Privacy Policy

Last updated: August 17, 2026 · Draft template. Have counsel review before charging users.

1. The short version

• You can use the trainer without an account. In that mode your practice data lives only in your browser's local storage and never reaches our servers.
• If you create an account, we sync your practice data so you can move between devices. We use it to run the product, not to advertise to you.
• We do not sell personal data and we do not run third-party ad trackers.

2. What we collect

• Account data. Your email address, used for passwordless sign-in links and essential service messages.
• Practice data. Your answers, timing per question, skill ratings, review schedule, flashcard progress, session history, and settings such as your goal and test date.
• Product events. Basic usage events (for example: round started, question answered, round completed) tied to your account, used to understand and improve the product.
• Site analytics. The marketing site uses cookie-free, aggregate analytics. We do not use advertising cookies.

3. How we use it

• To run the adaptive engine: your answers drive your skill ratings, question selection, and review schedule.
• To sync your progress across devices when you are signed in.
• To fix problems and improve question quality, using aggregate statistics such as per-question correct rates.
• To send the service emails you request, such as sign-in links. Optional email like a weekly digest has its own toggle in your account.

4. Where it lives and who processes it

• Synced data is stored with Supabase (hosted in the United States), protected by row-level security so each account can only read its own rows.
• The website and app are served by Cloudflare.
• When paid plans launch, payments will be processed by Stripe through Stripe-hosted checkout. Your card details go to Stripe, never to us.
• We do not sell or rent personal data. We share it only with the processors above, or if the law requires it.

5. Your controls

• Export. Download your complete practice data from the Account page at any time.
• Import or stay local. You can keep everything in your browser and never create an account.
• Delete. Delete your account and synced data from the Account page. Deletion is permanent.
• Questions. Write to privacy@startfromnowhere.com and we will respond within 30 days.

6. Retention

We keep account and practice data while your account exists. If you delete your account, synced data is removed from the production database promptly and from backups on their rotation schedule. Local browser data is yours to clear at any time.

7. Children

The Services are not directed to children under 16, and we do not knowingly collect data from them. If you believe a child has created an account, contact us and we will delete it.

8. Changes

If this policy changes in a way that matters, we will note it here with a new date and, for signed-in users, flag it in the app before the change takes effect.