# Privacy policy

> **DRAFT, not in force.** This is an outline awaiting legal review. Text in
> [SQUARE BRACKETS] is a placeholder for a decision not yet made (see
> `TODO.md`, "Decide the privacy facts"). The facts about the software are
> in the [data inventory](data-inventory).

Effective date: [DATE]

## 1. Who we are

[COMPANY/NAME], [ADDRESS], contact [PRIVACY EMAIL]; UK/EU representative [IF NEEDED].

## 2. What we collect

- **Account:** e-mail address, first and last name, profile
  picture choice, password (stored only as an argon2id hash); your Google ID
  and e-mail if you sign in with Google; whether you confirmed you are old
  enough at sign-up; your phone number if you add one, and your two-factor
  sign-in choice (with an authenticator app, its secret key, stored
  encrypted like the API keys and left out of the data export).
- **Learning data:** your answers, scores, vocabulary, progress, game
  results and the courses you open.
- **Courses and notes you create:** course files, what you asked the AI for,
  and the notes or homework you paste in.
- **API keys you provide:** stored encrypted; never shown again.
- **Payment:** [PAYMENT status via Stripe]: your Stripe customer and
  subscription ids and the subscription's status. Card details go to Stripe
  and never reach us.
- **Technical:** one session cookie; server logs [IP, retention].

## 3. Why, and the legal basis

Contract (the account and learning), consent (sending your notes to an AI
provider with your key), legitimate interests (security logs) [per purpose].

## 4. AI features

When you use an AI feature (generating a course, adding content, the
tutor), your notes, the course and your messages are sent to the provider
you chose (Anthropic, OpenAI, or Google), with your own key and under their
terms [LINKS]. The form tells you which provider before you send anything.
Do not paste sensitive data (health, religion, and the like) or other
people's personal data. We do not use your content to train anything
[CONFIRM].

## 5. Who else sees it

Hosting [PROVIDER/REGION]; Google (sign-in only); Stripe [IF USED]; our
e-mail provider [PROVIDER] (your address and the messages we send you); our
text message provider [PROVIDER, IF USED] (your number and the texts we send you); TypeSafe
(the text of the courses you make, checked against our Terms before they are shared; a part it scores high is also read by our AI provider). No ads,
no analytics, no sale or sharing of data [CONFIRM]. Other learners see your
first name and last initial next to your scores on game leaderboards.

## 6. Cookies

One strictly necessary session cookie, plus a sign-in state cookie during
Google sign-in and while a two-factor code is awaited; no banner needed [CONFIRM]. Settings such as your voice
choice are kept in your browser and never sent to us. The [cookie notice](cookies)
lists every cookie, what it is for and how long it lasts.

## 7. Retention

Sessions: 30 days. Learning data: until you delete your account, except
your answers and game rounds, which are deleted after two years [N].
Notes: deleted once your course is ready (kept while a failed generation
can resume) [N]. A course whose AI generation failed: deleted with its notes
after 30 days without a resume or edit [N]. A count of the texts sent to a
phone number (with a one-way hash of the number, not the number): two
days, kept that long after you delete your account so the text limits
hold. An account whose e-mail
address was never confirmed: deleted, with everything in it, when someone
registers the same address [7] days or more after it was made. Server
logs: 31 days. Backups: 31 days at most.

After you delete your account, nothing personal about you is kept longer
than 31 days. Your account is deleted at once; copies of it in server logs
and backups are gone within 31 days. We keep no anonymized statistics from
deleted accounts.

## 8. Your rights

- **Access and export:** Profile → Your data → Download my data. We prepare
  the file in the background and e-mail you a link; it works once, for 24
  hours, while you are signed in, and the file is deleted once downloaded
  or when the link expires. One copy a day.
- **Correction:** edit your profile.
- **Consent:** Profile → Privacy and consent lists what you agreed to and
  when: the Terms, your age, your phone number and Google sign-in where you
  use them, and AI features. Turn AI features off there and nothing you
  type goes to an AI company; turn them back on the same way. Each change
  is recorded with its date and is in your download. Taking back your age
  confirmation means deleting your account.
- **Deletion:** Profile → Your data → Delete account. You are signed out
  everywhere, and the account is deleted 14 days later, or when a
  cancelled plan's paid time ends if that is later; where we send e-mail,
  we e-mail you the date. Until then you can sign in again, but only to
  cancel the deletion or sign out, and courses you shared are hidden from
  the people you shared them with. On that day we delete your account and
  everything in it, except a record of the address-confirmation e-mails
  sent to your address in the last 24 hours (address and time, no text),
  kept until that day is over so nobody can flood the address by deleting
  and re-registering.
- **Objection** and other requests: [PRIVACY EMAIL].
- EU/UK: you may complain to your data protection regulator. California:
  [California rights].

## 9. Security

API keys and authenticator apps' secret keys are encrypted at rest; passwords and session tokens are hashed, and so are the sign-in, two-factor and phone codes the server checks. A code or link we e-mail or text you is in the message itself: it waits in our outbox until it is sent, and its text is erased once it is sent or has failed for good. Codes are never in an e-mail's subject, are not written to the server's logs, and are not in Download my data.
Whoever controls the
server can read everything on it, including your keys while they are in
use. Breach notice within [72h].

## 10. Children

Not for children under 14. If we learn that an account belongs to one,
we delete it.

## 11. International transfers

[MECHANISM]

## 12. Changes

We will post changes here with a new effective date [DATE].