one-way hashing of network addresses used for abuse prevention, exclusion of raw IP addresses from application logs, end-to-end encryption of reminder notifications to your browser, acceptance of push addresses only on recognized browser push services, an automated browser security check with a computational puzzle and, when needed, a captcha to block automated abuse, encryption of daily database backups before they leave our server, strict input validation, rate limiting, and restriction of access to our database to authenticated server processes.

HOWEVER, NO METHOD OF TRANSMISSION OVER THE INTERNET OR METHOD OF ELECTRONIC STORAGE IS COMPLETELY SECURE. WE CANNOT AND DO NOT GUARANTEE THE ABSOLUTE SECURITY OF ANY INFORMATION, AND YOU PROVIDE INFORMATION AT YOUR OWN RISK. You are responsible for maintaining the confidentiality of your password and for signing out on shared devices. Reminder notifications are displayed by your device's operating system and may be visible to anyone who can see your screen, including on a locked screen. If we become aware of a security incident affecting your Personal Information, we will notify you and any relevant authorities where and as required by applicable law.

11. International Users

The Service is operated from the United States, and our service providers may store and process information in the United States and other countries. In particular, AI requests pass through OpenRouter and are processed by the hosting providers described in Section 05, which may be located outside the United States, including in China, where MiniMax and Xiaomi are headquartered. If you access the Service from outside the United States, you acknowledge and consent to the transfer of your information to, and its storage and processing in, the United States and other jurisdictions whose data protection laws may differ from, and may be less protective than, those of your jurisdiction.

12. California Privacy Rights

If you are a California resident, you may have rights under California law, including the California Consumer Privacy Act as amended by the California Privacy Rights Act, to the extent those laws apply. The Service is a free, non-commercial educational project, and the Developer may not meet the thresholds that make those laws applicable. Nonetheless, California residents may contact us as described in Section 15 to request access to, correction of, or deletion of their Personal Information. We do not sell Personal Information or share it for cross-context behavioral advertising, and we have not done so in the preceding twelve (12) months. We do not use or disclose sensitive personal information for purposes that would give rise to a right to limit such use.

Under California's "Shine the Light" law, California residents may request information regarding disclosure of Personal Information to third parties for their direct marketing purposes. We do not disclose Personal Information to third parties for their direct marketing purposes.

California users under eighteen (18) years of age who have posted content on the Service may request its removal by contacting us as described in Section 15. Removal may not ensure complete or comprehensive removal of the content in all circumstances.

13. Third-Party Links and Services

The Service may contain links to, or rely on, third-party websites and services. We are not responsible for the privacy, security, or content practices of any third party. Your interactions with any third party are governed by that third party's own policies, and we encourage you to review them.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time in our sole discretion. Revised versions will be posted on this page with an updated "Last Updated" date and become effective upon posting unless otherwise stated. Where required by applicable law, we will provide additional notice or obtain your consent. Your continued use of the Service after a revised Privacy Policy is posted constitutes your acceptance of the revised Privacy Policy.

15. Contact Us

If you have questions or concerns about this Privacy Policy, or wish to exercise any of your rights, please contact the Developer by email at [email protected]. Please include the email address associated with your account so that we can verify and process your request. You may also delete your account directly through the Account Settings page of the Service.

Disclaimer: TierOne Business Prep is an independent, non-commercial educational study aid built as a student project. It is not affiliated with, endorsed by, or officially connected to Future Business Leaders of America, Inc. (FBLA). All FBLA trademarks are the property of their respective owners.