Security

Prezi Prep holds data about children, and we treat that as the strongest possible reason to hold as little as we can and to protect it well. The principles: collect only what the Services need; make the safe path the default; keep answer keys and personal data on the server; and be honest when something goes wrong.

• No passwords. The only way in is a Telegram account. We never see a Telegram password, and there is no Prezi Prep password to leak or guess.
• Verified sign-in. Every sign-in carries a signature from Telegram, which we check on the server before a session is created. Data that fails the check is discarded.
• Signed sessions. A session is an HTTP-only, Secure cookie signed by our server. Scripts in the page cannot read it, and it cannot be forged without our secret key.
• Limited lifetime. A session expires after 30 days without use, and every session of an account can be revoked on the server at once — on every device — if the account is compromised.
• Cross-site protection. Every request that changes data is checked against the page that sent it, so another website cannot act on your behalf.

• All connections — browser to application, application to database, application to Telegram — are encrypted with TLS.
• The database is hosted by Neon, Inc., a managed PostgreSQL service that encrypts data at rest and keeps automatic backups.
• Secrets — signing keys, API tokens, database credentials — live in the hosting provider's protected configuration, never in the code repository.

• Answers are graded on the server. The correct options are never sent to a device before a test is finished, so a learner — or a tool — cannot read them out of the page.
• Nothing from the browser is trusted. Every submitted answer is checked against the test's own questions, and who an attempt belongs to is read from the session, never from the request.
• Rewards are computed on the server from stored facts, so points and coins cannot be claimed by editing a request.
• Dependencies are kept current, and the code is reviewed for the common web vulnerabilities before release.

• Production data is accessible only to the small team that operates the Services, only for support and maintenance, and only as far as the task needs.
• Our providers — hosting, database, Telegram, analytics — process data under contracts that limit what they may do with it; see the Privacy Policy.
• A parent can see a learner's progress only after the two accounts have been linked.

• No profiles. The rankings board shows a first name, an initial and a score — no photo, no phone number, and no way to reach a learner.
• No messaging between users, no comments, no chat.
• No advertising and no third-party trackers.
• The phone number shared in the bot is accepted only if it belongs to the Telegram account that is registering, so nobody can register a child with someone else's number.
• A parent or guardian can ask for a learner's data to be corrected or deleted at any time.

If we learn of a security incident affecting personal data, we will contain it, work out who is affected, notify affected users and the authorities as the law requires, and publish what we learned.

If you find a vulnerability in the Services, please tell us through @PreziPrepBot before making it public. Give us enough detail to reproduce it, do not access other people's data beyond what is needed to demonstrate the problem, and give us a reasonable time to fix it. We will not take legal action against research done in good faith under these conditions, and we will credit you if you wish.

• Protect the Telegram account the learner uses: turn on two-step verification in Telegram, and keep the phone locked.
• Sign out of Prezi Prep on shared or borrowed devices.
• Do not share the account or the phone number with anyone else.
• If something looks wrong — a result you do not recognise, a sign-in you did not make — tell us through @PreziPrepBot and we will revoke the account's sessions.

Security questions and reports: the Telegram bot @PreziPrepBot, or the contact page.