Privacy Policy
What LadderPrep collects from parents and children, how we use it, and your choices.
Effective date: October 25, 2026
Last updated: October 25, 2026
LadderPrep is a math preparation program for the ISEE Middle Level test. Parents create the account and buy access for each child. Children use the learning app through a sign-in link that their parent gives them. This policy explains what we collect, why, who helps us run the service, how long we keep information, and the choices you have.
This policy is also our notice to parents under the US Children's Online Privacy Protection Act (COPPA).
LadderPrep is offered to families in the United States.
The short version
- Children never get their own account, email address or password.
- A child can sign in to the learning app only after a parent confirms permission by email.
- In the learning app, children answer multiple-choice questions and watch lesson videos. They cannot send us free text, post, or message anyone. The notes box in full-length math practice tests stays on the device, is never sent to us, and is cleared when the section ends.
- We use children's learning information only to run LadderPrep for that family. We do not sell it, rent it, or use it for advertising.
- LadderPrep runs no ads, analytics or chat tools on any page. Apart from the service providers listed below, the only company that can collect information on our pages is YouTube, and only after you press play on a video on a public page.
- You can see your child's progress, ask for a copy of their information, or delete their profile.
Who we are
LadderPrep is operated by Raptune Limited, a company registered in Hong Kong.
- Postal address: Unit 18, 8/F, Peter Leung Industrial Building, 103 Wai Yip Street, Kwun Tong, Kowloon, Hong Kong
- Email: support@ladderprep.com
- Phone: +1 949 274 9371
When this policy says "we" or "us", it means Raptune Limited.
Information we collect from parents
Account information. Your name and email address. If you register with a password, we store it only as a secure hash, never in readable form, and ask you to confirm your email address.
If you choose Google sign-in, Google sends us your Google account ID, name, email address, whether Google has verified that address, and a link to your profile picture. We keep these with your account, along with the sign-in tokens Google issues. We do not receive your Google password or ask for access to your Gmail, Drive, Calendar or contacts. Google receives your sign-in request and the IP address and browser information of the device you sign in on. If you created your account with Google sign-in, your Google profile picture appears in your account menu and loads from Google's servers, so Google also receives your IP address and browser information when a page shows it. Google sign-in is for parents only; we do not send children's profiles or learning records to Google through this feature.
Language preference. When you create an account we record a preferred language for your parent pages and emails, taken from your browser's language setting. LadderPrep is available in English only for now, so your pages and emails are in English whatever this setting says.
Sign-in records. When you sign in, we keep a session record with its start and expiry time, the IP address, and the browser and device type your browser reports.
Information you give us about your child. When you add a child, you give us a nickname (1 to 30 characters; it does not need to be the child's real name), grade, the exam and level they are preparing for, an optional test date, and a time zone (your browser suggests it). You can also set a weekly study schedule: how many minutes your child plans to study on each day of the week, and changes for particular dates, such as a day off. Only you can change these settings.
Email preferences. Whether you have turned weekly progress emails off, and when.
Payments. Payments are made on a checkout page hosted by our payment processor, Stripe. Stripe collects your card details and your billing address (country, state, ZIP code and street); the address is used to work out which sales tax, if any, is added at checkout. We do not receive your full card number. Stripe may include billing details in the payment notifications and responses it sends us, but we do not save your billing address in the LadderPrep database. For each purchase we keep which child it was for, when it was paid, the amount including tax, whether it was an enrollment or extension, the Stripe payment references, access start and end information, and whether it was refunded, reversed or could not be applied. We keep the terms version you accepted and when, purchase-confirmation and access-start email status, and any recorded choice to continue or refresh a child's plan after re-enrolling. We also keep a record of the most recent checkout for each child, including the email address we gave Stripe; it is replaced when you start the next checkout for that child and deleted with the child's profile.
Messages you send us. If you use the contact form or email us, we receive your name, email address and message. Contact-form messages are emailed to our support inbox; they are not stored in the LadderPrep database. The contact form is for parents and guardians. If we learn that a message came from a child under 13, we use the child's email address only to reply once, and we delete the message and our reply within 3 days of replying.
