Legal
Privacy policy
Superheat is built so that there is very little to write a privacy policy about. This page says exactly what that means, in the order somebody would actually ask.
Last updated Updated August 18, 2026
The short version
- If you are a technician using the app, you have no account and we never learn your name or email address.
- Your answers, your readiness figures and your exam date stay on your phone.
- If you are using a seat bought by a training program, four fields go to us: the seat code, a readiness number, how many questions you have answered, and your weakest subject area.
- Analytics carry a random identifier created when the app is installed, and nothing else.
- There is no advertising identifier, no tracking prompt, no ad network and no cross-app tracking.
- The only permission the app ever asks for is notifications, and only if you switch reminders on.
- We do not sell or share personal information, because we do not have any to sell.
Individual users have no account
There is no sign-up screen in the Superheat app. You are not asked for an email address, a phone number, a name or a password, and there is no way to supply one. There is no “continue with Google” and no anonymous account created behind the scenes.
The consequence, stated plainly because it is a real trade rather than a benefit: we cannot recover your progress if you lose your phone, and we cannot look up your history if you write to support. There is nothing to look up.
What is stored on your device
The app keeps two databases. The question bank ships inside the app and is read-only. A second, writable database holds everything about you, in the app’s own storage area, and is what the operating system removes when you uninstall.
| Table | What it holds |
|---|---|
| profile | One row: which certification path you chose, your exam date if you set one, your theme, whether haptics and reminders are on, an alias if you redeemed a cohort seat, the content version, an install-scoped random identifier, and when the row was created. |
| attempt | Every answer you have given: the question id, its subject area, whether you got it right, how many milliseconds you took, the mode, and when. |
| review_queue | Which questions are due for review and when, plus your streak on each. |
| mock | Each mock exam you started: which items, when it started, the deadline, and the result. |
| entitlement | What you have bought or redeemed, when it was last verified, and any expiry. |
| outbox | Items waiting to be sent when a connection returns: a cohort progress ping, a question defect report, or a code redemption. Nothing else is ever queued for sending. |
| clock | A high-water timestamp, so changing your device clock cannot skip the review schedule. |
None of that is uploaded for an anonymous user. There is no server table it could be written to, which is a stronger guarantee than an undertaking not to write to one.
Cohort seats: the four fields
If your training program bought you a seat, you enter an eight-character code and choose an alias. Your instructor needs to see how the class is doing, so the app sends a progress ping. It carries four fields and there is deliberately nowhere to add a fifth:
- seat_code — the code your instructor issued.
- readiness — a whole number from 0 to 100.
- answered — how many questions you have answered.
- weakest_topic — one of eighteen fixed subject-area identifiers. Free text is rejected by the database.
The request also carries a device hash, which is a salted SHA-256 of an install-scoped identifier computed on your phone. It is not a device serial number and not an advertising identifier. Its only job is to stop one code being redeemed on twenty handsets. The server stores that hash and cannot reverse it.
The endpoint rejects any request containing a field outside that list — it returns an error rather than ignoring the extra data. A future version of the app that started attaching your answers to a ping would fail on its first request instead of quietly succeeding.
Your alias is chosen by you and is limited to 40 characters. The database refuses an alias containing an “@”, so it cannot become a contact address. Your instructor sees the alias, the code, and the four fields above. They do not see your answers, your timings, your exam date or anything you typed.
Pings are rate-limited to one per hour per seat. Seats expire: 180 days after issue if never redeemed, 90 days after redemption otherwise. Deleting the seat deletes its pings. The full retention schedule.
Analytics and crash reports
The app records a fixed vocabulary of product events — a drill started, a citation expanded, a mock exam submitted, a purchase completed. Each event carries an install-scoped random identifier and a small number of non-identifying properties such as a question id or a subject area.
What an event may never carry is enforced centrally rather than left to whoever writes the call. A scrubber removes any property named for question text, options, an answer, an explanation, a quote, an alias, an email address, a name, a code, a seat code, a device identifier or an advertising identifier, and drops any string value longer than 64 characters on the grounds that prose is not a property. There is a test that feeds it a question stem and asserts the stem does not survive.
There is no advertising identifier, no IDFA, no App Tracking Transparency prompt, no advertising SDK, and no cross-app or cross-site tracking of any kind. Nothing about you is combined with data from another company. On iOS this is what allows the App Store privacy label to read “Data Not Linked to You”.
Crash reports carry the same breadcrumb vocabulary through the same scrubber. A crash report never contains question text or anything you typed.
Permissions
The app declares one permission: notifications. It is requested only after you set an exam date and switch reminders on, never on launch, and a refusal is a normal outcome — the countdown still shows inside the app and you are not asked again.
