Privacy policy

DRAFT, not in force. This is an outline awaiting legal review. Text in [SQUARE BRACKETS] is a placeholder for a decision not yet made (see TODO.md, “Decide the privacy facts”). The facts about the software are in the data inventory.

Effective date: [DATE]

1. Who we are

[COMPANY/NAME], [ADDRESS], contact [PRIVACY EMAIL]; UK/EU representative [IF NEEDED].

2. What we collect

  • Account: e-mail address, first and last name, profile picture choice, password (stored only as an argon2id hash); your Google ID and e-mail if you sign in with Google; whether you confirmed you are old enough at sign-up; your phone number if you add one, and your two-factor sign-in choice (with an authenticator app, its secret key, stored encrypted like the API keys and left out of the data export).
  • Learning data: your answers, scores, vocabulary, progress, game results and the courses you open.
  • Courses and notes you create: course files, what you asked the AI for, and the notes or homework you paste in.
  • API keys you provide: stored encrypted; never shown again.
  • Payment: [PAYMENT status via Stripe]: your Stripe customer and subscription ids and the subscription’s status. Card details go to Stripe and never reach us.
  • Technical: one session cookie; server logs [IP, retention].

Contract (the account and learning), consent (sending your notes to an AI provider with your key), legitimate interests (security logs) [per purpose].

4. AI features

When you use an AI feature (generating a course, adding content, the tutor), your notes, the course and your messages are sent to the provider you chose (Anthropic, OpenAI, or Google), with your own key and under their terms [LINKS]. The form tells you which provider before you send anything. Do not paste sensitive data (health, religion, and the like) or other people’s personal data. We do not use your content to train anything [CONFIRM].

5. Who else sees it

Hosting [PROVIDER/REGION]; Google (sign-in only); Stripe [IF USED]; our e-mail provider [PROVIDER] (your address and the messages we send you); our text message provider [PROVIDER, IF USED] (your number and the texts we send you); TypeSafe (the text of the courses you make, checked against our Terms before they are shared; a part it scores high is also read by our AI provider). No ads, no analytics, no sale or sharing of data [CONFIRM]. Other learners see your first name and last initial next to your scores on game leaderboards.

6. Cookies

One strictly necessary session cookie, plus a sign-in state cookie during Google sign-in and while a two-factor code is awaited; no banner needed [CONFIRM]. Settings such as your voice choice are kept in your browser and never sent to us. The cookie notice lists every cookie, what it is for and how long it lasts.

7. Retention

Sessions: 30 days. Learning data: until you delete your account, except your answers and game rounds, which are deleted after two years [N]. Notes: deleted once your course is ready (kept while a failed generation can resume) [N]. A course whose AI generation failed: deleted with its notes after 30 days without a resume or edit [N]. A count of the texts sent to a phone number (with a one-way hash of the number, not the number): two days, kept that long after you delete your account so the text limits hold. An account whose e-mail address was never confirmed: deleted, with everything in it, when someone registers the same address [7] days or more after it was made. Server logs: 31 days. Backups: 31 days at most.

After you delete your account, nothing personal about you is kept longer than 31 days. Your account is deleted at once; copies of it in server logs and backups are gone within 31 days. We keep no anonymized statistics from deleted accounts.

8. Your rights

  • Access and export: Profile → Your data → Download my data. We prepare the file in the background and e-mail you a link; it works once, for 24 hours, while you are signed in, and the file is deleted once downloaded or when the link expires. One copy a day.
  • Correction: edit your profile.
  • Consent: Profile → Privacy and consent lists what you agreed to and when: the Terms, your age, your phone number and Google sign-in where you use them, and AI features. Turn AI features off there and nothing you type goes to an AI company; turn them back on the same way. Each change is recorded with its date and is in your download. Taking back your age confirmation means deleting your account.
  • Deletion: Profile → Your data → Delete account. You are signed out everywhere, and the account is deleted 14 days later, or when a cancelled plan’s paid time ends if that is later; where we send e-mail, we e-mail you the date. Until then you can sign in again, but only to cancel the deletion or sign out, and courses you shared are hidden from the people you shared them with. On that day we delete your account and everything in it, except a record of the address-confirmation e-mails sent to your address in the last 24 hours (address and time, no text), kept until that day is over so nobody can flood the address by deleting and re-registering.
  • Objection and other requests: [PRIVACY EMAIL].
  • EU/UK: you may complain to your data protection regulator. California: [California rights].

9. Security

API keys and authenticator apps’ secret keys are encrypted at rest; passwords and session tokens are hashed, and so are the sign-in, two-factor and phone codes the server checks. A code or link we e-mail or text you is in the message itself: it waits in our outbox until it is sent, and its text is erased once it is sent or has failed for good. Codes are never in an e-mail’s subject, are not written to the server’s logs, and are not in Download my data. Whoever controls the server can read everything on it, including your keys while they are in use. Breach notice within [72h].

10. Children

Not for children under 14. If we learn that an account belongs to one, we delete it.

11. International transfers

[MECHANISM]

12. Changes

We will post changes here with a new effective date [DATE].