Privacy Policy

1. Data we collect

We collect the minimum data required to run the Service:

• Account data: display name, email address, hashed password, role (student or instructor), and email verification status. Student accounts are assigned a pseudonym as their public display name so that real names are never shown to other learners.
• Learning data: responses you submit to lesson activities, scores, automated feedback, and progress indicators (units started, lessons completed, mastery status, review schedule).
• Course data: course enrollments, assignment completion, and gradebook rollups visible to your instructor.
• Billing data: for paid plans, Stripe handles payment information. We store only a Stripe customer ID and subscription status — we do not store card numbers.
• Messages you send us: if you use the contact form, we keep your name, email address, and message so we can reply. If you subscribe to the newsletter, we keep your email address and the page you subscribed from.
• Operational logs: error reports via Sentry, limited to stack traces and non-identifying debug context, and standard server logs (IP address, user agent, requested URL) retained briefly by our hosting provider for security and abuse prevention, including rate limiting.

2. How we use data

We use data to: (a) deliver the curriculum and feedback you requested; (b) show your progress on your own dashboard; (c) show instructor dashboards scoped to their own enrolled students; (d) process billing; (e) send account emails such as verification, password reset, and progress digests, and — only if you opt in — the newsletter; (f) diagnose platform errors and prevent abuse. We do not sell personal data, we do not share learning data with advertisers, and we do not use personal data for targeted advertising.

3. Cookies and analytics

We use one strictly necessary cookie: a session cookie that keeps you signed in. It is HTTP-only, secure, and same-site, and it expires after 30 days or when you sign out. We do not set advertising or cross-site tracking cookies, and we do not load third-party trackers.

We measure page views with Vercel Web Analytics, a first-party, cookieless analytics tool that records aggregate visits and pages without identifying individual visitors. Because we use no tracking cookies, the site does not display a cookie banner.

Do Not Track and Global Privacy Control. Since we do not track visitors across other sites and do not sell or share personal data for advertising, there is nothing further for these browser signals to switch off; we treat all visitors as if the signal were present.

4. Service providers (sub-processors)

We do not disclose personal data to third parties except to the following providers, who process it on our behalf under agreements that restrict use to providing their service to us:

• Vercel — application hosting, content delivery, server logs, and cookieless web analytics.
• Neon — managed PostgreSQL database hosting for account, learning, and course data.
• Stripe — payment processing and subscription billing for paid plans.
• Resend — transactional and newsletter email delivery.
• Sentry — error monitoring.
• Anthropic — the AI service provider that generates written feedback on activity responses (see section 5).
• Cloudflare — bot protection on the registration form (Turnstile), when enabled.

These providers operate in the United States. If you access the Service from outside the United States, your data will be transferred to and processed there.

5. Automated feedback processing

Activity responses may be sent to a third-party AI service provider to generate feedback. The processor handles the submission on our behalf, under terms that prohibit using submissions to train its models. Submissions are not retained by the processor beyond what is needed to return a response. Only the text of your response and the rubric evaluation of it are sent — never your name, email address, or account identifiers. Automated feedback is advisory; it does not by itself determine course grades, which remain under your instructor's control.

6. Instructor visibility

When you join a course via a class join code or instructor enrollment, that instructor can see your display name, email, completion percentages, and average scores for assignments they created. They cannot see your work in other courses or your private study activity.

7. Children and school use

The Service is intended for users aged 13 and older. We do not knowingly collect personal information from children under 13 through public self-registration. Where a school, homeschool co-op, or other educational institution uses the Service with students under 13, the institution or the student's parent or guardian provides consent on the child's behalf and we process the student's data solely for the institution's educational purposes, consistent with COPPA's school-authorization exception and our FERPA Statement. Parents and guardians may review, correct, or request deletion of their child's data by contacting us or the child's institution. If you believe a child under 13 has registered without such authorization, contact us and we will delete the account.

8. Data retention

Account and learning data are retained while your account is active. You can delete your account from Account Settings or by contacting support; upon deletion, personal identifiers are removed within 30 days. Server and error logs are retained for no more than 90 days. Newsletter subscriptions are kept until you unsubscribe. Contact form messages are kept for as long as needed to resolve your request. Anonymized aggregate data may be retained for product analytics.

9. Your rights

You can: (a) view your account and progress data via your dashboard; (b) export your submissions by contacting support; (c) correct your display name and email through account settings; (d) delete your account. Users in jurisdictions with applicable data protection laws (including the GDPR, the CCPA, and the Texas Data Privacy and Security Act) may also request access to, correction of, portability of, or deletion of their personal data, and may appeal a decision, by emailing the address in section 12. We will verify your request and respond within 45 days.

10. Email

We send account emails (verification, password reset, and progress digests) as part of operating the Service; you can stop digests at any time by emailing support@rigorousreasoning.com. The newsletter is sent only to addresses that subscribed to it and every message includes a one-click unsubscribe link.

11. Security

Passwords are hashed using industry-standard algorithms. Session cookies are HTTP-only, secure, and same-site. All traffic is encrypted in transit. Database access is restricted to platform servers. Authentication and form endpoints are rate limited. If we learn of a breach affecting your personal data, we will notify affected users and institutions without undue delay and within the time required by applicable law.

12. Contact

Privacy questions, data access requests, and deletion requests can be sent to privacy@rigorousreasoning.com. Security researchers can find reporting instructions at /.well-known/security.txt.

13. Changes to this policy

When we make material changes to this policy we will update the date at the top of this page and notify account holders by email before the change takes effect. Continued use of the Service after that date means you accept the updated policy.