Information we collect about children
A child can sign in to the learning app only after the parent has confirmed permission (see "How parental permission works").
From the parent: nickname, grade, exam and level, optional test date, time zone, and the weekly study schedule (described above).
From the child's use of the learning app:
- Answers to practice, practice-test, review and other questions: which choice (A to D) the child picked, that they left it blank or, in the Free Placement Test, that they have not learned it yet, and whether they flagged it.
- Time spent on each question, when each set or test section was started and finished, and whether a timed section ran out of time.
- Which lesson videos the child watched, and when. We record a video as watched when playback time reaches about 90% of the video's length, not counting parts skipped by seeking. Separately, for the refund rule, we keep which 10-second parts of each video version were played and when a lesson video first reached 80% played. We do not keep a playback timestamp for each part.
- A sign-in record for each device: when it started, when it expires, and when it was last used (updated at most once an hour). The device keeps a random sign-in cookie (see our Cookie Policy).
From these records we work out progress: completed lessons, accuracy, which skills are mastered or need review, a study plan, and readiness estimates after a full-length math practice test.
What children do not give us in the learning app: email address, phone number, postal address, photos, voice, precise location, contacts, or any free text. We do not store a child's IP address or device type in our app database. Children cannot create public profiles or communicate with anyone through the learning app.
Video and network data. Lesson videos inside the learning app are streamed by Cloudflare Stream, and the whole site runs on Cloudflare. Like any website or video host, Cloudflare receives the IP address and browser information of the device that loads a page or plays a video. We can also read Cloudflare's request logs, including logs of requests from child pages; these may contain network and browser information and are kept for a limited time (see "How long we keep information"). We use this only to deliver the service and keep it secure.
How we use information
We use parents' and children's information only to:
- create and secure your account and your child's sign-in;
- send the permission emails required by COPPA;
- run the program: lessons, practice, review, the Free Placement Test, the full-length math practice tests, study plans and progress;
- show you your child's progress in your dashboard;
- send weekly progress emails, unless you turn them off;
- send account emails: email confirmation, password reset, a notice when someone tries to sign up with your email address, child sign-in links you ask us to email, purchase confirmations with the terms you accepted, and a notice when an enrollment's 180 days start;
- take payment for enrollments, show your receipts, and handle refund requests;
- answer your messages;
- keep the service working and secure, prevent abuse, and fix problems;
- meet legal obligations.
We do not use children's information for advertising, marketing, or building profiles for anyone else. We do not send marketing email, and signing up does not subscribe you to a newsletter.
How parental permission works (COPPA)
We use the "email plus" method of verifiable parental consent.
- You create a parent account and confirm your email address.
- You add a child and tick a box confirming that you are the child's parent or legal guardian and that you give permission.
- We email you a permission request. It lists what we collect and links to this policy. The link works for seven days; you can ask for a new one from your dashboard.
- You open the link and press Confirm.
- We send you a second email confirming your permission and explaining how to withdraw it.
- Only after that second email has been sent can your child sign in.
We keep a record of when you asked for and confirmed permission, the method used, and the policy version that applied when you added the child.
If you do not confirm, your child cannot sign in, and the unconfirmed profile is scheduled for deletion 14 days after you asked for permission. Asking for a new link does not restart that period. A daily cleanup processes eligible profiles in limited batches; a backlog or a failed run can delay removal.
You can buy an enrollment only after permission is confirmed, and paying never counts as permission.
Child sign-in links
Your child signs in with a link you create on the child's page in your dashboard. You can copy the link, or ask us to email it to your own account email address; we never email a child. A link works once, expires after seven days, and replaces any earlier link for that child. When you ask us to email a link, we record the time so we can limit these emails to one per child per minute. Anyone who can read the email or the copied link can use it until it is used, replaced or expires, so treat it like a password. You can also open your child's sign-in directly on a device you are using; this signs you out of your parent account in that browser.
