Privacy Policy
Effective date: August 14, 2026. Short version: we collect the minimum needed to run a store and a classroom, we run no third-party trackers, and we don't sell data — there's nothing to sell.
1. What we collect
Account data: your email address, the name you give us, and your password — stored only as a salted scrypt hash, which cannot be reversed into your password. Email verification timestamps and login attempt counters live alongside it.
Purchase data: your orders (what, when, price) and the resulting content access rights. When payments launch they will be processed by Stripe; your card number never touches our servers — we receive only a confirmation that payment succeeded.
Saved work: trainings you save to your account, and feedback or content-issue reports you submit (with your account attached if you're signed in).
Analytics: a first-party count of page views per page per day. No IP addresses are stored with it, no cookies are used for it, no profile of you exists. It answers "how many people visited", nothing else.
2. Cookies and local storage
One cookie: ct_session, which keeps you signed in. It is HttpOnly,
first-party, and expires after 12 hours. Your shopping cart and topic selections live
in your own browser's local storage and are not sent to us until you check out.
There are no advertising or tracking cookies, ours or anyone else's.
3. Who touches the data (processors)
We run on a small set of infrastructure providers, each seeing only what their job requires: Render (hosts the application and database), Brevo (sends transactional email such as verification links and receipts to your address), Cloudflare (DNS and inbound email forwarding), and — once payments launch — Stripe (payment processing). We do not share, rent, or sell your data to anyone for marketing.
4. Retention and deletion
Account data is kept while your account exists. Order records are kept as long as accounting and tax rules require. To delete your account and its data, email contact@learnshaper.com from the account's address — we verify it's you, then delete the account, sessions, and saved trainings, keeping only the order records the law requires us to keep.
5. Your rights
You can ask us at any time what data we hold about you, ask for a copy, correct it, or have it deleted (subject to the retention duties above). One email to contact@learnshaper.com does it — no forms, no dark patterns.
6. Children
LearnShaper is not directed at children under 13, and we do not knowingly collect their data. If a child has created an account, contact us and we will delete it.
7. Security
All traffic is encrypted (HTTPS with HSTS). Passwords are salted and hashed with scrypt. Sessions expire. The database lives on access-controlled infrastructure with daily backups. No system is perfectly secure, but this one is built conservatively — and holds little worth stealing by design.
8. Changes
If this policy changes materially, the effective date above changes and the new version applies from then on. We will not retroactively weaken your rights over data collected under an older version.