Privacy Policy

1. Information collection: personally identifiable information

In the course of using the Services, we collect personally identifiable information, such as your email address, authentication data, IP address, and persistent identifiers. We also collect billing information in connection with paid subscriptions; this is handled directly by our payment processor (Stripe), and we do not see or store full card numbers. We collect and store this personal information to operate your account, process subscription billing, and provide support for the internal operations of our Services and our Site.

2. Product usage data

We also collect data about how you use the Services, such as which questions you've viewed or solved, your progress across topics and pillars, and general interaction and traffic data. We use this solely to operate the product, for example, to show your progress and to understand how the Site is used so we can improve it.

3. Cookies and other technologies

Like many websites and applications, we use "cookies" to collect information. A cookie is a small data file that we transfer to your device for record-keeping purposes. We may use session cookies to enable certain features of the Site or Services, to keep you signed in, to better understand how you interact with the Site, and to monitor web traffic routing on the Site and aggregate usage of the Site and Services. You can instruct your browser, by changing its options, to stop accepting cookies or to prompt you before accepting a cookie from the websites you visit. If you do not accept cookies, however, you may not be able to use all portions of the Site or all functionality of the Services.

4. Information sharing and disclosure

We will not share, sell, rent, or trade your personal information with other parties, except as described below.

We rely on third-party service providers to operate the Services, including Supabase for authentication and data storage, and Stripe for payment processing. Each provider only receives the information it needs to perform its function on our behalf (for example, Stripe receives billing and payment details; Supabase stores your account and progress data), and each has its own privacy policy governing how it handles that data.

We may also disclose personal information if required to do so by law, or in the good faith belief that such action is necessary to comply with a legal obligation, protect the rights or safety of CrackTheStacks, our users, or the public, or investigate and prevent fraud or abuse of the Services.

5. Business transfers

We may sell, transfer, or otherwise share some or all of our assets, including your personal information, in connection with a merger, acquisition, reorganization, or sale of assets, or in the event of bankruptcy. Any such transfer will comply with all applicable laws and regulations, and the recipient will remain bound by this Privacy Policy with respect to previously collected personal information, unless you consent otherwise.

6. Data retention

We keep account and progress data for as long as your account is active. If you delete your account, or request deletion, we will delete or anonymize your personal information within a reasonable time, except where we are required or permitted to retain it (for example, billing records needed for tax or accounting purposes).

7. Security

We are concerned with the security of your personal information and are committed to taking reasonable steps to protect it from unauthorized access and use. To that end, we rely on the security practices of our infrastructure providers (including Supabase and Stripe) and put in place reasonable technical and organizational measures designed to secure personal information. No method of transmission over the Internet, or method of electronic storage, is 100% secure. Therefore, while we strive to use commercially acceptable means to protect personal information, we cannot guarantee its absolute security.

8. International transfer

We are based in France and primarily process personal data within the European Economic Area (EEA). Some of our service providers (such as Supabase and Stripe) may process or store data outside the EEA, including in the United States. Where this happens, we rely on appropriate safeguards recognized under the General Data Protection Regulation (GDPR), such as the European Commission's Standard Contractual Clauses, to ensure your data continues to receive an adequate level of protection.

9. Your rights

If you are located in the European Economic Area, the United Kingdom, or another jurisdiction with similar data protection laws, you have the right to access, correct, export, or delete your personal data, to object to or restrict certain processing, and to withdraw consent at any time where processing is based on consent. You can update much of your account information directly from your account settings, or contact us at the address below to exercise these rights, including to request deletion of your account and associated data.

You also have the right to lodge a complaint with your local data protection supervisory authority. In France, this is the Commission Nationale de l'Informatique et des Libertés (CNIL), which can be reached at www.cnil.fr.

10. Links to other sites

Our Services may contain links to other websites, applications, and online services. If you choose to visit a third-party service or click on a third-party link, you will be directed to that third party's website, application, or online service. We do not exercise control over third-party websites or services. These other websites or services may place their own cookies or other files on your device, collect data, or solicit personal information from you. We encourage you to read the privacy policies or statements of the other websites and services you use.

11. Children's privacy

The Services are not directed to children, and we do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us so we can take appropriate action.

12. Changes and updates to this Privacy Policy

This Privacy Policy may be revised periodically, and this will be reflected by the "last updated" date above. Please revisit this page to stay aware of any changes. Any amended Privacy Policy will automatically take effect 30 days after the change, except that we will not, without your consent, use your previously collected personally identifiable information in a manner inconsistent with the Privacy Policy in effect when we received that information. If you do not agree with any changes to this Privacy Policy, you may terminate your use of the Services.

13. Contact

Please contact us with any questions or comments about this Privacy Policy, your personal information, or our third-party disclosure practices, at crackthestacks@gmail.com.