Weekly progress emails
Once a week, between Sunday evening and Monday noon in the time zone of your first-added child with confirmed permission, we email you a progress report for your children who have an active enrollment. For each child it shows the nickname, lessons completed, study minutes, first-try accuracy, review and mastery counts, the coming week's lessons and practice, the expected finish week and whether the weekly study time fits the plan, with a link to the child's page. It never contains your child's answers, questions, test date or readiness estimate, and it has no tracking pixels or ads. After three quiet weeks in a row we stop sending empty reports until your child is active again. Every report has an unsubscribe link, and you can turn reports on or off in Settings > Emails.
Who we share information with
We do not sell or rent personal information, and we do not share it for cross-context behavioral advertising. We do not offer any optional sharing of children's learning records for advertising or for another company's own use.
These service providers help us run LadderPrep:
| Provider | What it does for us | What it receives |
|---|---|---|
| Cloudflare | Hosting, database, file storage, sending email, forwarding email sent to our addresses, lesson video streaming, security and request logs | Everything stored in LadderPrep; IP addresses and browser information of visitors; the email addresses and contents of the emails we send and receive |
| Stripe | Payment processing and receipts | Your email address, the card and billing details you enter at checkout, the amount, what was bought (an enrollment or an extension, and the price type), the terms version you accepted and when, any choice you made about your child's plan when re-enrolling, and internal reference numbers for your account and your child's profile. Stripe never receives your child's nickname, grade or learning data. |
| Optional parent sign-in; hosts the mailbox that receives email sent to support@ladderprep.com and hello@ladderprep.com, including contact-form messages | If you choose Google sign-in: your sign-in request, and your IP address and browser information when you sign in and when your profile picture loads. For the mailbox: your name, email address and messages to us, and anything you include in them |
Under COPPA, you can agree to our collection and use of your child's information without agreeing to its disclosure to third parties. We do not disclose children's information to third parties. The service providers listed above handle it only to host and secure LadderPrep, stream lesson videos, send and receive our email and process payments, which supports the operation of our service and is not a disclosure under COPPA. If we ever wanted to disclose your child's information to a third party for another purpose, we would first ask for your separate permission.
Stripe also uses payment information under its own privacy policy, for example to prevent fraud and meet its legal obligations.
We also send ourselves short internal alerts through Discord, for example "an enrollment was purchased" with the amount and a Stripe reference number, or counts of weekly emails that could not be sent. These alerts contain no names, email addresses or child profile details.
We may also disclose information if the law requires it, to protect the safety of a child or others, to enforce our Terms, or as part of a merger or sale of the business. In a sale, the buyer must honor this policy for information already collected, or ask for your permission before using it in a materially different way.
Cookies
We use first-party cookies and browser storage that the site needs: to keep
parents and children signed in, to remember your language and display choices,
to remember scroll positions, and to recover from site updates. The child's
sign-in cookie (__Host-lp_kid) holds a random value, lasts 30 days, and
cannot be read by page scripts. We use no advertising or analytics cookies.
Our Cookie Policy describes each item and how long it lasts.
YouTube videos on our public pages
Our home page and some public lesson pages can show a LadderPrep video hosted on YouTube. These pages do not contact YouTube until you press play: before that, you see a picture served by us. When you press play, the video loads from youtube-nocookie.com, and YouTube (Google) receives your IP address and browser information and may store information on your device, under Google's privacy policy. If you open the video on YouTube itself, for example in a new tab, YouTube's normal terms and privacy policy apply. Lesson videos inside the learning app are not on YouTube; they are streamed by Cloudflare.
Sharing a page. The "Send this to a parent" button on public lesson pages uses your device's share menu or copies the link. It sends nothing to us.
No analytics
LadderPrep does not use analytics, advertising, chat or similar third-party tools on any page, and our fonts are served from our own site. We will never add one to child pages, our home page, public lesson pages, the permission page or the parent dashboard. If we ever add such a tool to other public pages, we will update this policy first.
Children may visit our home page and public lesson pages. These pages have no sign-up, no analytics and no collection of learning information. The plan estimate on our home page runs in your browser. If you continue to sign up from it, the test date and weekly study time you chose travel in the sign-up link so your dashboard can prefill the test date; we keep them only if you save them in your child's profile. Like every page on our site, they are served by Cloudflare, which processes the visitor's IP address and browser information to deliver and secure them (see "Video and network data"). Our contact form, linked from these pages, is for parents (see "Messages you send us"), and YouTube receives information only after you press play.
