Privacy Policy | decodemachine

Plain-language summary: we collect what is needed to run your account, save progress, process payments, and understand which lessons help people learn. We do not sell your personal data.

1. What we collect

Account data: email address, name, avatar (if you use Google), and authentication identifiers from Supabase Auth.
Learning data: completed lessons, XP, hints used, study time, command counts, daily drills, streak, and last active date.
Billing data: Stripe customer and subscription identifiers, plan status, and renewal dates. Card details are handled by Stripe and never reach our servers.
Product analytics: page views, clicks, and events such as “lesson_completed” or “checkout_started”, plus approximate device information. We use PostHog and Vercel Analytics.
Session and security data: sign-in and sign-out times, IP address, approximate city/country from our hosting provider, browser, operating system, device type, viewport size, language, referrer, campaign parameters, and session activity such as pages viewed and lessons completed. We use this to secure accounts, investigate abuse, support learners, and understand retention.
Technical logs: server errors and request metadata needed to keep the service secure and working.

2. Why we use it

To authenticate you and keep your progress synced across devices.
To run the streak, daily drills, and entitlement checks.
To process subscriptions, invoices, and cancellations through Stripe.
To improve lessons, fix friction, and measure conversion and retention.
To prevent abuse, investigate suspicious sign-ins, and support account issues.
To understand which acquisition channels and product paths lead to durable learning.
To comply with legal obligations.

3. Who processes it

We use service providers that process data on our behalf: Supabase (database and authentication), Stripe (payments and billing portal), Vercel (hosting and analytics), PostHog (product analytics), and Google (optional OAuth sign-in). Each provider has its own privacy and security terms. We do not sell personal data.

4. Cookies and storage

Supabase uses cookies to keep you signed in. We use local storage for theme, anonymous analytics identifiers, and a local copy of lab progress. You can clear these in your browser, but you may be signed out and lose unsynced local progress.

5. Retention and deletion

We keep account and learning data while your account is active. Session and authentication event records are kept for up to 6 months. Raw IP addresses are kept for up to 30 days and then removed; a hashed form may be retained for aggregate analysis for up to 6 months. You can delete your account from Account. Deleting your account cancels an active subscription, removes your profile, progress, sessions, and attribution, and anonymizes or deletes associated analytics records within a reasonable period. Some billing records may be retained where required by tax or accounting law.

6. Your choices

You can update your name and timezone from your account.
You can cancel marketing email at any time.
Depending on where you live, you may have rights to access, correct, export, or delete your data. Email us to exercise them.
You can use the site without Google sign-in by using email and password.

7. Children

The service is not directed at children under 13, and we do not knowingly collect personal data from them.

8. Security

Data is encrypted in transit. Database access is governed by row-level security. Payments are handled by Stripe. No system is perfectly secure; use a unique password and enable Google sign-in if you prefer.

9. Contact

Privacy questions or deletion requests: hello@decodemachine.com. See also our Terms of Service.