Privacy Policy

This Privacy Policy describes how PrepDrive (Android package: uz.intalim.online) collects, uses, and protects information about users of the PrepDrive mobile application.

By downloading, registering for, or using the application, you acknowledge that you have read and agree to the practices described in this Policy. If you do not agree, please discontinue use of the application.

We collect the following categories of information in connection with your use of the application:

Account & Identity Information. When registering, you provide your full name, phone number, and email address. A password is created by you and is not stored in plain text on our servers.

Device Identifiers. We collect technical identifiers such as device platform, model, manufacturer, operating system version, Android ID (on Android devices), and identifierForVendor (on iOS devices) via device_info_plus. These are transmitted in request headers (X-Device-ID, X-Device-Name) and used to associate your session and push notification token with your account.

Usage Data. Your interactions with the application — including lessons accessed, tests taken, videos viewed, and test results — are recorded on our servers in connection with your account.

Support Communications. If you submit a support ticket, we collect the text of your message and any files or images you choose to attach.

Referral & Subscription Data. Referral codes, subscription status, and account balance are synchronised with our servers.

The following permissions are declared in the application's Android manifest:

Location (GPS), microphone, and contacts permissions are not requested.

Registration requires a phone number, name, email address, and password. A one-time passcode (OTP) is delivered via SMS to verify your phone number. CAPTCHA verification is applied during registration and password-reset flows to prevent automated abuse.

Upon successful authentication, the server issues a JWT access token and refresh token. Both tokens are stored exclusively in the device's secure storage — EncryptedSharedPreferences on Android and Keychain on iOS — using the flutter_secure_storage library. Tokens are never written to unencrypted storage.

PrepDrive uses Firebase Cloud Messaging (FCM) to deliver push notifications. Upon sign-in or registration, the device's FCM token is transmitted to our servers via the /api/auth/fcm-token endpoint and associated with your account solely for the purpose of routing notifications to your device.

Local notifications may be stored on your device via flutter_local_notifications. On Android 13 and later, push notifications are only delivered after you grant the POST_NOTIFICATIONSpermission. You may revoke this permission at any time through your device's application settings.

PrepDrive supports balance top-ups and subscription purchases through the following payment providers: Payme, Click, and Uzum.

All payment flows are completed through the respective provider's website, which is opened in an external browser (url_launcher with LaunchMode.externalApplication). Card numbers, CVV codes, and other payment credentials are entered directly on the payment provider's page and are never transmitted through, or stored by, PrepDrive or its servers.

PrepDrive receives only a transaction status confirmation (success or failure) and subscription state update from the payment provider, which is used solely to reflect your subscription or balance in the application.

The application integrates Google Firebase Analytics to collect aggregated, anonymised data on how users interact with the application. This includes event data such as screen views and feature usage, as well as device attributes such as operating system version and device model.

Data collected through Firebase Analytics is processed by Google on its own infrastructure. For details on how Google handles this data, please refer to the Google Privacy Policy and the Firebase Privacy and Security documentation.

Analytics may associate events with approximate geographic area (for example, derived from IP address). PrepDrive does not receive your precise GPS location through this mechanism.

The following third-party services receive data in connection with normal application operation:

We do not sell, rent, or share your personal data with any party not listed above for commercial or marketing purposes.

The following non-sensitive preference data is stored locally on your device using shared_preferences and is not transmitted to our servers: application theme (light/dark), display language, text size setting, and a local copy of the FCM token. Notification display history may also be retained locally by the notification controller.

Uninstalling the application removes all locally stored data from your device.

All communication between the application and our backend (https://cdn.prepdrive.uz) is conducted exclusively over HTTPS using TLS encryption. Authentication tokens are stored in device-level secure storage as described in Section 4.

Network request logging via pretty_dio_logger is enabled only in debug builds and is disabled in production releases, ensuring that request data is not logged in deployed versions of the application.

Data retention

Active accounts. We retain your account profile, learning activity, and related data for as long as your account remains active.

Account deletion. After you confirm account deletion, your account enters a grace period of 30 days. During this time you may cancel deletion and restore your account. If deletion is not cancelled, personal data tied to the account is permanently removed from our production systems when the grace period ends, subject to limited exceptions where the law requires a longer retention (for example, certain financial records).

Support tickets. Support messages and attachments are typically retained for up to 24 months after the ticket is closed, for quality assurance and dispute handling, unless a shorter period applies by law.

Server and security logs. Technical and security logs may be retained for a limited period (typically up to 90 days) unless a longer period is required for incident investigation or legal compliance.

Retention periods may be updated; material changes will be reflected in this Policy or communicated as described in Section 14.

You may request the deletion of your account and associated personal data inside the PrepDrive app (Settings → account section): you must enter your password and type the word DELETE to confirm.

Upon submission of a deletion request, your account is placed in a scheduled-deletion state for a grace period of 30 (thirty) days. During this time you may cancel the request and restore your account from the in-app recovery screen. After the 30-day period expires without cancellation, associated personal data is permanently deleted from our production systems in line with Section 10, except where law requires retention.

You may also start or complete account deletion through our web account area: account.prepdrive.uz/auth/delete-account.

Subject to applicable law, you have the following rights with respect to your personal data:

To exercise any of the above rights, please contact us using the details in Section 15.

PrepDrive is not intended for children under 13. We do not knowingly collect personal information from anyone under 13. If you are a parent or guardian and believe a child under 13 has provided us with personal data, please contact us at the email in Section 15 and we will take steps to delete such information where required by law.

Users between 13 and 17 should use the service with the involvement of a parent or guardian where local law requires parental consent for online services.

We reserve the right to update this Privacy Policy at any time. In the event of material changes, we will notify users through an in-application notice or push notification prior to the changes taking effect. The updated Policy will be accessible within the application and at prepdrive.uz.

Your continued use of the application after the effective date of any update constitutes acceptance of the revised Policy.

For questions, requests, or complaints relating to this Privacy Policy or the processing of your personal data, please contact us: