What leaves your browser.

Your progress stays on your device

Answers, scores, streaks, XP, mastery, flagged questions, your exam date and your light/dark preference are all written to your browser's localStorage. That is a store only this site can read, it never travels with a request, and clearing your browser data erases it. No account is needed to use any free feature on this site, except the study assistant’s AI answers (see The study assistant). Buying Premium needs one.

Two things on certificates of completion stay in this browser too: the date each milestone was first reached (levlprep_milestones) and the name you type onto a certificate (levlprep_cert_name). The name is never sent anywhere, is not synced to an account or included in a backup, and a shared certificate link does not contain it.

So does the record behind the occasional suggestion to try another course here: which topics you have finished sessions in, as far as a suggestion needs to know, and which suggestions you have already been shown, so none is shown twice (levlprep_cross). It is not sent anywhere.

Keeping a copy of it

That last part cuts both ways. Nothing leaves your device, and nothing survives clearing your browser data, switching browsers, or moving to a new laptop. Signing in is the fix: it carries your XP, streak and activity, and the records that took real work to build — which questions you have seen, which you missed on a timed exam, your mastery and your per-domain statistics, and which textbook sections you have read. Three things stay deliberately device-local: an exam you are part-way through, so two devices cannot race on the same attempt; the order this browser shuffles answer choices into; and your light/dark preference.

So you can take the whole thing with you as a file — everything above, as readable JSON — and put it back on any browser. Your sign-in token is deliberately left out of it: that is a live credential, and a backup should not be a way to hand over an account.

Restoring merges the file into what is on this browser: XP, answered questions, review schedules and lesson progress from both are kept, so an old backup cannot undo newer studying. You will be asked to confirm first.

One anonymous counter

Each page load increments a counter so we can see which pages get used. It records the page path and the date, and nothing else — no IP address, no cookie, no user id, no session id, no device fingerprint, no referrer. There is no way to tell two visits apart, or to tell whether a visit was yours.

It works by calling a single database function that can only do one thing: add one to a (path, day) total. The table behind it is locked so that nothing — including this website — can read it back or write to it any other way.

Premium works the same way: when someone meets a Premium limit, opens the Premium dialog, starts a checkout or pays, a (course, step, day) total goes up by one. Again nothing else is recorded, and turning off site analytics below turns this off too.

When a page breaks

If a page hits a JavaScript error, the site sends us a short report so it can be fixed. This matters here because the site is a few hundred hand-written pages with no framework behind them: a page can break in a way that shows you an ordinary-looking screen where nothing works, and without this the only person who knows is you.

A report contains the page path, the error message, the file, line and column it came from, the first few lines of the stack, and your browser's user-agent string. That is everything needed to reproduce it and nothing else.

It does not contain anything you stored, answered or typed, your email address, an account id, a session id, or a referrer. There is no identifier in a report and no way to connect one to you or to another report. At most five are sent per page load, repeats within a load are sent once, and they go to the same locked table shape as the counter above — nothing, including this website, can read them back.

One caveat worth stating plainly rather than burying: an error message is written by the browser and can quote the thing it choked on, most often a fragment of a file that failed to parse. Messages are cut to 300 characters and we do not go looking for anything in them. If one ever turns out to carry something it should not, the fix is in the code that sends it.

This is covered by the same off switch as the analytics below: turning that off turns this off too, and nothing is sent rather than sent and discarded.

Reporting a problem with a question or page

Every question, and every A&P and Biology lesson, notes page and glossary, has a Report a problem link. It is optional and sends nothing until you press Send. A report contains the course, which question or page it is about, the reason you picked (wrong answer, unclear, typo, disagrees with current guidance, or something else) and, if you typed one, your note of up to 1,000 characters. It carries no account, email address, id or anything else about you, so do not put personal details in the note. Reports are kept so the question can be fixed, and like the counters above, nothing on this website can read them back.

Site analytics

Alongside that counter and the error reports above, we use Umami, a privacy-focused analytics tool, to understand how the site is actually used — which lessons get opened, and whether people who start an exam finish it. It sets no cookies and does not track you across other websites.