Parents' rights and choices
You can:
- Review your child's progress in your dashboard at any time, or email us for a copy of the information we hold about your child.
- Correct your child's nickname, grade, test date, time zone and study schedule in the dashboard.
- Refuse further collection or withdraw permission by deleting your child's profile. You can also sign out your child's devices and cancel sign-in links on the child's page.
- Delete your child's profile (on the child's page; you type the nickname to confirm) or your whole account (Settings > Security; you type your email address to confirm). If a checkout for a child is still open or being confirmed, it has to be completed, cancelled, or settled by the payment processor first; your child's page shows its status. Even while a checkout is open or being confirmed, you can sign out all of your child's devices and cancel sign-in links at once, which stops further collection right away.
- Stop weekly emails with the link in any report or in Settings > Emails.
You can also email us to do any of these. Write from your account email address so we know the request is really yours; we may also ask you to confirm it while signed in to your account. We respond within 30 days.
What happens when you delete
Deleting a child's profile permanently removes from our app database the profile, the permission record, and all of that child's learning records: answers, timings, video progress, review history, practice tests, sign-in links, device sessions, enrollments, purchase and checkout records, and our stored snapshots of the child's weekly reports. Emails already delivered to your inbox stay there. A paid enrollment for that child ends and is not transferred, and deleting does not refund it: if you want a refund, ask before you delete (see our Terms).
Deleting your account removes your account, sign-in records, language and email preferences, weekly report history, and every child profile with all of its data, as above.
Some records remain after a child's profile is deleted. Our weekly-email delivery log may keep the child's internal reference number, together with your account and the report week, for up to 12 months after that report week, or until your account is deleted if that is sooner. Stripe keeps its own payment records, which include internal reference numbers for your account and the child. If you buy again or ask for a refund with the same registration email address, we use Stripe's payment and refund history for that email, including after your account or a child's profile is deleted, to apply the rule of one refund request per 365-day period in our Terms. Messages you sent us and records we saved for a refund request are kept for the periods in the table below. Deleted data may also remain in backups and logs for a limited time, as described below.
How long we keep information
We keep children's information only as long as we need it to provide LadderPrep to your family: to run lessons, practice and practice tests, keep your child's study plan and progress, show you that progress, and let your child continue if you enroll again. We do not keep children's information indefinitely. The table below lists how long we keep each kind of information and when we delete it.
| Information | How long |
|---|---|
| Child profiles, permission records, learning records, and enrollment and purchase records in our database | While your child is using LadderPrep, and for 12 months after the latest of your child's last activity, the end of their last enrollment and the day you gave permission. After that we delete them. You can delete them earlier at any time. |
| Child profiles that were never confirmed | Scheduled for deletion 14 days after the permission request |
| Parent account, language and email preferences | Until you delete your account |
| Permission links and child sign-in links | Stop working after 7 days; removed when used or replaced, when the profile is deleted, and in any case 90 days after they expire |
| Child device sign-in records | The sign-in ends after 30 days. Ended or cancelled sign-ins are deleted 90 days after they end, except the most recent sign-in record for each child, which is deleted with the profile. |
| Parent sign-in records | The sign-in ends 7 days after it was last renewed; the record, with IP address and browser type, is deleted 90 days after the sign-in ends |
| Email confirmation and password reset records | Deleted 90 days after they expire |
| The most recent checkout record | Until the next checkout for that child replaces it, or the child's profile is deleted |
| Purchase records at Stripe | As long as Stripe needs them to meet its legal obligations, such as tax, accounting and fraud prevention |
| Weekly report records | 12 months after the report week, or sooner if you delete your account (stored child snapshots are removed when that child is deleted) |
| Messages you send us | 24 months after the last message in the conversation. A message from a child under 13 is deleted, with our reply, within 3 days of our reply. |
| Records we save when you ask for a refund | 18 months after the payment |
| Copies of your information that we send you at your request | We delete our copy within 30 days after we deliver it |
| Database point-in-time backups (Cloudflare D1) | Up to 30 days |
| Request logs and traces (Cloudflare) | Up to 30 days (Cloudflare keeps them for 7 days; we do not export them) |
| Records of emails we send or forward (Cloudflare activity log) | Up to 31 days (Cloudflare keeps them for 31 days; we do not copy them elsewhere) |
How we protect information
- All traffic uses HTTPS.
