Privacy Policy

To provide the Service, we collect the following categories of data:

• Account data. We identify accounts by email address. If you sign in with an email one-time code, we collect that email address. If you sign in with Google, we additionally receive basic profile information within the scope you authorize, such as your display name and profile picture.
• Learning data. Your practice records, progress, scores, and learning preferences, used to provide the Service and a personalized experience.
• Device and log data. To keep the Service secure and stable and to support different devices, we record basic log information such as device type, operating system, browser type, and the pages you visit.
• Payment data. When you subscribe, payment and subscription management are handled by Stripe (Stripe, Inc.). We never receive or store your card number or other sensitive payment details. Subscription status, renewals, and invoices are managed by Stripe Billing.

We use your personal data only as far as necessary, and mainly to:

• provide, maintain, and improve the Service and its features;
• manage accounts, verify sign-in, and administer subscription entitlements;
• offer personalized content and study suggestions based on your practice;
• provide customer support and handle questions and feedback;
• protect against security threats, abuse, and abnormal behavior;
• carry out statistical analysis to improve the product, where the law allows.

Where the GDPR applies, we rely on these legal bases: performance of a contract (running your account and the Service you signed up for), legitimate interests (keeping the Service secure, preventing abuse, and improving the product, balanced against your rights), consent (where we ask for it, such as for optional communications), and legal obligation (for example, retaining payment records for tax purposes).

We do not use your personal data for purposes unrelated to those described here.

We do not sell or rent your personal data. We share it only where necessary, in the following situations:

• Service providers we need in order to run the Service — for example Stripe (payments and subscription billing), Google (sign-in and analytics), our email delivery provider (one-time sign-in codes), and our hosting and database providers. These providers may only use your data for the agreed purpose and are bound to protect it.
• Legal requirements — where we are required to disclose data by law, regulation, or a competent authority.
• Protecting rights — where necessary to protect our rights or those of others.

To understand how the site is used and to improve it, we use Google Analytics 4, a third-party analytics service. It collects information about your visit, including your IP address, browser type, the time of your visit, and the pages you view. Google Analytics sets cookies in your browser for this purpose.

The data is processed by Google under its own terms. We use it only for traffic statistics and operational analysis, not to identify you personally.

We and our service providers may process your data in countries other than the one you live in, including the United States. Where we transfer personal data out of the EEA or the UK, we rely on the safeguards our providers put in place, such as the European Commission’s Standard Contractual Clauses and the UK Addendum.

We use reasonable technical and organizational measures to protect your personal data against unauthorized access, disclosure, alteration, or loss, including encryption, access controls, and security review.

We keep personal data only as long as we need it for the purposes described here, unless the law requires otherwise. Account and learning data are kept while your account is active. Payment and invoicing records are kept for as long as tax and accounting rules require. When data is no longer needed, we delete it or anonymize it.

If a security incident affecting your data occurs, we will take remedial steps as required by law and, where the law requires it, tell you promptly.

We use cookies and local storage on your device for two purposes:

• Essential. To keep you signed in, and to remember your learning preferences and interface settings, such as light or dark theme.
• Analytics. Set by Google Analytics 4, as described above, to measure how the site is used.

You can manage or clear cookies and local storage in your browser settings. Note that blocking essential storage may stop parts of the Service from working properly.

Depending on where you live, you have rights over your personal data. These include the right to:

• access your personal data and receive a copy of it;
• correct data that is inaccurate or incomplete;
• delete your personal data, or close your account;
• restrict or object to certain processing;
• receive your data in a portable, machine-readable format;
• withdraw consent at any time, where processing is based on consent;
• lodge a complaint with your local data protection authority.

California residents. Under the CCPA/CPRA you have the right to know what personal information we collect, to request its deletion or correction, and to opt out of the sale or sharing of personal information. We do not sell your personal information, and we do not share it for cross-context behavioral advertising. We will not discriminate against you for exercising your rights.

To exercise any of these rights, contact us through the support channel listed on the Service. We will respond within the timeframe the applicable law requires. To protect your account, we may ask you to verify your identity first.

The Service is not directed at children. You must be at least 16 years old to use it, or the minimum age for digital consent in your country, or you must have verifiable consent from a parent or guardian.

If we learn that we have collected a child’s personal data without the required consent, we will delete it.

We may update this policy from time to time. The updated version will be published on this page with its effective date. For material changes we will give reasonable notice.

The updated policy takes effect when published. Continuing to use the Service afterwards means you accept the updated policy.

If you have questions, comments, or a complaint about this policy or how we handle your personal data, please contact us through the support channel listed on the Service. We will handle and respond to your request within a reasonable time.