The Umami script itself is served from this site (a pinned copy, so no third-party script runs here). What it records goes first to this site's own server (api.levlprep.com), which passes it on to Umami Cloud, where it is stored for us. Our server forwards exactly what your browser sent, plus your IP address so the country can be worked out and your browser's user-agent string; it keeps none of it. It also drops visits from cloud servers and automated browsers, so the numbers count people rather than crawlers. Umami collects more than our own counter does. On each page view it records:

• The page you are on and the referrer — the page or search that sent you here.
• Your browser, operating system, device type and screen size.
• Your country, worked out from your IP address. The IP address itself is not stored.
• A visitor identifier made by hashing your IP address and browser together with a secret that changes daily. This is what lets it tell one visit from another within a day. It cannot be reversed to find you, and because the secret changes, it cannot link today's visit to tomorrow's.

We also record a small number of milestones, so the site can tell whether a feature works rather than just whether it was opened: an exam being started and finished (with the score as a band such as "70-79", never an exact result), a practice, flashcard or scenario session being started and finished, a lesson being completed, a chapter or course milestone being reached, which kind of next step was picked at the end of a session (one word, such as review or lesson), and a share button being used (whether the share went through, as one word, never what was shared or with whom). When you arrive from a link the site itself sent you — a study reminder, a reminder email, or a link someone shared — that is recorded as one word (push, email or share), and the tag is removed from the address bar as the page opens.

A few more things are recorded, all as coarse as they can be while still being useful:

• Where this browser first came from, as one word worked out on the first visit (such as tiktok, google or direct). It is kept in this browser (levlprep_first) and added to the events above. If you buy a pass, the same word goes with the order to our payment provider, so we can tell which channel led to a sale.
• Your answer, if you give one, to a one-time question asking how you found LevlPrep. You can skip it, and it is not asked again either way.
• On notes and lesson pages, how far down you read and for how long, as bands such as "50-75" (percent of the page) and "3-10" (minutes of active reading).
• If you leave an exam partway through, the question you stopped at out of how many.
• For about one visit in three, how fast the page loaded and responded, as bands.
• Three quick clicks on the same spot, a sign that something did not respond, with the page and the label of what was clicked; and the first lines of the first error on a page.
• On the homepage, if you open one of the topics from our videos, its course and its place in the list.
• If you set an exam date, how many weeks away it is, as a band such as "4-8". The date itself stays in your browser.
• When a pass is bought or refunded, the course, the pass and the amount in whole dollars, counted by our server rather than your browser.

Answers, as totals only. When you answer a practice or exam question, its id, whether you got it right, roughly how many seconds you spent and its topic are added to a per-day total for that question in our own database. Nothing else goes with it: no account, no browser id and no IP address, so the totals can show that a question is hard, never who found it hard. They are written through the same kind of locked function as the counter above, and nothing on this website can read them back. These are not sent to Umami.

One more milestone answers a question the rest cannot: did studying here stick. Once a day at most, this browser sends how many separate days it has studied, and how long ago its first visit was — as a band such as "d2-7", not a date. The dates behind that band are kept in this browser's own localStorage (levlprep_visits) and never leave it, because the visitor identifier above is deliberately useless across days. No identifier is created here, nothing is sent that could pick your browser out of a crowd, and clearing your browser data erases the history along with everything else. It is covered by the same off switch as the rest of this section.

If your browser sends a Do Not Track signal, this is switched off for you entirely and nothing above is collected. Blocking it with an ad blocker or privacy extension works too, and nothing on the site depends on it.

If you are signed in, your visits also carry an account tag: a one-way hash of your account's internal id, never your email address, so that a visit on your phone and one on your laptop can be read as the same person. Someone holding only Umami's data cannot turn it back into your account. Nothing in Umami is connected to your progress or to the study assistant. Umami acts as our processor and the data is never sold, shared or used for advertising.

You can also just switch it off here, for this browser, without installing anything (adding ?notrack=1 to any page address does the same). The switch covers everything in this section, the answer totals included:

Study reminders

The site can send you one notification a day, at a time you pick, when you actually have questions due for review or a streak about to lapse. It is off unless you turn it on, and nothing about it runs until you do.

What it needs to work: the address your browser’s own push service gives us, which is what a notification is delivered to. Alongside it we keep the time your next reminder is due and the sentence it will say — that is all.

