Privacy Policy

Account information

When you sign up, we collect your email address and, optionally, your name. You can sign in with a magic link, with Google, or start as an anonymous guest (in which case we hold no email until you create an account).

Learning data

To personalize and measure your learning, we collect the information you give us and generate as you use the Service: your goals and prior knowledge, your answers and assessment results, your progress and mastery history (your "Learner Graph"), and the courses, lessons, and feedback generated for you.

Payment information

When you buy a subscription, payment is handled by Paddle (our Merchant of Record). Paddle collects your billing details and card information directly; we do not receive or store your full card number. We receive confirmation of your subscription status and a payment-provider identifier so we can apply your plan.

Usage & device data

We collect limited technical data — such as IP address, device and browser type, pages viewed, and product events — to operate, secure, and improve the Service.

Communications

If you email us, we keep that correspondence to respond and for support records.

• to provide the Service: generate and tailor your courses, run assessments, and track mastery;
• to measure whether your capability moved — the core of what lrnit does;
• to process subscriptions and manage your plan (via Paddle);
• to communicate with you about your account, learning, and important changes;
• to secure the Service, prevent abuse, and enforce our Terms;
• to understand usage and improve the product;
• to comply with legal obligations.

Our legal bases (where applicable) are performance of our contract with you, your consent (for example, optional communications), our legitimate interests in operating and improving the Service, and compliance with law.

To generate tailored courses, assessments, and feedback, we send prompts to large language models and related AI services. Those prompts can include your learner profile, your answers, and lesson context — that is what makes the content specific to you. All AI calls run server-side; provider keys never reach your browser.

We do not use your personal data or private content to train AI models, and the AI providers we use are engaged under API terms that do not grant them the right to train on the data we send them.

We share data with third parties that process it on our behalf, only as needed to run the Service:

• Supabase — database, authentication, and storage (all application data, including your Learner Graph);
• Vercel — application hosting and compute (request data and server logs);
• Paddle — payments and Merchant of Record (billing and payment data);
• OpenRouter — AI gateway to model providers (generation prompts);
• Google Cloud — text-to-speech narration;
• Jina AI — text embeddings used for retrieval and similarity;
• E2B — sandboxed code execution for project lessons (code you write and run);
• Brave Search — web content discovery (topic-derived search queries, no personal data);
• Sentry — error monitoring (error traces and diagnostics, configured to exclude auth tokens);
• PostHog — product analytics (usage events).

We may also disclose data if required by law, to protect our rights or users, or in connection with a business transfer (for example, a merger or acquisition), subject to this Policy.

We use strictly necessary cookies for authentication (a secure, http-only session cookie) and to remember preferences such as your language and theme. We use product analytics to understand how the Service is used. We do not sell your personal data.

We keep your Learner Graph while your account is active — longitudinal memory is part of the product. You can delete your account at any time from Settings, which permanently removes your profile, courses, mastery records, and generated content. Deleted data ages out of provider backups automatically as backups rotate (at most 30 days). We may retain limited records where required for legal, tax, or security reasons.

Depending on where you live, you may have the right to access, correct, export, or delete your personal data, to object to or restrict certain processing, and to withdraw consent. You can:

• export your full Learner Graph as JSON at any time from Settings ("Download my data");
• delete your account and its data from Settings;
• contact us at hello@lrnit.app to exercise any other right.

We will respond within the time required by applicable law. You may also have the right to complain to your local data-protection authority.

We and our providers process data in several regions, which may be outside your country (for example, our database is hosted in the Asia-Pacific region, and some providers operate in the United States and the European Union). Where data is transferred internationally, we rely on appropriate safeguards as required by applicable law.

The Service is not directed to children under 16, and we do not knowingly collect their personal data. If you believe a child has provided us data, contact hello@lrnit.app and we will delete it.

We protect data with tenant isolation, role-based access control, encryption in transit and at rest, and server-side handling of credentials. No system is perfectly secure, but we work to protect your data and to be honest about the controls in place. You can read more on our security page at lrnit.app/security.

We may update this Policy from time to time. We will update the "Last updated" date above and, for material changes, take reasonable steps to notify you.

For privacy questions or requests, email hello@lrnit.app.