Privacy Policy

Last updated: February 2026

1. What we collect

When you create a Learning Accounts account we collect:

Account information you give us: email, password (stored hashed), display name, optional profile photo.
Learning activity: which lessons you complete, quiz scores, flashcard reviews, AI Tutor questions, study streak, achievements earned.
Payment information: handled entirely by Stripe — we never see your card number. We store the Stripe customer id and the email you used to pay.
Technical data: IP address, browser/device user-agent, and timestamps of sign-ins (used for security alerts on the /security page).

2. How we use it

Run the product — show you lessons, save your progress, send transactional email via Resend (password resets, 2FA codes, payment receipts).
Personalise the AI Tutor — your message goes to OpenAI to generate a reply; we don't sell or share your conversations.
Improve the platform — aggregate analytics (e.g. lesson completion rates). Individual identity is not shared with third parties for marketing.
Protect your account — flag unusual sign-ins, enforce 2FA for admin accounts, alert you by email when your password is changed.

3. Who we share it with

Stripe — payment processing.
OpenAI — generating AI Tutor responses (text input only, no personal identifiers).
Resend — sending transactional email.
Hosting infrastructure — Emergent platform + MongoDB Atlas.

We never sell your data, period. We will only disclose data if compelled by a lawful legal process.

4. Your rights

You can, at any time:

Update your name, email, photo, or password from your Profile and Security pages.
Cancel your subscription from the Stripe customer portal — access continues until the period you've paid for ends.
Delete your account by emailing the address in Contact. We will delete all personal data within 30 days, except where retention is legally required (e.g. payment records).

5. Cookies

We use a single first-party session token stored in localStorage to keep you signed in. We do not use third-party advertising cookies or trackers.

6. Children

Learning Accounts is not directed at children under 13. We do not knowingly collect data from anyone under 13. If you believe a child has signed up, contact us and we will delete the account.

7. Changes & contact

We may update this policy as the product evolves. Material changes will be announced via email and on this page. Questions? Use the Contact form.