The number in that sentence is worked out in your browser, from the study records that never leave it. We are told “12” and a time; we are not told what the twelve are, which subjects you study, or anything you have answered. Turning reminders off deletes the row, rather than flagging it as off.

It also stops on its own. Three reminders with no sign that you have come back and it goes quiet until you open the site again — there is no re-engagement campaign here and no second notification because the first was ignored.

The Premium waitlist

Before Premium went on sale on 1 October 2026, a card at the end of a practice session offered to tell you when it launched. It was off unless you pressed it and typed an address.

If you do, we store your email address, which course you asked about, the date, and which card you pressed — nothing about your progress or your answers. We use it to send one email about Premium launching for that course, with an unsubscribe link, and for nothing else: it is not a newsletter and is never shared.

Deleting your account removes any waitlist entry under the same address. If you joined without an account, email us at the address at the bottom of this page and we will remove it.

Signing in is optional

If you create an account, the same progress described above is also copied to a row in our database so it follows you to another device. In that case we store:

• Your email address, used to sign you in and nothing else.
• Your progress data — the same values already on your device.

We send you email only when you ask us to, or about something you bought. Four kinds are about getting you into your account: confirming a new account, a sign-in link if you request one, a password reset, and a confirmation if you change your address. The fifth is the study reminder above, which is off unless you switch it on, only exists for browsers that cannot do notifications, arrives at most once a day, and carries a one-click unsubscribe that needs no sign-in. The sixth is a single notice, three days before a Premium pass you bought ends. It is about your purchase rather than marketing, so it is sent without a separate opt-in and has no unsubscribe link, and it goes once per pass. Separately, if you joined the Premium waitlist, you get one email about the launch. Polar, which handles payments, also emails you a receipt when you buy. There is still no newsletter. Our emails are delivered by Resend, acting as our processor: it receives the address and the message, and nothing else.

The data is never sold, shared or used for advertising. Accounts and storage are handled by Supabase, acting as our processor; each account can read and write only its own row, enforced by the database rather than by the app.

You can delete your account yourself, from the site. Open the account menu in the header and choose Delete account. It removes your account, your email address and the synced copy of your progress immediately and permanently; nobody has to approve it and there is nothing to wait for. Because your progress also lives in this browser separately from the account, the same screen offers to erase that too — and offers you a backup file first, since this is the one thing on the site that deletes your work on purpose. This used to be an email request.

If the account holds a Premium pass, deleting the account deletes our record of the pass with it, and the pass ends; it is not refunded (take a refund first if you are within the 7 days). Polar, as the seller, keeps its own record of the order, because tax and accounting law requires it to; deleting your account here does not delete that, and Polar’s own privacy policy covers it.

If the sign-in box offers a provider button — Google, Apple or GitHub — using it is optional and never required. If you do, that provider handles the sign-in itself and therefore learns that you signed in here and when; we receive your email address from them and nothing else, and no other route into your account sends them anything. Signing in with an email and password, or with a sign-in link, involves no provider at all.

Buying a Premium pass

Premium passes are sold by Polar (polar.sh), the merchant of record: Polar is the seller, takes the payment, works out and collects sales tax or VAT, and sends you the receipt. The checkout is Polar’s own page, shown over this site or in a new tab. What you type there — your card details, name, billing address or country, and email — goes to Polar and its payment processor, not to us, and is covered by Polar’s privacy policy. That page may use its own cookies, for example for fraud prevention; this site does not.

To start a checkout, we send Polar your account’s email address (so the receipt reaches you) and your account id and the pass you chose (so the payment can be matched to your account). When the payment goes through, Polar tells us, and we store the Polar order id, the pass and course, the amount paid, when the pass starts and ends, and, if it happens, when it was refunded. We never see or store your card number. Your Account page shows all of this to you.

Refunds are made through Polar too: a self-serve refund from the Account page asks Polar to refund that order, and we mark the pass as refunded. To keep access correct, the site checks Polar’s records of orders, refunds and payment disputes on your account from time to time.

Each address gets one self-serve refund and one NREMT Pass-or-extend claim. To keep those limits after an account is deleted and made again, using either one stores a one-way hash of the account’s email address (a scrambled fingerprint that cannot be turned back into the address) and which of the two was used. It is not linked to any account and holds nothing else.

