1. What we collect
- Account data: email address and profile details you provide when you sign up.
- Usage data: worksheets generated, subjects selected, session timestamps.
- Payment data: processed entirely by Creem.io — we never see or store your card number.
- Device data: browser type, IP address (for rate limiting and abuse prevention).
2. Where data lives
- Auth and account data: Supabase (PostgreSQL).
- Generated worksheets: Supabase Storage, while your account remains active.
- Server logs: retained for security, reliability, and abuse prevention.
- Payment records: Creem.io — we retain only transaction IDs.
3. How we use it
- To generate worksheets and deliver them to you.
- To enforce rate limits and prevent abuse.
- To process payments and manage your subscription.
- We do not sell your data to third parties.
- We do not use your data to train AI models.
4. Data retention
Generated worksheets remain in Supabase while your account is active. If you deactivate your account, we retain account data and generated content as needed for account history, service operations, and legal obligations. You can request deletion by emailing us.
5. Your rights
- Request a copy of your data.
- Request deletion of your account and data.
- Opt out of non-essential data collection.
6. Security
We use HTTPS, security headers (HSTS, CSP, X-Frame-Options), rate limiting, and server-side input validation. No system is 100% secure, but we follow OWASP guidelines to protect your data.
7. Changes
We may update this policy. Material changes will be notified via email or in-app.
