Privacy Policy

Last updated: 2026-05-15 · Effective: 2026-05-15

This Privacy Policy explains how PreppHint, a brand of Nixologic ("we", "us", "our") collects, uses, and shares information when you use the Chrome Audio Capture browser extension (the "Extension"), the website at audio.prepphint.com (the "Site"), or the Pro subscription service. "PreppHint" is our trading name; "Nixologic" is the registered legal entity that handles billing and appears on receipts.

1. Summary — what we do and don't do

• ✅ We collect your email address and (if you use Google sign-in) your name and profile picture, solely to identify your account and your subscription status.
• ✅ We collect your subscription state from Paddle (active / canceled / past-due, current period end, plan name) to gate Pro features.
• ❌ We do not upload, store, or have access to the audio you record. Audio is captured and encoded inside your browser and saved to your local Downloads folder.
• ❌ We do not sell personal information. We do not run advertising trackers, analytics that profile you across sites, or tracking pixels.

2. What we collect

2.1 Account information

When you sign in to manage your Pro subscription, our identity provider (Supabase Auth) records:

• Your email address (required);
• Your Supabase user ID (a random UUID);
• If you choose "Continue with Google": your Google display name and profile picture URL (provided by Google);
• The timestamp of your sign-in and most recent activity.

2.2 Subscription information

When you subscribe to Pro, our payment processor (Paddle) records the information necessary to process payment (your name, billing address, country, card details, transaction history). Paddle is the Merchant of Record and the controller of that information. We receive a minimal payload via webhook containing: subscription ID, customer ID, plan, status, and current period end. We do not see your card number or full billing address.

2.3 Audio recordings — explicitly not collected

The Extension uses Chrome's tabCapture API to record the audio stream of a single browser tab. The audio is encoded entirely within your browser using a WebWorker (Lame for MP3, raw PCM for WAV) and saved to your local Downloads folder via the downloads permission. At no point does any audio data leave your device. We cannot recover recordings, and we do not store, transcribe, analyze, or share them.

2.4 Diagnostic information

Our backend (Supabase Edge Functions) may write minimal request logs (timestamp, edge function name, response status) for operational debugging. These logs do not contain your email or audio content and are retained for up to 30 days.

3. Why we use this information (legal bases)

• To provide the Service — verify your identity, check your Pro entitlement, deliver subscription receipts. (Legal basis: performance of a contract.)
• To process payments — Paddle handles this on our behalf. (Legal basis: performance of a contract.)
• To meet legal obligations — tax and accounting records. (Legal basis: legal obligation.)
• To improve the Service — operational debugging, security monitoring. (Legal basis: legitimate interest.)

4. Sub-processors

We use the following third-party services to operate the Service. Each is contractually bound to handle data securely and only on our instructions:

• Supabase Inc. — authentication and database (data stored in ap-south-1, Mumbai). supabase.com/privacy
• Paddle.com Inc. — payment processing, Merchant of Record. paddle.com/legal/privacy
• Google LLC — optional OAuth identity provider (only if you click "Continue with Google"). policies.google.com/privacy
• Cloudflare, Inc. — website hosting (Cloudflare Pages) and CDN. cloudflare.com/privacypolicy

5. International transfers

Our infrastructure is hosted in India (Supabase, ap-south-1) and the United States (Paddle, Cloudflare). If you access the Service from outside these regions, your information will be transferred to and processed in those countries. Where the law requires, we rely on Standard Contractual Clauses approved by the European Commission to safeguard such transfers.

6. Your rights

Depending on where you live, you may have the following rights regarding your personal information:

• Access — request a copy of what we hold about you;
• Rectification — ask us to correct inaccurate data;
• Erasure ("right to be forgotten") — ask us to delete your account and associated records (subject to legal-retention requirements);
• Restriction / objection — ask us to limit or stop processing your data;
• Portability — receive your data in a portable format;
• Withdraw consent — for any processing based on consent;
• Complain — lodge a complaint with your local data-protection authority.

To exercise any of these rights, email hello@prepphint.com. We respond within 30 days.

7. Data retention

Account and subscription records are retained while your account exists and for up to seven years after closure to comply with tax and accounting laws. You can request earlier deletion of personal data not subject to legal retention by emailing us. Server-side request logs are deleted after 30 days. Local browser storage (the Extension's session cache) lives on your device until you uninstall the Extension or clear browser data.

8. Cookies, tracking & storage

The Site uses the following browser storage:

• localStorage / sessionStorage — to keep you signed in across page loads and to carry the extension ID across the OAuth redirect. No third-party advertising cookies are set.
• chrome.storage.local (inside the Extension) — your Supabase session, cached license status, and the proLicenseMirror used by the service worker. This data does not leave your browser.
• chrome.storage.sync (inside the Extension) — your settings (recording format, quality, time limit, multi-tab preference). Chrome may sync this across devices using your Google account if Chrome sync is enabled.

The Site does not use third-party analytics or advertising trackers.

9. Children's privacy

The Service is not directed to children under 13 (or under 16 where the EU GDPR applies). We do not knowingly collect personal information from children. If you believe a child has provided us personal information, please contact us and we will delete it.

10. Security

We use industry-standard measures to protect your data, including TLS encryption in transit, encryption at rest by our infrastructure providers, row-level security on the licenses database, and HMAC verification of webhook callbacks. No system is perfectly secure; if we become aware of a personal-data breach affecting you, we will notify you and the relevant data-protection authority as required by law.

11. Changes to this policy

We may update this Privacy Policy from time to time. The "Last updated" date at the top reflects the most recent change. Material changes will be announced via email or a banner on the Site at least seven days before they take effect.

12. Contact & data controller

Data controller: PreppHint (Nixologic)
Near Railway Line, Ketari Bagan
Ranchi, Jharkhand 834010, India
Email: hello@prepphint.com

For California residents: under the CCPA, you have the right to know what personal information we collect about you, to delete it, to opt out of the sale of personal information (we do not sell personal information), and to not be discriminated against for exercising any of these rights. To make a request, email us at the address above.