Claiming NREMT Pass-or-extend stores the legal name, state and exam date you enter, so the claim can be checked against the National Registry of EMTs’ public certification lookup. We only look you up there; we send the Registry nothing.

How long things are kept

• Your account, synced progress, Premium pass records and any Pass-or-extend claim: until you delete the account. Deleting it removes them at once (see above).
• The refund and Pass-or-extend hashes: kept, so the once-per-address limits hold. They identify no one on their own; email us from the address and we will tell you whether it has one.
• Reminder settings: until you turn reminders off, which deletes them, or delete the account.
• Waitlist entries: until you ask us to remove them or delete the account that uses the same address.
• The page counter, the Premium counter and error reports: kept as totals and reports with nothing identifying anyone, so there is nothing personal to expire.
• Polar’s order and payment records: kept by Polar for as long as tax and accounting law requires, under its own policy.
• Service logs: the providers below keep short-lived technical logs of requests (for example Cloudflare, which also uses your IP address for a moment to rate-limit the assistant and Premium endpoints; we do not store it).

What this site does not do

• No advertising, and no advertising SDKs.
• No cookies set by this site. (localStorage is not a cookie and is never transmitted.) Polar’s checkout, which opens only if you choose to buy, is Polar’s page and follows its own policy.
• No pixels, session recorders, heatmaps or A/B tools.
• No cross-site tracking: nothing here follows you to any other website.
• No selling or sharing of personal information, under CCPA or otherwise.

The study assistant

The study assistant in the corner of every course page answers from that course’s own notes, searched inside your browser. In that mode nothing is sent anywhere, and it works with no connection at all. If you are not signed in, that is the only mode.

AI answers are on by default for signed-in students. When you ask a question while signed in, your browser sends our assistant endpoint (a Cloudflare Worker) your question, the passages from the course that matched it, your last four questions and answers in this conversation, and which course you are in, together with your sign-in token so the endpoint can check you are signed in. The endpoint passes the question, passages, recent turns and course to an AI model run by Cloudflare Workers AI, acting as our processor, which writes the reply. Neither we nor the endpoint store the question or the answer, and nothing is linked to your progress; the conversation lives in the page until you close the tab. You can turn AI answers off at any time from the gear icon in the assistant, which returns it to searching your browser only.

Answers you receive are kept in your own browser for 30 days so that asking the same thing again is instant and costs nothing. That copy never leaves your device, and clearing your browser data removes it.

Answers are study material, not medical or professional advice. For anything clinical, your protocols and medical direction are the authority.

Third parties your browser does contact

• jsDelivr serves two pinned libraries: the Supabase client, on pages where signing in is possible, and Polar’s checkout script, only when you open a Premium checkout. Like any web host, it sees the request.
• Google, Apple or GitHub — only if you choose one of those buttons to sign in, and only at the moment you press it. The buttons appear only where that provider is switched on for this site; if none is, your browser never contacts any of them.
• Wikimedia Commons serves three lung-sound recordings, and only if you press play on one in the sound trainer.
• YouTube (Google) plays the video lessons, and only if you press play on one. Until then the video is a picture served from this site and nothing is sent to YouTube. The player comes from YouTube’s privacy-enhanced domain (youtube-nocookie.com), which YouTube says does not use what you watch there to personalise your YouTube experience; once you press play, YouTube’s own privacy policy covers it. We count that a video was played (which video, nothing about you) in the analytics above.
• Cloudflare runs our endpoint (a Worker) and the study assistant's AI model (Workers AI), the model only when you ask a question while signed in with AI answers on. It receives what The study assistant above lists. The same Cloudflare service starts Premium checkouts and refunds, sends reminders and the pass-ending email, and receives Polar’s payment notices.
• Umami Cloud receives the analytics described above, on every page, unless you switch it off.
• Polar — only if you open a Premium checkout. It receives what you enter there, as described in Buying a Premium pass.
• GitHub Pages hosts the site and, like any web host, sees the requests for it.

The typefaces are served from this site, so no font service is contacted.

Your rights

Because there is no identifier attached to the page counter, there is nothing there to look up, correct or delete. The same is true of the error reports and the question reports above: neither carries anything that identifies who sent it.

