Privacy Policy

We collect only what we need to run the Service:

• Account & profile: your name, email address, and — if you provide them — phone number, address, education level, and the reason you enrolled.
• Learning activity: your enrolments, lesson progress, and quiz attempts, so we can save your place and show your progress.
• Payment information: processed directly by Stripe. We receive a confirmation and limited transaction metadata (such as amount and status) but never your full card number.
• Usage & device data: pages viewed, referring links, basic engagement events, and how long each page was actively open. We also record your device type (mobile, tablet or desktop), your browser family, and an approximate location (city, region and country) resolved by our hosting provider at the network edge.
• Network identifiers: a hashed representation of your IP address, used for security and rate limiting, and a truncated form of it that keeps only the network portion (for example 203.0.113.0). We do not store your full IP address in our analytics.

We use your information to:

• create and secure your account and deliver the courses and content you access;
• process payments and provide receipts and support;
• save your learning progress and personalise your study experience;
• protect the Service — detecting abuse, enforcing rate limits and the single-device policy;
• understand aggregate usage so we can improve the platform; and
• send you essential service communications (and, only if you opt in, updates).

We use strictly necessary cookies to keep you signed in and to secure your session. We also use privacy-conscious, first-party analytics and aggregate measurement to understand how the site is used. We do not use cookies to build advertising profiles or sell your browsing behaviour.

Our first-party analytics do not use cookies at all. To tell one visit apart from another we store a random identifier in your browser's session storage, which your browser discards when you close the tab. Time-on-page is measured only while the page is actually visible, so a tab left open in the background records nothing.

Visitor-level analytics records are kept for 12 months and then automatically deleted. Only anonymous daily totals are retained beyond that point.

We share personal information only with the processors that operate the Service on our behalf, under contracts that require them to protect it:

• Stripe — payment processing;
• Supabase — authentication and database hosting for your account and progress;
• Our hosting / CDN and email providers — to serve the site and send account emails.

We do not sell your personal information. We may disclose information if required by law or to protect the rights, safety, and security of Meroidea and its users.

Passwords are hashed (never stored in plain text), connections are encrypted in transit, and database access is governed by row-level security so accounts can only reach their own data. Sensitive credentials are held in server-side environment configuration, never exposed to the browser. No system is perfectly secure, but we design defensively and act quickly on issues.

We keep account and learning data for as long as your account is active and as needed to provide the Service, then delete or anonymise it within a reasonable period, unless a longer period is required for legal, tax, or accounting purposes (for example, transaction records).

Depending on where you live, you may have the right to access, correct, export, or delete your personal information, to object to or restrict certain processing, and to withdraw consent. You can update much of your profile in your account settings, and you can contact us to exercise any of these rights. We will respond within the timeframe required by applicable law.

Our providers may process data in countries other than yours. Where personal information is transferred across borders, we rely on providers that offer appropriate safeguards for that transfer, consistent with applicable data-protection laws.

The Service is not directed to children under 16, and we do not knowingly collect their personal information. If you believe a child has provided us information, contact us and we will delete it.

We may update this Privacy Policy as the Service evolves. We will revise the “Last updated” date above and, for material changes, take reasonable steps to notify you. Your continued use of the Service after an update means you accept the revised policy.