Privacy Policy

Last updated: 19 June 2026

Erudia ("we", "us") operates the website and learning application at erudia.org. This policy explains what we collect, why, who we share it with, and the choices you have. We don't sell your personal data.

1. What we collect

Account information — the email address you sign up with (or the email from your Google account if you use Sign in with Google), a securely hashed password, and, if you set them, a public display name and country.
Learning data — your lesson and mastery progress, answers, spaced-repetition review state, the adaptive model's per-skill estimates, XP, level, streaks, placement results, and speed scores.
Usage analytics — per-question event logs (timing, correctness, hints used, predicted vs. actual recall, and the review-model state) that we use to measure and improve the learning engine. These are linked to your account, so they are pseudonymous, not anonymous. We also store which variant of an A/B experiment you're in (for example, hint timing or review settings).
Community content — if you take part in the community, the problems you submit, your votes, flags, and solve records. Published problems and your display name and country are visible to other signed-in learners (for example, on leaderboards).
Local storage — we keep your progress and your sign-in session in your browser (localStorage) so the app works offline and can sync to your account.

2. How we use it

To provide the Service and sync your progress across devices.
To schedule reviews and adapt difficulty to you.
To measure and improve how well the learning engine works, including A/B experiments.
To process subscriptions, secure accounts, and prevent abuse.

3. Legal bases (EU/UK users)

We process your data to perform our contract with you (providing the Service), on the basis of our legitimate interest in measuring and improving the learning engine (you can object by contacting us), and — where required — with your consent.

4. Service providers we share with

We don't sell your data and we don't use advertising networks. We use a small set of trusted providers strictly to run Erudia:

Supabase — authentication and database hosting (your account, progress, and analytics).
Cloudflare — website hosting and content delivery.
Stripe — payment processing for subscriptions. Stripe acts as the merchant of record and handles your payment details directly; we never receive your full card information. See Stripe's privacy policy.
Google — only if you choose "Sign in with Google," to authenticate you.
Sentry — error monitoring. It receives technical error reports (such as stack traces and browser type) and is configured not to capture personal data by default.

5. Data retention & deletion

We keep your data while your account is active. You can permanently delete your account at any time from Settings → Delete account; this erases your progress, analytics, profile, and community contributions from our systems. Backups are purged on a rolling basis shortly afterward. You can also export your progress as a JSON file from Settings at any time.

6. Your rights

Depending on where you live (for example, under GDPR or UK GDPR), you may have the right to access, correct, export, or delete your personal data and to object to certain processing. You can do most of this yourself in Settings, or contact us at the address below.

California residents: the CCPA's thresholds may not apply to a service of our size, but we honor access and deletion requests regardless, and we do not sell or share your personal information.

7. Cookies & local storage

Erudia uses browser local storage to run the app and an authentication token to keep you signed in. We do not use third-party advertising or cross-site tracking cookies.

8. Children

Erudia is not directed to children under 13, and you must be at least 13 years old to use it. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has created an account, contact us and we will delete it.

9. Security & international transfers

We protect data in transit with TLS and restrict access at the database level with row-level security. Our providers may process and store data in the United States and other countries; where required, we rely on appropriate safeguards such as Standard Contractual Clauses.

10. Changes

We may update this policy; we'll change the "last updated" date above and, for material changes, notify you in the app.

Questions or requests: erudia@erudia.org · Terms of Service · Accessibility