PrepLab

Privacy Policy

Last updated: November 5, 2026

PrepLab is currently available to users located in the United States only. This Privacy Policy is written for U.S. users; we do not offer the Service in the EU/UK/other regions at this time.

1. Who we are

PrepLab ("we," "our," "us") is an AI-powered interview preparation platform available on the web, on iOS, and on Android (Google Play). This Privacy Policy explains what information we collect, why, and who we share it with. It applies to users in the United States. We do not currently market or sell the service in the EU/UK; if that changes, we will publish an addendum.

Questions or requests: privacy@preplab.ai.

2. Information we collect

2.1 Information you give us

  • Account: name, email, password (hashed with bcrypt), or your Google / Apple / LinkedIn sign-in identifier.
  • Profile: target role, seniority, industry, company type, weekly goals.
  • Interview content: your text answers and, in voice mode, your spoken answers (live microphone audio) during mock interviews (voice mode is available on web and on the mobile apps), plus the target role, company, and any job description you enter. See §4.1 for how this is processed by a third-party AI service.
  • Resume content: the resume file you upload for a Resume Review (text is extracted and stored; the original file is discarded after extraction). Resume text is sent to the AI service described in §4.1 only if you upload a resume.
  • Coach messages: what you type into the AI Coach.
  • Payment info: handled by Stripe (web), or by Apple (iOS) or Google Play (Android) via RevenueCat. We never see your card, Apple ID password, or Google account password.
  • Support messages: anything you send us by email.

2.2 Information collected automatically

  • Usage: features used, interview frequency, session duration, screens visited. In the mobile apps this is collected with Google Firebase Analytics (see §4.3).
  • Install source: on Android, the Google Play install referrer (which ad or link led to your install). On iOS and Android, a referral or ad click identifier if you arrived through one.
  • Device / log: IP address, user-agent, OS, app version, crash logs, request timestamps.
  • Cookies / local storage: session cookie for login, plus preferences (theme, dismissed prompts). We do not set advertising or third-party tracking cookies in the web app.

On iOS, the app asks for App Tracking Transparency permission after onboarding. Only if you tap Allow do we read your device's advertising identifier (IDFA) and pass it to RevenueCat for ad attribution. If you tap Ask App Not to Track, we do not read it. On Android we do not collect or send your Advertising ID.

How we collect it: directly from you when you type, speak, upload, or sign in; automatically from your device and our servers when you use the app (through our own servers and the analytics, crash-reporting, and purchase SDKs listed in §4); and from Apple, Google, or LinkedIn when you choose to sign in with them (we receive your name, email, and a sign-in identifier). The mobile apps ask for permission to use your microphone (to capture spoken interview answers) and, if you opt in, to send notifications.

3. How we use your information

  • Run the service: generate interview questions, run the AI interviewer, produce spoken interviewer audio, score your answers and write feedback, build prep plans, render report cards, and power the AI Coach and Resume Review. This is done by sending the content you provide to the third-party AI service in §4.1.
  • Manage your account, credits, and billing.
  • Send transactional email (verification, password reset, magic-link sign-in, purchase receipts, daily reminders you opt into).
  • Authenticate you, process purchases and restore subscriptions, and grant referral rewards.
  • Detect fraud and abuse, debug crashes, and improve product quality (including aggregate analytics on how features are used).
  • Measure marketing effectiveness (which ad brought you here) - see §4.4.

We do not sell your personal information. We do not use your interview transcripts or resume content to train AI models, and we do not use your data for any purpose not listed in this section.

4. Who we share data with

We share the minimum data needed with the following service providers. Each link goes to the provider's own privacy policy.

4.1 Third-party AI processing (Google Gemini)

PrepLab uses Google Gemini, an AI service from Google LLC, accessed through the Gemini API, to power the AI interviewer. When you use the app, the following personal data is sent to Google Gemini:

  • Your interview answers, both typed text and live voice audio from your microphone.
  • The target role, company, and job description you enter.
  • Your resume text, only if you upload a resume.
  • Your AI Coach messages.

Google Gemini uses this data to run the AI interviewer, generate interview questions and prep plans, write feedback and scores, and generate the interviewer's spoken audio. We do not send your name, email address, or account ID with these requests.

We use Google's paid Gemini API terms. Under those terms, Google does not use your content to train or improve its models and processes it only to provide the service to us. Google is bound to protect this data at least as strongly as this Privacy Policy does. Gemini API terms

Your permission: before any of this data is sent to Google Gemini, the mobile app shows a screen that explains what is sent and to whom, and asks you to choose Agree or Not now. If you choose Not now, the data is not sent. You can review or change your choice at any time in Settings.

