Privacy Policy

When you sign up via Google or GitHub OAuth (through Supabase Auth), we receive the information your provider shares with us: your name, email address, and profile picture. We never see or store your third-party account password.

As you use CraftCourse, we also collect:

• Account data: username, XP, streaks, plan tier, and onboarding preferences
• Course data: the courses, modules, notes, and progress you create
• Chat data: messages you send to the Sage AI tutor, used to generate responses and, on paid plans, retained as chat history
• Usage data: which AI features you use (chat, quiz, summary, mindmap, study guide, flashcards) for the purpose of enforcing Potion limits
• Billing data: for paid plans, Stripe processes your payment details directly. We store your Stripe customer ID and subscription status, never your card number

We use your information to:

• Provide and maintain the Service, including generating your course outlines and AI tutor responses
• Track your progress, XP, streaks, and leaderboard position
• Process payments and manage your subscription through Stripe
• Send account-related communications (e.g. billing notices)
• Monitor and prevent abuse of AI features and free-tier limits

We do not sell your personal information to third parties, and we do not use your course content to train AI models.

CraftCourse relies on the following third-party services to operate:

• Supabase: database, authentication, and file storage
• Google Gemini: generates course outlines, quizzes, summaries, mindmaps, study guides, flashcards, and AI tutor chat responses. Your lesson context and questions are sent to Gemini to produce these responses
• Stripe: payment processing and subscription billing for Starter, Pro, and Teams plans
• YouTube: embedded video playback for lessons you choose
• Vercel: application hosting

Each of these providers has its own privacy policy governing how it handles data on our behalf.

You can delete your account at any time from your profile settings. Deleting your account anonymizes your personal information (username, name, email, avatar) and permanently bans the account from signing in again. Aggregated, non-identifying data (such as XP, course counts, and usage statistics) may be retained for analytics and abuse-prevention purposes, but is no longer linked to identifiable personal information.

If you delete your account and later create a new one with the same email address, your free-tier usage limits will reflect your prior account's history rather than resetting, to prevent abuse of free-tier limits through repeated sign-ups.

We use industry-standard security practices, including HTTPS encryption in transit, database-level access controls via Supabase Row Level Security, and OAuth-based authentication so we never store your third-party passwords. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

Depending on your location, you may have the right to access, correct, export, or delete your personal information. You can access and export most of your data directly from your profile and course pages, or delete your account entirely from profile settings. For any other request, contact us at the email below.

CraftCourse uses essential cookies for authentication (managed by Supabase Auth) and to remember your theme preference. We do not use third-party advertising or tracking cookies.

CraftCourse is not directed at children under 13, and we do not knowingly collect personal information from children under 13.

We may update this Privacy Policy from time to time. Material changes will be communicated by email or in-app notification. The date of the most recent revision is shown at the top of this page.

For any questions about this Privacy Policy or your data, reach out at:

support@craftcourse.app