Privacy Policy

ScoreBridge Prep (“ScoreBridge,” “we,” “us”) is operated by Isaac Emil Heinze.

This Privacy Policy explains how we collect, use, disclose, and retain information when you use scorebridgeprep.com and related ScoreBridge services.

Contact: support@scorebridgeprep.com. Privacy requests: privacy@scorebridgeprep.com. Mailing address: 1011 Rosemont Ave NW Cullman.

This policy applies to the ScoreBridge website and authenticated student and admin experiences we operate.

It does not apply to third-party sites that we do not control. Service providers that process information on our behalf are described below.

ScoreBridge is intended for users age 13 and older. We do not knowingly collect personal information from children under 13.

If you are a parent or guardian and believe we have collected personal information from a child under 13, contact privacy@scorebridgeprep.com and we will take reasonable steps to delete it.

Permanent account creation requires an affirmative confirmation that the user meets the minimum age. This notice is not a claim of COPPA certification.

Account information may include your email address, authentication credentials (passwords are stored by our authentication provider in hashed form; we do not store plaintext passwords), and whether your account began as an anonymous guest session.

Profile and preference information may include timezone, appearance preference (stored in your browser), optional study goals (such as ACT test date, target composite, daily or weekly question goals, planned study days), and notification preference toggles.

Communications may include feedback messages, question reports, optional contact email you choose to share, and replies in support threads.

Our hosting and delivery providers may receive technical information such as IP address, browser and device characteristics, and request timestamps as part of operating and securing the service.

We record product analytics events for key activation steps (for example, starting a diagnostic or first practice session). Those events may include a user identifier and limited properties such as attempt or diagnostic identifiers.

We use Vercel Analytics and Speed Insights for operational performance and usage measurement. We do not use advertising pixels or cross-site ad trackers in the current product.

When you take a diagnostic or practice, we store attempts or sessions, selected answers, correctness and grades, question and skill associations, and optional timing or activity signals (such as time a question was visible, tab-hidden duration, or pauses). Timing is used for product improvement and is not presented as a punitive countdown in the current experience.

This educational activity is linked to your authenticated identity (including anonymous guest identities) so progress can be saved securely.

ScoreBridge may compute preliminary score estimates, ranges, confidence or evidence indicators, progress summaries, and practice recommendations from your diagnostic and practice activity.

Estimates are educational signals, not official ACT scores. Practice-driven visible estimate updates may be disabled, limited, or changed as we improve integrity controls.

If you submit feedback or report a question, we store the message content, category, related page or content identifiers when provided, and limited device or browser context used for triage.

Administrators may read and reply to feedback. Internal staff notes may be stored for operations and are not shown to students.

Authentication and password-reset emails are sent through our authentication provider. The app does not currently send marketing or practice-reminder emails, even if preference toggles exist for future use.

When a guest starts a diagnostic, ScoreBridge may create an anonymous authenticated identity so answers can be saved securely. This is not a public profile.

You may later upgrade that identity to a permanent account (typically by adding an email and confirming it). When upgrade succeeds in place, diagnostic ownership remains attached to the same account identifier.

If you instead sign into an existing permanent account, ScoreBridge may offer a secure, one-time claim flow to attach or discard a guest diagnostic. We do not accept arbitrary attempt IDs from the browser without verification.

Anonymous records still contain educational activity and technical data. We may remove inactive anonymous records after a period we determine; a fixed automated purge schedule is not guaranteed in the current product.

We use strictly necessary cookies for authentication sessions and for short-lived diagnostic conversion or claim continuity (httpOnly cookies).

We use browser storage for appearance preference and temporary assessment UI state (such as flagged questions during a sitting).

We do not use advertising cookies. Because we do not run advertising or cross-context behavioral advertising trackers, we do not display a marketing cookie banner. If that changes, we will update this policy and any required consent controls first.

We use information to provide diagnostics and practice, save progress, compute estimates and recommendations, secure accounts, prevent abuse, provide support, improve content quality, operate admin tools, and comply with law.