There is no camera, microphone, location, contacts, photo-library, storage or tracking permission. Several permissions that would otherwise arrive automatically through dependencies are explicitly blocked in the app configuration, including cloud-messaging receipt, install-referrer access, Wi-Fi state, and sixteen launcher-badge permissions that the notification library would have added. The check runs against the built package rather than against the configuration file, because what ships is the merged manifest.
Notifications are local
When you set an exam date, the whole reminder ladder — 14, 10, 7, 5, 3, 2, 1 and 0 days out — is computed on your phone at that moment and scheduled with the operating system. There is no push server, no APNs certificate, no Firebase project and no device token. No notification data leaves your phone, and we cannot send you a message.
A reminder names your current weakest subject area and how long a session takes. It is one notification a day at most, the ladder ends on exam day, and the app never sets a badge.
Purchases
Purchases in the app go through the App Store or Google Play. We never see or store a card number. The store tells us that an entitlement exists; it does not tell us who you are.
Entitlements are cached on your device and stay valid for 30 days without a successful check, so a paying user does not lose access in a basement. Restoring on a new device uses your store account, not an account with us.
Cohort seats are bought by an instructor through Stripe. Stripe handles the payment details and we receive the buyer’s email address and organization name in order to create their console access. No student is involved in that transaction.
This website
The public pages of this site set no cookies. There is no analytics script, no tag manager, no advertising pixel, no embedded video, no web font loaded from another company’s server, and no chat widget. Fonts are served from this site.
The sample questions page works by posting your chosen answer to the server and receiving the result. That request is not logged with anything that identifies you, is not stored, and nothing about it persists after the response. There is no sign-up and no email capture anywhere on the site.
The hosting provider keeps ordinary web-server request logs, which include IP addresses, for a short period. Those logs are the provider’s, are not used for analytics, and are covered in the retention schedule.
The instructor console at /cohorts sets one cookie: a signed, HTTP-only session cookie after an instructor signs in. It is not used for tracking.
Instructor accounts
An instructor is the only kind of person with an account, and the only email address anywhere in the system. Sign-in is by one-time link — there is no password to reuse or leak. We hold the address, the organization name, the cohorts, the seats and the pings described above.
An instructor can only ever see their own cohorts. That is enforced by row-level security in the database rather than by a check in the application, and there is a test that signs in as one instructor and asserts that another instructor’s cohort returns nothing.
Who else touches data
| Who | For what | What they see |
|---|---|---|
| Apple, Google | App distribution and in-app purchase | Your store account and payment, under their own privacy policies. Not shared with us. |
| RevenueCat | Reconciling store receipts to entitlements | An anonymous purchase identity and receipt data. No name, no email address from us. |
| Supabase | Database and API for cohort features | Instructor email addresses, cohorts, seat codes, aliases and the four ping fields. |
| Stripe | Cohort seat payment and invoicing | The buyer’s payment details and billing information. No student data. |
| PostHog | Product analytics | Scrubbed events with an install-scoped random id. Not configured in the current build. |
| Sentry | Crash reporting | Crash traces and scrubbed breadcrumbs. Not configured in the current build. |
Children
Superheat is professional certification material for people working in a trade. It is not directed to children, and it is not designed or marketed for anyone under 13. We do not knowingly collect personal information from a child — and for an individual user we do not collect personal information from anybody.
A training program may issue a seat to a student who is a minor. That seat is anonymous: an alias the student chooses and a code. If you are a parent or an instructor and you want a seat removed, write to privacy@superheatprep.com with the seat code and we will delete it and its pings.
Your rights, and how to exercise them
If you use the app anonymously, deleting your data does not require us. Delete the app. Everything described under “What is stored on your device” is removed by the operating system, and there is no server copy — not a backup, not an archive, not an analytics record tied to you. We cannot delete it for you and we cannot produce a copy of it, because we have never had it.
If you hold a cohort seat, write to privacy@superheatprep.com with the seat code. We will tell you what the four fields currently say and delete the seat and its pings on request. Your instructor can also delete a seat.
If you are an instructor, write to the same address for access, correction, export or deletion of your account and your cohorts. Deleting an instructor deletes their cohorts, seats and pings.
We do not sell personal information, we do not share it for cross-context behavioural advertising, and we do not profile anyone for automated decisions with legal effects. We will not discriminate against you for exercising a privacy right.
Changes to this policy
When this policy changes materially, the updated date at the top changes and the change is described here. A change that would cause more data to be collected than this page describes will be announced in the app before it takes effect, not retroactively.
Contact
Privacy questions: privacy@superheatprep.com. Anything else: support@superheatprep.com. Security reports have their own page.