- Passwords are stored only as secure hashes.
- Child sign-in cookies, sign-in links and permission links are long random values. We store only a one-way hash of each, so a copy of our database cannot be used to sign in as your child.
- Child sign-in cookies cannot be read by page scripts and are sent only over HTTPS.
- Every request about a child is checked against the parent who owns that profile.
- Cloudflare encrypts stored data at rest.
- Only the people who run LadderPrep can access production data, and only to run and support the service.
No system is perfectly secure. If we learn of a breach that affects your information, we will notify you as the law requires.
Where information is processed
Raptune Limited is based in Hong Kong. LadderPrep runs on Cloudflare's global network, Stripe processes payments in the United States and other countries, and Google provides optional parent sign-in and hosts our support mailbox. Your information may be processed outside the country where you live, including in the United States and Hong Kong. We rely on these providers' contractual and security commitments to protect it.
Hong Kong Personal Data (Privacy) Ordinance
Raptune Limited is a Hong Kong company, so the Hong Kong Personal Data (Privacy) Ordinance applies to the personal data we collect. This section is our collection statement under that law.
- Purposes. We use your and your child's personal data for the purposes listed in "How we use information".
- What you must give us. To create an account you must give your name and email address, and either set a password or use Google sign-in. To add a child you must give a nickname, grade, and the exam and level. The test date, time zone and study schedule are optional. Without the required information we cannot create the account or the child's profile.
- Who may receive it. The service providers listed in "Who we share information with"; courts, law enforcement and other authorities when the law requires it; a buyer of our business, as described above; and our professional advisers, such as lawyers and accountants.
- Access and correction. You have the right to ask for access to, and correction of, the personal data we hold about you and your child. We do not charge for this, and we respond within 30 days.
- Contact. Send requests to: Privacy contact, Raptune Limited, Unit 18, 8/F, Peter Leung Industrial Building, 103 Wai Yip Street, Kwun Tong, Kowloon, Hong Kong, or support@ladderprep.com.
Your privacy rights
Wherever you live in the United States, you can ask us to:
- Know and access: tell you what personal information we collect, use and disclose, and give you a copy of it.
- Delete: delete your personal information.
- Correct: fix inaccurate information.
We will not treat you differently for using these rights.
When you use LadderPrep, we collect these categories: identifiers (name, email address, IP address, account and session IDs); customer records (email address; payment records, with card and billing details collected by Stripe); commercial information (enrollment purchases); internet activity within LadderPrep (answers, timings, video progress, language preference); inferences about learning (skill mastery, study plans, readiness estimates); and account login credentials, which we use only to let you sign in. Sources: you, your child's use of the service, Stripe, and Google if you choose Google sign-in. Purposes: those listed in "How we use information".
We do not sell personal information or share it for cross-context behavioral advertising, including information about anyone under 16, so there is nothing to opt out of. We do not use sensitive personal information to infer characteristics about anyone.
To make a request, email support@ladderprep.com from your account email address; we may also ask you to confirm the request while signed in to your account. You may use an authorized agent: the agent needs your signed written permission, and we will confirm the request with you directly. We respond within 30 days.
Changes to this policy
When we change this policy, we update the date at the top and post the new version here. If we make a material change to how we collect, use or share children's information, we will not apply it to your child's information until you have given permission again.
Contact us
Questions, requests or concerns about your or your child's privacy:
- Email: support@ladderprep.com
- Mail: Raptune Limited, Unit 18, 8/F, Peter Leung Industrial Building, 103 Wai Yip Street, Kwun Tong, Kowloon, Hong Kong
- Phone: +1 949 274 9371