Ordination Prep — Privacy Policy
Effective Date: August 19, 2026 Version: 1.0
This Privacy Policy describes how Ian Engebrecht ("Owner," "we," "us," or "our") collects, uses, stores, and protects your personal information when you use the Ordination Prep web application ("the Service"). This Privacy Policy is incorporated into and subject to our Terms of Use.
We believe you should understand exactly what data we collect and why. This policy is written to be direct and specific rather than vague or overly broad.
1. Information We Collect
We collect the following categories of information. This list is comprehensive — we do not intentionally collect data beyond what is described here. Routine system metadata (such as authentication protocol fields) may also be stored as part of normal service operation.
1.1. Information Received from Your OAuth Provider
You sign in to the Service through a third-party OAuth provider (currently Google and GitHub). We do not offer username/password accounts. When you sign in, we receive:
| Data | Purpose |
|---|---|
| Name | Display name and account identification |
| Email address | Account identification and communication |
| Profile image URL | Display within the Service |
| OAuth account identifiers (provider name, provider account ID) | Linking your OAuth identity to your account |
| OAuth tokens (access token, refresh token, ID token, token type, scope, expiry) | Maintaining your authenticated session and verifying your identity |
1.2. Information You Provide During Onboarding
After your first sign-in, we ask you to complete an onboarding profile. You provide:
| Data | Purpose |
|---|---|
| First name and last name | Personalizing your experience (you may correct what the OAuth provider supplied) |
| Email address | Communication (you may correct what the OAuth provider supplied) |
| Church, school, or organization affiliation | Contextualizing your study experience |
| Daily study target (in minutes) | Tracking your study goals |
| IANA timezone | Displaying times correctly and calculating your study calendar |
1.3. Terms Acceptance Record
When you accept the Terms of Use, we record:
| Data | Purpose |
|---|---|
| Timestamp of acceptance | Legal record of when you agreed |
| Version string of the accepted Terms | Legal record of which version you agreed to |
1.4. Study Activity Data
As you use the Service, we collect data about your study sessions. This data powers spaced repetition scheduling, progress tracking, and study analytics.
| Data | Purpose |
|---|---|
| Question attempts (which question, study mode used, your typed answer, self-grade 0–5, AI grade label, normalized score 0–1, AI feedback text, response latency in milliseconds, timestamp) | Tracking your performance and enabling spaced repetition scheduling |
| Spaced repetition card state (ease factor, interval, repetition count, due date, last result) | Scheduling future review using the SM-2 algorithm |
| Study time logs (study mode, start timestamp, end timestamp, duration, calendar day, client event ID) | Tracking study time toward your daily goal |
1.5. System-Generated Data
The Service automatically creates and maintains the following:
| Data | Purpose |
|---|---|
| User ID (a cuid — a unique identifier) | Internal identification of your account |
| Account creation timestamp | Record keeping |
| Last updated timestamp | Record keeping |
| User role (USER or ADMIN) | Access control within the Service |
| Profile completion flag | Determining whether to show onboarding |
| Theme preference (dark, light, or terminal) | Displaying the interface in your chosen theme |
2. Information We Do Not Collect
For clarity, the Service does not collect:
- Payment or financial information (the Service is free)
- Location data beyond your timezone
- Health or biometric data
- Advertising identifiers
- Social media data beyond what is received through OAuth sign-in
- Analytics or tracking pixels
- Cookies beyond the session authentication cookie (see Section 5)
3. How We Use Your Information
We use your information for the following purposes and no others:
3.1. Operating the Service. Authenticating your identity, maintaining your session, and delivering study functionality.
3.2. Personalizing your experience. Displaying your name and profile image, applying your theme preference, showing study progress in your timezone, and tracking your daily study goal.
3.3. Spaced repetition scheduling. Using your study performance data to schedule question reviews at optimal intervals.
3.4. AI-assisted grading. Sending question text, expected answers, and your typed answers to third-party AI providers for automated grading (see Section 4.1 for details).
3.5. Communication. Contacting you about your account or material changes to the Service or this Privacy Policy, using the email address associated with your account.
3.6. Legal compliance. Maintaining records required by law and responding to lawful requests from authorities.
4. Third-Party Data Sharing
We share your data with third parties only as described below. We do not sell your personal information to anyone, and we do not share your data for advertising purposes.
4.1. AI Grading Providers
When you submit a typed answer for AI-assisted grading, the following data is sent to a third-party AI service provider:
- The question text
- The expected answer (model answer)
- Your typed answer
The following data is never included in AI grading requests: your name, email address, organization affiliation, or any other profile information.
The AI provider used is configurable and may include OpenAI, Anthropic, or an OpenAI-compatible endpoint. We select providers that offer data processing agreements and we opt out of model training on user data where such options are available. Once data is transmitted to an AI provider for grading, the provider may retain it for a limited period in accordance with its own data retention policies (typically up to 30 days for abuse monitoring and safety purposes). This retention is outside our direct control. For more information about AI-assisted grading, see Section 7.6 of our Terms of Use.
4.2. Hosting and Infrastructure
The Service is hosted on Railway (Docker containers), and the database is hosted on Railway Postgres. These infrastructure providers process your data as necessary to deliver the Service. They act as data processors on our behalf.
4.3. OAuth Providers (Google and GitHub)
During sign-in, a standard OAuth token exchange occurs with Google or GitHub. We receive profile data from these providers. We do not send your study data, progress, or any other Service data back to them.
