Privacy Policy

1. Data We Collect

We do not sell personal data to third parties. We do not use your data for advertising profiling.

2. Legal Bases for Processing

We rely on the following lawful bases (under GDPR and equivalent laws):

• Contract performance — to provide your subscription and enforce account access.
• Legitimate interests — security, fraud prevention, and service improvement.
• Legal obligation — where required by applicable law.
• Consent — for any optional marketing communications (you may withdraw at any time).

3. Third-Party Services

• Neon (database hosting) — stores your account and usage data on servers in the US.
• Lemon Squeezy / Link LLC — processes payment card data as our merchant of record.
• Cloudinary — hosts uploaded content images.
• Upstash (Redis) — rate-limiting counters (no personal data stored long-term).
• Google (Gemini AI) — AI-drafts question content; we do not send identifiable user data to the AI.
• Vercel — application hosting; may log request metadata (IP, timestamp).

Each provider processes data under its own privacy policy and, where applicable, standard contractual clauses for international transfers.

4. Data Retention

We retain your account data for as long as your account is active or as needed to provide the Service. After account deletion we retain anonymised aggregated statistics and any data required by law (e.g. financial records) for up to 7 years. Browser fingerprint hashes for anonymous usage are retained for 24 hours.

5. Your Rights

Depending on your location, you may have the following rights regarding your personal data:

• Access — request a copy of data we hold about you.
• Rectification — correct inaccurate data.
• Erasure — request deletion of your data (“right to be forgotten”).
• Portability — receive your data in a machine-readable format.
• Restriction / Objection — limit or object to certain processing.
• Withdraw consent — for any processing based on consent.

To exercise any right, email danielmainawaweru@gmail.com. We will respond within 30 days (or as required by law). We may verify your identity before processing a request.

6. Cookies and Tracking

We use session cookies for authentication. We use a one-way browser fingerprint hash (not stored in a cookie) solely to enforce the anonymous daily question limit. We do not use third-party advertising cookies or cross-site tracking. You can disable cookies in your browser, but this will prevent login from working.

7. California Residents (CCPA / CPRA)

California residents may request to know what personal information we collect, how we use it, and with whom we share it; to delete personal information; and to opt out of sale (we do not sell data). We do not discriminate against users who exercise these rights. To submit a request, contact us at danielmainawaweru@gmail.com.

8. International Transfers

Your data may be transferred to and processed in countries outside your own, including the United States. We take steps to ensure appropriate safeguards are in place (such as standard contractual clauses) when transferring data from the EEA, UK, or other regions with data-transfer restrictions.

9. Children's Privacy

The Service is not directed to children under 16. We do not knowingly collect personal data from anyone under 16. If you believe we have inadvertently collected such data, contact us and we will delete it promptly.

10. Security

We implement reasonable technical and organisational measures to protect your personal data, including bcrypt password hashing, HTTPS, and strict server-side access controls. No method of transmission over the internet is 100% secure; we cannot guarantee absolute security.

11. Changes to This Policy

We may update this policy from time to time and will notify registered users by email. The “Effective date” at the top of this page will be updated accordingly. Continued use of the Service after updates constitute acceptance of the revised policy.

12. Contact / DPO

For privacy questions, data subject requests, or complaints, contact our data controller:

EU/UK users may also lodge a complaint with their local supervisory authority (e.g., ICO in the UK, or your national DPA in the EU).