Privacy and student data

Guest answers

Guest answers stay in this browser. They are not sent to the server. Reset this browser removes that saved copy from this browser. Clearing this site's data in the browser does the same. A file you downloaded or a page you printed is a copy you keep.

An account

A personal account or a school account stores the email, the display name, and a hash of the password on this site's server. The password itself is not stored. The answers are stored with that account. Sign-in sets a cookie named learnality_session. Sign-out deletes that session. It does not delete the account. A free personal account gets one welcome email. Occasional updates are a separate choice. For anyone 18 or older the box starts checked and can be unchecked. For ages 13 to 17 the box starts unchecked. Anyone under 13 does not see it. A parent can choose updates for themselves. You can stop updates from a link or from account settings.

A waitlist email

After a free result you can leave an email for one note when Premium opens. The yes box has to be checked. The address is stored once on this site's server, with the time and the source free-blend. Nothing is emailed. To remove it, use Remove my email on the result page. That calls /api/waitlist/remove. The reply is the same whether or not the address was on the list. Closing an account also removes a waitlist row that uses the same email. The site owner can download the list. A teacher cannot. It is not a school record.

Who can see school records

A school student's saved answers can be opened by the teacher assigned to that student. A school administrator of that school can export that school's student records. Another student cannot open them. A guest cannot open them.

Step counts

We count how many browsers reach a few steps: opening the home page, starting the questions, reaching halfway, finishing, seeing the result, joining the waitlist, opening the save page and making a free account. Finishing the questions also counts one time bucket: under 3 minutes, 3 to 5, 5 to 8, 8 to 12, or over 12. Seeing the result also counts whether the top approach changes when the questions worded the other way round are left out. Saving, printing or sharing your card counts too, but never the card itself or the name on it. Starting and finishing a retake count too, so a person who retakes counts twice. On the server we also count each checkout started, purchase, refund and account deleted, as a daily total with no name or email. We keep only one total per step per day. Your answers, email, IP address, cookies and account are not saved with it, so nothing identifies you. Your browser keeps a small note so a step counts once a day. School students and staff are never counted. If you turn on Global Privacy Control or Do Not Track, nothing is counted. A view of an approach page is counted the same way. A sign-in cookie, Global Privacy Control, or Do Not Track means that view is not counted, and the cookie is not stored.

How to remove an account

A personal account, not a school account, can be closed from #personal-account. That page calls /api/personal-account/erase after a preview, the current password, and a yes. It runs only when the operator has configured the procedure. If it is not configured, the page says so and nothing is deleted. A school account is not closed there. A school administrator can erase one student's records at /api/school/students/:id/erase when an approved procedure is configured. If it is not configured, the server says erasure is unavailable and nothing is deleted.

How long we keep it

A sign-in session and a recovery link are deleted 7 days after they expire.

The words of an email are removed 30 days after it is sent. A short note may stay, with no address and no message.

A waitlist email is deleted 12 months after the person joins.

An account with no visit for 24 months is marked quiet. It is not deleted. TODO-VLAD: deletion waits until Vlad confirms the 24 month period.

A pending account for anyone under 13 is deleted after 14 days if a parent does not agree.

Guest answers stay in the browser until the person clears them. Account answers stay until the person erases the account, or a parent erases a linked child.

Backups and host logs still have no timer.

The reflection

The reflection is a self-report of study habits. It is not a test and not a diagnosis.

Checkout

Premium checkout is not open. Nothing on this site charges you.

Outside audit

There has been no formal outside audit.

Children's privacy

Personal accounts are for 13 and older. Accounts for children under 13 are not open.

A student who joins with a class code is not asked for a birth month or a parent email. That use is under school authorization for educational use only. TODO-VLAD: schools must agree to act for parents in the school agreement. A class code from one teacher, with no school agreement, is a gap.

Operator legal name: Vladimir Chernov. Postal address: 6360 Telephone Rd, Ventura, CA 93003. Email: [email protected]. Phone: (630) 344-2662. The product reply address is [email protected]. That is not a substitute for the operator details a children's notice needs.

TODO-VLAD: a written security program, which the 2025 COPPA rule changes expect, is not in this draft. Pending requests are deleted after 14 days. A parent can delete a child's account on request. The section How long we keep it states the timers for sessions, recovery links, email messages, the waitlist, and a quiet account mark. Backups and host logs still have no timer.

TODO-VLAD: a lawyer should review this before any marketing to children or teens.

Questions can go to [email protected].

Contact

The contact form opens an email draft to [email protected] in your mail app. This site does not send or store that message.