Privacy Policy

This is a plain-language summary of how we handle your data, written to be readable rather than exhaustive. It reflects our current practices.

What we collect

Account email, OAuth identity (if you sign in with Google or Apple), study activity (questions answered, flashcards reviewed), and billing metadata required by Stripe.

What we don't do

We do not sell your data. We do not run ads. Analytics that use cookies are opt-in only.

Analytics and cookies

We count page views with Vercel Web Analytics, which is cookieless and does not identify you. Separately, we ask whether we may use Google Analytics. It stays off, and sets no cookies, unless you choose "Allow analytics". If you do, Google Analytics sets first-party cookies (named _ga) and receives the pages you view, an approximate location derived from your IP address, and your device and browser type. We have its advertising features switched off: no Google Signals, no ad personalization, no link to any ads account. A browser sending a Global Privacy Control signal is treated as a "no" without being asked.

You can change your choice at any time: open analytics preferences. Turning it off removes the Google Analytics cookies from this browser. The only other cookies we set are the ones the site needs to work: your sign-in session, the certification you are studying, and a first-party note of which link brought you here.

Your rights

Export, delete, or rectify your data at any time from your account page. EU/UK users: you have full GDPR rights, email privacy@tieronedefense.com to exercise them.

Subprocessors

Supabase (database hosting), Vercel (web hosting), Stripe (billing), Resend (transactional email), Anthropic (AI tutor responses), Google (Google Analytics, opt-in only).