Privacy policy

1. What we collect

You can read every lesson without an account. When you log in, we store:

• Account data: your email address, the name you give us (or the name from your Google profile), your avatar (an emoji or a photo you upload), your interface language and the ways you have logged in.
• Learning data: your answers to exercises, scores, lesson progress, topic mastery and certificates.
• AI usage records: when and how much AI feedback you used, so we can apply daily limits. These records contain token counts and costs, not your answers.
• Technical data: our hosting providers keep standard server logs (IP address, browser, requested page) for security and troubleshooting.

If you allow analytics in the cookie banner, Google Analytics collects anonymous usage data such as pages viewed and approximate location. If you decline, the analytics script is not loaded at all.

2. Google sign-in

If you log in with Google, we ask Google only for your basic profile: a unique account ID, your email address, whether it is verified, and your name. We do not get your password or access to your Gmail, Drive, contacts or any other Google data.

We use this data only to create your account and log you in. We do not sell it, use it for advertising, or share it with anyone except the providers listed below that help us run the service. Our use of information received from Google APIs follows the Google API Services User Data Policy, including the Limited Use requirements.

3. Why we use your data

• To provide the service you asked for: your account, saved progress, exercise feedback and certificates (performance of a contract).
• To send you login links by email (performance of a contract).
• To keep the service secure and within budget: rate limits, abuse prevention and AI usage limits (legitimate interest).
• To understand how the site is used, only if you agree (consent).

We do not send marketing emails and we do not sell personal data.

4. AI feedback

For open-ended tasks, the text of your answer and the task are sent to our AI provider, DeepSeek, to generate feedback. We do not send your name or email with it. Please do not include personal or confidential information in your answers.

5. Who processes your data

We use a small number of providers who process data on our behalf:

• Vercel (website hosting) and Render (API and database hosting).
• Resend (sending login emails).
• Google (sign-in with Google, and Google Analytics if you allow it).
• DeepSeek (AI feedback, as described above).

Some of these providers are located outside Ukraine and the European Economic Area, including in the United States and China. Where required, transfers rely on the providers' contractual safeguards.

6. Certificates

When you complete a course, your certificate gets a public verification link. Anyone with the link can see the name on the certificate, the course, your average score and the date. The link is not listed anywhere; you decide whom to share it with.

7. Cookies and local storage

• pl_session: keeps you logged in (30 days). Required.
• pl_oauth_state: protects Google sign-in (10 minutes). Required.
• PL_LOCALE: remembers the language you picked. Required.
• Browser storage for your theme and your cookie choice. Required.
• _ga cookies from Google Analytics, only if you allow analytics.

You can change your analytics choice at any time with "Cookie settings" in the footer.

8. How long we keep data

We keep your account and learning data until you delete your account. Login links expire after 15 minutes. When you delete your account, your profile, answers, progress and certificates are deleted immediately; AI usage records stay only as anonymous cost statistics. Server logs are kept by our hosting providers for a limited period.

9. Your rights

You can view and change your name and avatar on your account page, and delete your account there at any time. You can also ask us for a copy of your data, to correct it, to restrict or object to its processing, or to delete it by writing to sergeybruh@gmail.com. We will reply within 30 days.

If you think we handle your data unlawfully, you can complain to the Ukrainian Parliament Commissioner for Human Rights or to the data protection authority in your country.

10. Children

The service is intended for people aged 16 and over. We do not knowingly collect data from younger children. If you believe a child has created an account, write to sergeybruh@gmail.com and we will delete it.

11. Changes

If we change this policy, we will update the date at the top. If the changes are significant, we will tell logged-in users on the site.