Security

What we do

These are things we have built and checked, not hopes.

• Every table that holds personal data has Row Level Security switched on, so the database itself only lets a person read their own rows. We check this automatically each time the database changes.
• The key that can read everything stays on our server and is never sent to a browser. The build fails if code that runs in a browser tries to use it.
• Your password is handled by our sign-in provider, Supabase. Our own code never stores it. A password cannot be a very common one or your email address.
• Login cookies are checked for tampering on every request, not just read.
• Pages are served with headers that stop other sites framing Preppi, stop browsers guessing file types and tell browsers to use only HTTPS.
• When you delete your account, everything saved under it is deleted with it. We check that every table that holds your data is covered.
• When a member of our team looks at a reply a learner flagged, the look is logged.

Where your data is held

Our database is hosted by Supabase in Singapore (region ap-southeast-1). What you type to the tutor is processed by our AI provider and may be processed outside the Philippines. See the Privacy notice.

Encryption

Information travels between your browser and Preppi over an encrypted (HTTPS) connection. Our database provider, Supabase, says on its security page: "All customer data is encrypted at rest with AES-256 and in transit via TLS." (read on 2026-10-26)

Card details

Preppi takes no payments today, so it never sees card details. If we add payments, we will use a payment provider's own checkout so that card details never pass through our servers.

Telling us about a problem

If you find a way into information that is not yours, or any other weakness, please tell us with the contact form and start your message with "Security". Tell us what you found and how to see it. Please do not look at other people's information or disrupt the service while you do. We will read it and reply.

If something goes wrong

If a breach puts personal data at risk, we will tell the National Privacy Commission within 72 hours of knowing about it and send a full report within five days, as Philippine rules (NPC Circular 16-03) require. We will tell the people affected, and for a learner under 18 their parent or guardian as well.