4.2 Service providers (run the product)

  • Replit (hosting + Postgres): hosts the web application and its database, where web accounts, interviews, reports, and Coach history live.
  • Railway (hosting) and Supabase (Postgres): host the backend and database for the iOS and Android apps, where your account, interviews, reports, and Coach history live. Railway privacy | Supabase privacy Privacy
  • Resend (transactional email): receives your email address and the contents of transactional emails (verification, magic links, receipts, reminders). Privacy
  • Twilio SendGrid (marketing email contacts): receives your email address and first name for our product-update and lifecycle mailing lists (marketing contacts only; transactional emails are sent through Resend). Privacy
  • Stripe (web payments): processes web subscriptions and credit-pack purchases. Stripe collects your payment details directly; we receive a customer ID, the last four digits of the card, and billing status. Privacy
  • Simli (web voice avatar): on the web voice-mode interview, your microphone audio is streamed to Simli to drive the talking avatar. Audio is processed in real time and is not retained by Simli or by us once the session ends. Privacy
  • Google Gemini Live Audio API (mobile voice interviews): part of the Google Gemini service in §4.1. On the iOS and Android apps, voice-mode interviews stream your microphone audio in real time to Google so it can understand and respond to your spoken answers. We do not store the audio; only the resulting text transcript is saved. Gemini API terms
  • Sentry (crash reporting & diagnostics): receives crash logs and diagnostic data (we do not send default personal information) from the mobile apps and backend to help us detect and fix bugs. Privacy

4.3 Mobile billing

  • Apple (App Store): all iOS purchases are processed by Apple. Apple shares the transaction with us via RevenueCat. Privacy
  • Google Play (Google Play Store): all Android purchases are processed by Google Play. Google shares the transaction with us via RevenueCat. Privacy
  • RevenueCat: middleware that records your purchase, your anonymized App Store or Google Play user ID, your subscription status, and any attribution attributes we forward (see 4.4). Privacy

4.4 Analytics & advertising

If you arrived from one of our ads, we forward conversion events (started trial, purchased pack, etc.) to the ad network so we can measure spend. We also use Google Firebase Analytics in the mobile apps to measure app usage (screens, feature use, and conversion events) and RevenueCat to attribute purchases. Google privacy. For ad networks we send SHA-256-hashed email and a hashed user ID, plus the click identifier the network gave us. We do not send your interview content, your resume, or your Coach messages.

  • Meta (Facebook / Instagram) - Conversions API: hashed email, hashed user ID, IP, user-agent, fbc click ID, and the event name (StartTrial, Subscribe, Purchase). We do not send IDFA or Android Advertising ID. Privacy
  • TikTok - Events API: hashed email, hashed user ID, IP, user-agent, ttclid, and the event name. Privacy
  • Google Ads - Enhanced Conversions: hashed email and the gclid click ID. On Android, Google Play install referrer data is used to attribute installs. Privacy

4.5 Other disclosures

  • Sign-in providers: if you sign in with Google, Apple, or LinkedIn, that provider tells us your name, email, and sign-in identifier under its own privacy policy.
  • Legal: if compelled by valid legal process or to investigate fraud or abuse.
  • Business transfers: if PrepLab is acquired or merges, your data may transfer to the new owner under this same policy.

5. Data retention

  • Account: kept until you delete it; deletion takes effect within 30 days.
  • Interview transcripts: paid users keep transcript access for 30 days after each interview; report scores are kept for the life of the account.
  • Resume text: kept until you delete the review or your account.
  • Coach conversations: kept until you delete them or your account.
  • Voice audio: not retained - streamed to Simli (web) or Google Gemini's live audio API (iOS and Android) and discarded when the session ends; only the text transcript is kept.
  • Payment records: 7 years (US tax / accounting requirement).
  • Server logs: 30 days.

6. Your choices

  • Delete your account: in the iOS or Android app, Settings → Delete account. On the web, email privacy@preplab.ai.
  • Access / export / correct your data: email privacy@preplab.ai. We respond within 30 days.
  • Opt out of marketing email: use the unsubscribe link at the bottom of any marketing email. Transactional email (receipts, password resets) cannot be turned off while your account is active.
  • Manage your subscription / cancel: iOS - Settings → Apple ID → Subscriptions; Android - Google Play → Payments & subscriptions; Web - Settings → Manage subscription (Stripe portal).

7. State-specific rights (US)

If you live in California (CCPA/CPRA), Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), or Utah (UCPA), you have the right to know what personal information we hold, to delete it, to correct it, and to opt out of "sale" or "sharing" for cross-context behavioral advertising. We do not sell personal information for money. Forwarding hashed identifiers to Meta, TikTok, and Google Ads for conversion measurement may be considered "sharing" under California law; you can opt out by emailing privacy@preplab.ai with the subject line "Do Not Share."

You may designate an authorized agent. We will not discriminate against you for exercising these rights.

8. Security

  • HTTPS for all traffic.
  • Passwords hashed with bcrypt; sessions are signed, httpOnly cookies.
  • CSRF protection on web write endpoints; rate limiting on auth.
  • Database access is restricted to the application servers.

No system is 100% secure. If we detect a breach affecting your data, we will notify you as required by US state breach-notification laws.

9. Children

PrepLab is not directed at and may not be used by anyone under 16. If we learn we have collected data from someone under 16, we will delete it.

10. Changes

We will update the Effective Date above and, for material changes, notify you by email or in-app notice before the change takes effect.

11. Contact

Privacy questions: privacy@preplab.ai. General support: hello@preplab.ai.

By using PrepLab, you acknowledge that you have read this Privacy Policy and our Terms of Service.

PrivacyTermsRefundsSupporthello@preplab.ai