Last updated: September 7, 2026

We collect as little as possible. Most of what the app remembers is stored in your own browser and never reaches our servers. Here's the full picture.

1. Stored on your device only

The following live in your browser's localStorage. These local preferences and saved copies stay in this browser:

• Theme preference — whether you chose light or dark mode.
• Free-prompt count — if you're using the app without an account, a simple counter of how many free prompts you've used.
• Returning-visit flag — remembers whether this browser visited before. We send only a returning yes/no value, never the flag or a visitor ID.
• Saved sessions — when signed in, your chats (the task type, a title, the messages, and a timestamp) so you can revisit them. These are kept only in this browser: they do not sync to other browsers or devices. Signing out hides them; signing back into the same account here restores access. Clear browser storage to erase them. We do not copy these sessions to our servers.

2. Your account (only if you create one)

Accounts are managed by Supabase Auth, a dedicated authentication service, and stored in its secure database. Your account record contains:

• Your email address and display name.
• Your password — hashed by Supabase, never in plain text. We never see or store your raw password; it's hashed with bcrypt and checked against known-breached-password lists.
• Account metadata — when the account was created and whether the email has been verified.
• Academy progress — which lessons you've completed and your quiz scores, stored with your account so it follows you across devices.

Your date of birth is not stored. We ask for it during sign-up only to confirm you're at least 13 years old, then we discard it.

3. Staying signed in

When you sign in, your session is stored in HttpOnly cookies issued by Supabase — they can't be read by scripts in your browser and aren't used to track you across other sites.

4. Security & abuse prevention

To protect the service, your IP address is used transiently, in memory, for rate-limiting, and failed sign-in attempts are counted per email to lock out brute-force attacks. These are not written to a database and reset over time.

5. Your chats and AI processing

To answer you, the messages you send in chat are transmitted to Anthropic's API (the company behind Claude) to generate a response. That processing is governed by Anthropic's own terms and privacy policy. We do not store the content of your chats on our servers — your saved sessions exist only in your browser (see section 1).

6. Analytics & tracking

We collect anonymous aggregate counts of visits, returning visits, tasks started, completed prompts, successful copies, and Yes / Not yet feedback. These usage events contain no conversation text, titles, account identifiers, or visitor IDs. Counts restart when the server restarts and are not unique-user counts. If the optional backend PostHog integration is configured, it receives only these sanitized events under a shared anonymous identity with person profiles disabled. We do not load third-party analytics or advertising scripts in your browser.

7. Your choices

• Use it as a guest — no account required (some features are limited). Anonymous usage counts and temporary abuse-prevention data still apply.
• Clear your data — clear your browser storage to remove saved sessions and preferences from your device. Signing out only hides saved sessions.
• Delete your account — email us at the address below and we'll remove your account record. (A self-serve delete button is on our roadmap.)

8. Contact

Questions about your data, or want your account deleted? Email privacy@aiskillstudio.com.