We do not use your educational answers to train third-party foundation models through ScoreBridge features. See the AI section for what content is sent to AI providers.

ScoreBridge prioritizes human-reviewed practice content when available. After reviewed content for a selection is exhausted, you may choose clearly labeled generated practice that has passed automated checks but may not yet be human-reviewed.

We use OpenAI’s API to generate and verify educational question and explanation content. Prompts are built from educational scope data such as section, skill, difficulty, passage text, and generation instructions. We do not send your email address, name, full student history, or feedback message bodies in those generation prompts.

Database records for generation jobs may store operational identifiers (such as which account requested runtime fallback) for rate limiting and review. That is separate from prompt contents.

OpenAI processes API data under its API terms. ScoreBridge does not enable provider training opt-ins in application code; operators should configure provider accounts consistently with this policy. We do not overstate confidentiality or retention beyond the provider’s official terms.

Unreviewed generated practice is generally excluded from predictive scoring weight in the current product.

We disclose information to service providers that process it on our behalf to operate, secure, and improve ScoreBridge.

Current categories include: Supabase (authentication and database), Vercel (hosting, delivery, Analytics, and Speed Insights), and OpenAI (generated educational content). Authentication emails are delivered through the email channel configured on our authentication provider.

We do not currently use a separate consumer payment processor, error-monitoring SaaS (such as Sentry), or advertising network in the application.

Besides service providers, we may disclose information if required by law, to protect rights and safety, or in connection with a business transfer where permitted.

Authorized ScoreBridge administrators can access account-linked operational data needed for support, content quality, security, and product integrity.

ScoreBridge does not sell personal information.

ScoreBridge does not share personal information for cross-context behavioral advertising.

ScoreBridge does not display targeted advertising in the current product.

We retain account and educational data while your account is active and as needed to provide the service.

When you delete your account, we delete the authentication user. Most owned educational and preference records are removed via cascading deletes. Some records may be retained in de-identified or de-linked form for support integrity or analytics (for example, feedback threads with user identifiers cleared, or analytics events with user identifiers cleared).

Legal acceptance records may be retained with the user link removed so we can demonstrate historical acceptance without keeping a live account.

We use industry-standard measures appropriate to our size and the sensitivity of educational account data, including encrypted transport, authenticated access controls, and database row-level security policies for student data.

No method of transmission or storage is perfectly secure.

Depending on your account, you may view and update account email and password, adjust preferences and study goals, export certain account data, delete your account, and contact us for access or correction requests.

Email privacy@scorebridgeprep.com for privacy requests. We will respond as reasonably practicable. We do not promise a fixed statutory response deadline beyond what applicable law requires for our situation.

Permanent accounts can request an export from Settings. The export currently includes profile, preferences, score estimates, submitted diagnostic summaries, practice session records, feedback threads (excluding internal staff notes), and legal acceptance history when available.

Raw answer-by-answer exports and some derived evidence tables may not be included in the current export package.

Permanent accounts can delete their account from Settings after confirmation. Deletion removes the Auth user and cascading student records described above.

Deletion is irreversible. Some de-linked operational records may remain as described in Data retention.

Depending on where you live, U.S. state law may provide rights to access, delete, correct, or obtain information about certain processing, subject to exceptions.

ScoreBridge is a small educational product. This section does not claim that ScoreBridge is currently subject to every comprehensive state privacy statute. If a right applies to you, contact us and we will evaluate your request in good faith.

ScoreBridge is operated from the United States. If you use the service from another country, your information may be processed in the United States and other locations where our providers operate.

We may update this Privacy Policy. The version identifier and effective date appear at the top of the page (current version 2026-07-26, effective July 26, 2026).

For material changes, we may display a notice in the product. We require re-acknowledgment when we determine it is legally or operationally appropriate.

Operator: Isaac Emil Heinze

Privacy: privacy@scorebridgeprep.com

General: support@scorebridgeprep.com

Mailing address: 1011 Rosemont Ave NW Cullman