Privacy Policy

This policy covers WorkDojo and VibeCoding Exercises. Both sites run on one service and one database. The data controller is [FOUNDER TO CONFIRM: legal name and address of the company that runs WorkDojo]. We keep what we collect small, and we don't sell your data.

What we collect

• Account details. Your email address and a user ID. If you sign in with Google, we also get the name and email Google shares with us.
• Progress. Lessons you finished or skipped, your best score, XP, streak, last active day and time zone.
• Exercise results. For each exercise, whether you got it right, wrong or skipped it, and when. Answers you type are checked in your browser. We don't save their text.
• Billing. Your plan, its status and renewal date, and Stripe customer and payment IDs. Stripe holds your card details. We never see your full card number.
• Tool requests. If you ask us to cover a tool, we save the tool name, your note, your email if you give it (or your account email if you're signed in), your user ID and which site you used.
• Question reports. If you report a problem with a question, we save the question, the reason, your note, the answer you gave, whether it was graded right, your email if you give it (or your account email if you're signed in), your user ID and which site you used.
• Emails you send us. Whatever you choose to tell us.
• Technical data. Our hosting and sign-in providers log basic request data, such as IP address, browser type and time, to keep the service running and secure.

As a guest, your progress stays in your browser. We don't store it on our servers until you sign in.

Why we use it, and our legal bases

If you are in the EU, UK or a similar place, these are the legal bases we rely on.

• To run the service you asked for (contract): sign you in, save progress, unlock your plan, take payment and send sign-in links and receipts.
• To keep the service safe and working (legitimate interests): stop abuse, fix bugs and see which lessons need work.
• To answer tool requests and messages (legitimate interests, or consent where you give us your email for a reply).
• To meet legal duties (legal obligation): keep billing records for tax and accounting.

We don't send marketing email unless you opt in. [FOUNDER TO CONFIRM: any newsletter or product email plans]

Who we share it with

We use these service providers. Each one handles data only to provide its service to us.

• Supabase: our database and sign-in. Stores your account, progress, plan, tool requests and question reports.
• Stripe: payments and the billing portal. Gets your email, user ID and payment details.
• Vercel: hosting. Handles every page request, so it sees request data like your IP address. We also use Vercel Web Analytics and Speed Insights, which count page views and measure page speed without cookies and without identifying you.
• PostHog: product analytics, when it's switched on. It records which pages you visit and actions like starting or finishing a lesson, using Listen, or starting checkout. It uses no cookies or browser storage, records no screens, and never sees what you type into exercises. If you're signed in, events are linked to your account ID.
• Resend: sends our emails, including sign-in links and receipts. Gets your email address and the message.
• ElevenLabs: makes the read-aloud audio. We send it only lesson text. We don't send your voice, your answers or anything about you.
• Google: only if you choose to sign in with Google.

We may also share data if the law requires it, or with a buyer if the business is ever sold. If that happens, this policy still applies to your data.

How long we keep it

• Account, progress and exercise results: while your account is open. Deleted when you delete your account.
• Tool requests: until we have reviewed them, up to [FOUNDER TO CONFIRM: retention, default 2 years]. If you delete your account, we remove your user ID from them.
• Question reports: until the question is fixed or reviewed. If you delete your account, we remove your email, note, answer and user ID from them.
• Billing records: Stripe and we keep these as long as tax and accounting law requires, often up to 7 years.
• Server logs: kept by our providers for a short time, usually days to weeks.

Your rights

• You can see, download or delete your data. Signed-in users can do this from the account page.
• You can ask us to correct your data, limit how we use it, or object to a use.
• If we rely on your consent, you can take it back at any time.
• If you are in the EU or UK, you can complain to your local data protection authority.
• Guests can clear their progress at any time by clearing this site's data in the browser.

For anything you can't do yourself, contact us. We will reply within 30 days.

Cookies and local storage

• Sign-in cookies. Supabase sets cookies that keep you signed in. They are needed for the site to work. Each site has its own.
• Local storage. Your browser keeps guest progress and settings like auto-read on your device.
• Moving between sites. When a guest follows a link between WorkDojo and VibeCoding Exercises, the link carries their progress in the part of the URL after "#". Browsers don't send that part to any server.
• We don't use advertising or tracking cookies.

Children

The sites are not for children under [FOUNDER TO CONFIRM: minimum age, default 13; consider 16 for the EU]. We don't knowingly collect data from them. If you think a child has given us data, contact us and we will delete it.

International transfers

Our providers may store and process data in the United States and other countries. Where data leaves the EU or UK, we rely on safeguards like the EU Standard Contractual Clauses or the EU-US Data Privacy Framework. [FOUNDER TO CONFIRM: Supabase project region]

Security

Data is encrypted in transit. Database rules let each person read only their own progress. Only our server code can write billing data and tool requests. No system is perfectly secure, so tell us if you find a problem.

Changes to this policy

We may update this policy. We will change the date at the top. If a change matters, we will tell signed-in users by email or on the site first.

Contact

Questions or requests about your data? Our contact email is coming soon. See also our Terms of Service.