Privacy · Public beta

Accounts store an email address, password hash, display name, timezone and account status. PostgreSQL also stores session records, lesson progress, quiz attempts, saved vocabulary, review schedules and study preferences.

Search text is sent to OpenRouter for embeddings when embeddings are enabled. Questions, selected canonical passages and prompts are sent through OpenRouter to the configured generation model (by default GPT-5.6 Luna). Consult OpenRouter’s privacy policy for provider handling; this application cannot guarantee upstream retention or deletion.

Request logs record an identifier, endpoint category, status and duration, without question bodies, passwords, authorization headers or session tokens. IP addresses are held temporarily in memory for traffic limits. Operators must configure limited log retention (recommended 14 days). Hosting gateways may separately process IP addresses and access logs.

By default, new answer audits do not retain the question text or generated explanation. Audit metadata, evidence identifiers and feedback become eligible for deletion after 30 days, and provider usage records after 90 days, with hourly cleanup. Earlier audit records can contain questions until cleanup. Operators can change these settings and must update this notice before collecting additional data. Submitted feedback comments can contain personal information; avoid including it.

Delete your account from the dashboard to remove account data, progress, quiz attempts, saved terms, schedules, sessions and linked answer audits. Shared canonical and curated content remains. Anonymous answers cannot be linked to an account. Aggregate billing records contain no user identity. Backups can retain deleted data until their retention expires (recommended 14 daily generations); restored backups require deletion reconciliation before serving users.

No email recovery or verification service is configured by this release. Production defaults to closed registration; existing accounts can sign in. Operators must publish a contact and their actual retention and backup settings before public launch.