Privacy Policy

This policy describes how the operator of Explain It To Me ("we," "us," or "our") handles information in the Explain It To Me app at explain-it.pages.dev/app. It is a draft prepared for review.

1. Information we collect

• Account information. When you create an account, you provide an email address and password. Passwords are sent directly to our authentication provider, Supabase Auth, over HTTPS. We do not receive, store, or log your plaintext password. Supabase stores a password hash and returns a user ID, email address, and session tokens.
• Session information. The app stores your access token, refresh token, email address, and user ID in your browser's local storage so you stay signed in across reloads. The app sends the access token to our Worker to verify your session.
• Quota information. To enforce usage limits, our Worker stores an anonymous ID, IP-derived counters, your account email or user ID, and request counts. It does not store your questions, explanations, follow-up text, quiz answers, or images in quota storage.
• Content you submit. Topics, explanations, follow-ups, quiz answers, and history are stored in your browser's local storage. Text you submit is sent to our Worker and an AI model provider to generate a response. Photos are recompressed in your browser, sent to our Worker and the AI model provider for explanation, and are not saved in your history.
• Technical information. Our hosting and infrastructure providers may process standard request metadata such as IP address, user agent, timestamps, and HTTP status. Our Worker logs generic status labels or HTTP status codes, not prompts, model output, images, or passwords.
• Cookies and local storage. We do not use advertising or tracking cookies. The app uses browser local storage for your session, anonymous ID, history, pending confirmation/reset email, PKCE verifier, and email cooldowns.

2. How we use information

• To create and confirm accounts, sign you in, refresh sessions, reset passwords, and sign you out.
• To generate explanations, follow-ups, quizzes, and photo explanations.
• To enforce anonymous, signed-in, per-minute, and global usage limits and to prevent abuse.
• To diagnose failures, protect the service, and improve reliability.
• To comply with legal obligations and enforce our Terms.

3. Service providers and sharing

We use service providers to run the app. They process information on our behalf or as independent providers under their own terms:

• Supabase for authentication and account data. See Supabase's privacy policy.
• Cloudflare for hosting, the Worker, and infrastructure. See Cloudflare's privacy policy.
• Google for AI model processing through a Gemini model. See Google's privacy policy.

We do not sell your personal information. We may disclose information if required by law, to protect rights or safety, or as part of a merger or acquisition. AI providers may retain inputs and outputs according to their own policies; do not submit sensitive personal information.

4. Retention

• Browser history, session data, pending-email data, PKCE data, and cooldowns remain in your browser until you clear them, sign out, delete your account, or the app removes them.
• Account records remain until you delete your account. Self-service deletion removes the Supabase Auth account and email, and the short-lived usage counters tied to it. Counters that aren't linked to your account expire on their own within about two days.
• Anonymous IDs, IP-derived counters, and global counters cannot be tied to an account and expire automatically, usually within about two hours for hourly counters and about two days for daily counters. If counter cleanup fails during account deletion, the signed-in counters may remain until they expire.
• A session token issued before deletion can remain valid until it expires, usually within about an hour. Signing out and clearing this site's local storage removes it from this browser sooner.
• Server logs are kept for a short period for security and reliability, then deleted or aggregated.
• AI providers retain data according to their own policies.

5. Security

We use HTTPS, short-lived access tokens, refresh tokens, and server-side token verification with asymmetric ES256 signatures. The front end does not contain a Supabase service-role key or a legacy JWT secret. No system is perfectly secure, and we cannot guarantee absolute security.

6. Children

The app is intended for people 13 and older. If you are under 13, do not use the app. If we learn that an account belongs to a child under 13, we will delete it. Contact us if you believe a child under 13 has provided information.

7. Your choices

• Clear your local history and sign out from the app at any time.
• Delete your account and data in the app: open the header menu, choose Settings, and use the danger zone. You can also use the public deletion page at explain-it.pages.dev/delete-account. You must sign in and type DELETE to confirm.
• Self-service deletion removes your account and email in Supabase Auth and the short-lived usage counters tied to it. It also clears the explanations saved in this browser. Counters that aren't linked to your account expire on their own within about two days. If counter cleanup fails, the counters tied to your account may remain until they expire.
• If you cannot use the self-service page, contact us at [operator contact email].
• You can stop using the app at any time.

8. International processing

Our providers may process information in the United States and other countries. Those countries may have different data-protection laws than your country.

9. Changes

We may update this policy. We will post the new version on this page and update the date above. Material changes may also be announced in the app.

10. Contact

Questions or requests: [operator contact email]. Replace this placeholder before launch.