Privacy Policy

Privacy Policy

Draft placeholder — needs legal review before launch. Replace this file's content before going live.

Data controller

[Company legal name] [Registered address] Email: [contact email address] [Data Protection Officer name and contact, if applicable]

What we collect

  • Account data: email address, password hash, chosen nickname.
  • Academic profile: university, program, year, selected modules — no real name, date of birth, or student ID number is collected (data minimization, see below).
  • Usage data: quiz and practice attempts, points, streaks, progress, and — where you use it — messages you send to the AI tutor.
  • Billing data: handled by our payment processor (Stripe); we do not store card details ourselves.
  • Technical data: session cookies strictly necessary for sign-in; cookieless, privacy-respecting product analytics (no tracking cookies).

[Placeholder — legal basis under Art. 6 GDPR for each processing purpose (contract performance, legitimate interest, consent) to be specified by legal counsel.]

Data minimization

We deliberately do not collect your real name, date of birth, or official student number — only what the product needs to function (spec §7.17).

EU hosting

All servers and data storage used by this service are located in the European Union. A current list of subprocessors (hosting, payments, AI, email delivery, embeddings, error monitoring) and their locations is maintained in docs/SUBPROCESSORS.md and available on request. We sign a Data Processing Agreement (DPA) with each subprocessor.

Your rights

Under the GDPR you have the right to access, rectify, erase, restrict, or port your personal data, and to object to certain processing. You can export your data (profile, progress, attempts, points, AI dialogs) as a JSON file from Settings at any time. Deleting your account hides you immediately (e.g. from leaderboards); your personal data is fully erased within 30 days, except for anonymized records kept for statistical integrity (points ledger, attempt history) and AI dialogs, which are deleted outright.

[Placeholder — contact details for exercising these rights and for lodging a complaint with a supervisory authority to be added.]

Cookies

We use only technically necessary cookies (for keeping you signed in). We do not use tracking or advertising cookies. If that changes in the future, we will ask for your consent first.

Changes to this policy

[Placeholder — process for notifying users of material changes to be added.]