For an account, the main rights are buttons rather than requests. Deletion is Delete account in the account menu, described above. Portability is Keeping a copy of it on this page, which exports everything stored about your progress as a plain JSON file you can read, keep, or import back. Access: that export, plus your Account page for your passes and purchases; for anything else we hold about you, email us and we will send it. If you are in the UK, EU or California, the access, correction, deletion and portability rights you have under GDPR or CCPA apply to that account data; you should not need to invoke them to use either button, and you do not have to tell us why. We answer emailed requests within 30 days.

For visitors in the UK and EU: we use account data to provide the account you asked for and the passes you bought (contract), send the pass-ending notice and keep purchase records for the same reason, and run the anonymous counters, error reports and analytics because we have a legitimate interest in keeping the site working and knowing what gets used (you can switch those off above). Reminders and the waitlist rest on your consent, which you can withdraw at any time. The services listed on this page are mostly in the United States, so your data is processed there. You can complain to your local data protection authority.

For California residents: in the past 12 months we have collected identifiers (email address), commercial information (the Premium passes you bought) and internet activity (your study progress, and the analytics above), for the purposes on this page. We do not sell or share personal information, or use it for targeted advertising, and we will not treat you differently for using these rights.

For schools

This section is for teachers, schools and districts thinking of pointing students at a course here, in particular the AP® Biology course. It sums up the rest of this page as it applies to a class; nothing in it adds to or takes away from the sections above.

• No login for student content. Every notes page, lesson, glossary, unit sheet, practice set and free-response question opens without an account, at a stable address you can share or post to Google Classroom. Students do not need to give us a name or an email address to use anything free.
• What a student who never signs in leaves with us: nothing with their name or email on it. Their answers, scores, streaks and typed free-response drafts stay in their own browser (Your progress stays on your device). Each page view adds one to an anonymous (path, day) counter (One anonymous counter) and is seen by our cookieless analytics, which records the page, browser, country and a daily-changing visitor hash (Site analytics; off with Do Not Track or the switch on this page). A page error sends the short report in When a page breaks, and a Report a problem sends only what the student picked and typed.
• If a student chooses to sign in: we keep their email address and a synced copy of the same progress, so it follows them to another device, plus, when they finish a full timed or adaptive exam while signed in, the course, the number of questions and the time. Free-response drafts are never synced.
• Purchases: nothing a class needs is behind a purchase it has to make. If a student or parent buys a pass, Polar sells it and keeps the payment details; we keep only the record in Buying a Premium pass. Buyers under 18 need a parent or guardian’s permission (terms).
• Who processes data for us: Supabase (accounts and synced progress), Cloudflare (our endpoint and the study assistant’s AI model, for signed-in students only), Polar (purchases), Umami Cloud (cookieless analytics, which a browser can switch off above or with Do Not Track) and Resend (account and reminder email). GitHub Pages hosts the site. Google Classroom is contacted only when someone presses “Share to Google Classroom”.
• How long: account data until the account is deleted; everything else as listed in How long things are kept.
• No ads, no selling, no profiling. There is no advertising on the site, student data is never sold, shared for advertising or used to build a profile of anyone, and the study assistant does not keep questions or answers.
• Deletion on request. A student can delete their own account from the account menu, which removes it and its synced progress at once. A school, teacher or parent can also email [email protected] and we will delete what we hold for the student’s address, and confirm it, within 30 days.
• Data privacy agreements. We are willing to sign the Student Data Privacy Consortium’s National Data Privacy Agreement (NDPA), or your state’s version of it, with a school or district that asks. Email [email protected].

AP® is a trademark registered by the College Board, which is not affiliated with, and does not endorse, this site.

Children

This site is built for people studying for professional certification, university courses and high-school courses such as AP® Biology. It isn't directed at children under 13, and we don't knowingly collect anything from them. You must be 13 or older to create an account. If we learn that an account belongs to a child under 13, we delete it; a parent who thinks this has happened can email us.

Changes, and how to reach us

If this policy changes in a way that affects what is collected, the date above will change with it. LevlPrep is run by Olivier Testa (Minnesota, United States), who is responsible for the data described here. Questions, or a deletion request: [email protected].