4.4. No Other Sharing
Beyond what is described in Sections 4.1 through 4.3, we do not share your personal information with any third party, except:
- When required by law, court order, or government request
- To protect the rights, safety, or property of the Owner, users of the Service, or the public
- In connection with a transfer of the Service to a new owner (see Section 12)
5. Cookies and Tracking
The Service uses a single cookie: a session authentication token. This cookie is:
- An httpOnly cookie (not accessible to client-side JavaScript)
- Used solely to maintain your authenticated session
- Not used for tracking, analytics, or advertising
We do not use tracking pixels, web beacons, fingerprinting, or any other tracking technologies.
6. Data Retention
6.1. Active accounts. Your account data and study activity data are retained for as long as your account remains active.
6.2. Account deletion. You may request deletion of your account and all associated data by emailing legal@ordinationprep.com. Upon receiving a verified deletion request, we will delete your data within 30 days. This deletion applies to data within our systems. Data previously transmitted to third-party AI providers for grading purposes is subject to those providers' own retention and deletion policies (see Section 4.1). Some data may persist in encrypted backups for up to 90 days after deletion, but will not be actively used or accessible.
6.3. Inactive accounts. We do not currently delete inactive accounts automatically. However, as stated in Section 8.1 of our Terms of Use, we reserve the right to terminate accounts for extended inactivity.
7. Data Security
We implement the following measures to protect your data:
7.1. No passwords stored. Authentication is handled entirely through OAuth providers. We never store, process, or have access to your password.
7.2. Encryption in transit. All data transmitted between your browser and the Service is encrypted using HTTPS.
7.3. Database access controls. The database is not publicly accessible. Access is restricted to the application server.
7.4. Session security. Session tokens are stored as httpOnly cookies, preventing access by client-side scripts.
7.5. Access control. The Service enforces role-based access control (ADMIN vs. USER) and validates all inputs on the server side.
7.6. No system is perfectly secure. While we take reasonable measures to protect your data, no method of electronic storage or transmission is 100% secure. We cannot guarantee absolute security.
8. Data Breach Notification
In the event of a data breach that compromises your personal information:
8.1. We will investigate the breach promptly and take steps to contain it.
8.2. We will notify affected users by email within 30 days of confirming the breach, describing the nature of the breach, the data involved, and steps we are taking in response.
8.3. Where required by applicable law (including the Colorado Privacy Act), we will notify the appropriate state attorney general or regulatory authority within the timeframes required by that law.
9. Children's Privacy
9.1. The Service is intended for users who are 18 years of age or older, as stated in Section 2.1 of our Terms of Use.
9.2. We do not knowingly collect personal information from anyone under the age of 18. If we become aware that we have collected personal information from a person under 18, we will delete that information promptly.
9.3. If you believe that a person under 18 has provided us with personal information, please contact us at legal@ordinationprep.com.
10. Your Privacy Rights
10.1. Rights Available to All Users
Regardless of where you are located, you may:
- Access your data. Request a copy of the personal information we hold about you.
- Correct your data. Update or correct inaccurate personal information. You can update your name, email, and organization affiliation directly within the Service. For other corrections, contact us.
- Delete your data. Request deletion of your account and all associated personal information by emailing legal@ordinationprep.com.
10.2. Colorado Privacy Act Rights
Although the Service may not currently meet the processing thresholds that trigger obligations under the Colorado Privacy Act (CPA), we extend the following rights to all users as a matter of good practice:
- Right to know. You have the right to know whether we are processing your personal data and to access that data.
- Right to correction. You have the right to correct inaccuracies in your personal data.
- Right to deletion. You have the right to request deletion of your personal data.
- Right to data portability. You have the right to obtain your personal data in a portable, readily usable format.
- Right to opt out of certain processing. We do not sell your personal data, use it for targeted advertising, or engage in profiling in furtherance of decisions that produce legal or similarly significant effects. Accordingly, there is no processing of this nature to opt out of.
10.3. Exercising Your Rights
To exercise any of the rights described above, contact us at legal@ordinationprep.com. We will respond to your request within 45 days. If we need additional time, we will notify you of the reason and extension period.
We will verify your identity before fulfilling any request by confirming the email address associated with your account.
10.4. Appeals
If we decline your privacy rights request, you may appeal by contacting us at legal@ordinationprep.com with the subject line "Privacy Rights Appeal." We will respond to your appeal within 45 days. If you are not satisfied with our response to your appeal, you may contact the Colorado Attorney General at https://coag.gov. If we deny your appeal, our response will include instructions for contacting the Colorado Attorney General.
10.5. Non-Discrimination
We will not discriminate against you for exercising your privacy rights. Exercising your rights will not affect your access to or use of the Service, except where deletion of your account data necessarily ends your ability to use the Service.
11. Changes to This Privacy Policy
11.1. We may update this Privacy Policy from time to time. When we do, we will revise the "Effective Date" and "Version" at the top of this document.
11.2. We will notify you of material changes by posting a notice within the Service or sending a notification to the email address associated with your account.
11.3. Your continued use of the Service after the revised Privacy Policy takes effect constitutes your acceptance of the revised Privacy Policy. If you do not agree to the revised Privacy Policy, you must stop using the Service.
12. Business Transfers
If the Service or its assets are acquired by, merged with, or transferred to another entity, your personal information may be transferred as part of that transaction. We will notify you before your personal information becomes subject to a different privacy policy.
13. Governing Law
This Privacy Policy is governed by and construed in accordance with the laws of the State of Colorado, United States, consistent with Section 13 of our Terms of Use.
14. Contact Information
If you have questions about this Privacy Policy, your data, or your privacy rights, please contact:
Ian Engebrecht Email: legal@ordinationprep.com
Last updated: August 19, 2026