Privacy Policy

This Privacy Policy explains how Luxiac Inc. (“EngBot,” “we,” “us”), headquartered in Toronto, Ontario, Canada, collects, uses, discloses, and protects personal information when you use EngBot Academy at academy.engbot.app (the “Service”). We are the organization responsible for this information (the “controller” in GDPR terms). We offer the Service worldwide and this policy is written to satisfy Canada’s PIPEDA, Quebec’s Law 25, the EU/UK GDPR, and U.S. state privacy laws including the California CCPA/CPRA, wherever they apply to you. If anything here is unclear, write to engbot.app@gmail.com and a human will answer.

1. Information we collect

Information you give us directly:

• Account data — email address and password (the password is held and hashed by Google Firebase Authentication; we never see or store it), or your Google account identifier if you use “Continue with Google,” or, in the iOS app, your Apple ID identifier, name, and the email you choose to share (which may be Apple’s private relay address) if you use “Sign in with Apple” — plus a record of which sign-in method your account uses.
• Guest accounts (mobile apps) — if you start without registering, we create an account under a random handle with no email, name, or contact details; only your learning activity is stored under it. Adding an email later links that same account. Guest accounts with no activity for 90 days are deleted automatically.
• Email changes — when you add or change your sign-in email, we hold the new address as “pending” and send it a confirmation link; the switch happens only when that link is opened.
• Profile & preferences — display name, chosen discipline, learning goal, self-reported starting level, daily minutes budget, study buddy, timezone, language, theme, sound/motion settings, and notification choices.
• Uploaded materials — files you choose to upload (PDF/PPTX), the text we extract from them, and the sections you select. Uploads are always optional and are used only for your own account (see section 4). We keep the original file in our storage so your course can be rebuilt and so staff can open the actual file if a review is needed; it is deleted with the material or with your account.
• Correspondence & reports — anything you send us by email or through support, including bug reports you file in-product (which include your account identifier, the page context, your message, and a one-line technical snapshot taken at filing time).

Information generated by your use of the Service:

• Learning activity — calibration answers, quiz responses and scores, lesson completions, session timestamps (including the time of day you study), streaks and streak freezes, torque (XP), per-buddy XP, bolts, per-topic mastery statistics, arcade scores, chest unlocks, and certification records.
• Security data — if you enable two-factor authentication: a one-way SHA-256 hash of each 6-digit code (never the code itself) for its 10-minute lifetime, the time a code was last sent, and the timestamp of your last verified sign-in.
• Notification data — which reminder emails and app notifications were sent to you, when, which wording was used, whether delivery succeeded, and whether a lesson followed within a few hours (that is how we learn which reminders help and which to stop sending). Email is processed through our email provider, Resend; if a message bounces or is marked as spam, we record that and stop optional email to that address.
• Push token (mobile apps) — only if you allow notifications on your phone: the device token Apple or Google issues so we can deliver notifications to that device, and whether it is a test or store build. It is removed when you sign out on that device, when the token stops working, or with your account.
• Bug reports — when you use “Report a bug,” the category you pick, anything you type, and a diagnostic snapshot taken at that moment (active course and progress, plan, whether you were on the website or in the app, the page you were on, and your browser or device user-agent) so we can reproduce the problem.
• Automatic error reports — if a screen crashes or a request fails unexpectedly, the app or website sends us the error message, the page you were on, whether it was the app or the website, your browser or device user-agent, and your account identifier, so we can fix it. If the mobile app cannot start, it sends a short launch log (which steps ran and how long they took, the device type, and the account identifier if one is signed in). These reports contain no lesson answers, uploads, or payment details. They are kept while the problem is being fixed and are deleted with your account.
• Technical data — IP address, device and browser type, and server logs used for security, debugging, rate-limiting, and abuse prevention.

Information from third parties:

• Stripe — subscription status, billing events, and a customer identifier. Full card numbers never touch our systems; Stripe (PCI-DSS Level 1) holds them.
• App Store / Google Play purchases — if you subscribe inside our iOS or Android app, Apple or Google processes the payment under its own terms and privacy policy. We receive only your subscription status, product, renewal and expiry dates, and the store’s subscription identifier — on iOS directly from Apple (its signed transaction records and App Store server notifications); on Android through RevenueCat, our subscription-management processor, which receives your account id so the purchase can be matched to your account. We never receive your card or store-account details.
• Google — if you sign in with Google: your email address and basic profile per the consent screen Google shows you.
• Apple — if you use Sign in with Apple in the iOS app: a stable identifier, and the name and email (or relay address) you approve on Apple’s sheet. Apple receives nothing about your learning activity.

We do not collect precise location, biometric data, health data, or data from data brokers, and we do not run third-party advertising or cross-site tracking of any kind.

2. How we use information, and our legal bases

• To provide the Service — operating accounts, lessons, adaptive calibration, roadmaps, progress mechanics, the arcade, certifications, and subscriptions. Legal basis: performance of our contract with you.
• To personalize learning — your discipline, level, goal, minutes budget, answers, and uploads determine which lessons and questions you see and how deep they go. Contract performance.
• To generate content with AI — see section 4. Contract performance / legitimate interests.
• To secure accounts — sign-in verification, 2FA codes, password resets, anomaly and abuse detection. Contract performance / legitimate interests / legal obligation.
• To communicate — see section 5. Consent (optional messages) / contract performance (service messages).
• To measure and improve — aggregate, non-identifying usage statistics via Google Analytics on the website, first-party visit counts on the website and in the apps; debugging from server logs. Legitimate interests / consent where required.
• To meet legal obligations — tax and accounting records, responding to lawful requests. Legal obligation.

We do not sell personal information, “share” it for cross-context behavioral advertising (as the CPRA defines those terms), or use it to train foundation models. We do not make automated decisions producing legal or similarly significant effects about you — adaptive difficulty only changes which practice content you see.

3. Support access

A small number of authorized administrators can view account records through an internal support console in order to help you: profile, plan, progress, course list, and activity timestamps. They cannot see your password (nobody can), your full payment details (Stripe holds those), or your 2FA codes (only hashes exist, briefly). Support staff may attach a short internal note to an account to keep context between support interactions; these notes are visible only in the support console, are written professionally as if you could read them, and are deleted with your account. Every support action taken on an account (for example a courtesy Pro grant, a password-reset send, or a support email) is recorded in an internal audit log — who did it, what, and when — precisely so that access to your data is accountable. Support actions are initiated only to resolve your issues.

Content review. Materials you upload and the lessons generated from them may be opened by our staff when a report, a complaint, or a lawful request calls for it, to enforce our Terms (for example copyright or illegal content). We do not run automated content filters over academic material — studying medicine, law, security, or any other subject is exactly what the Service is for. Staff access is limited to what the review needs and is logged — including every time a staff member opens an original file you uploaded, which is recorded in our audit log with the staff member’s identity and the time.

4. AI processing — in plain language

Lesson text and quiz questions are generated with third-party large-language-model providers (currently Anthropic; Google is available as a fallback by configuration). What is sent to them: curriculum topics, difficulty level, and learning-goal context — and, when you use the custom-course feature, excerpts of the materials you uploaded, so lessons and questions can be drafted from them. What is never sent: your name, email address, password, or payment details. Under our agreements with these providers, API inputs and outputs are not used to train their models. Generated curriculum content is cached and shared across learners at the same topic/level (it contains no personal information); content generated from your uploads is cached only for your account and shown only to you. AI lecture videos are assembled from that same lesson text: narration is synthesised with Google’s text-to-speech API and background illustrations are generated with Higgsfield from prompts that describe the topic — neither receives anything about you personally — and the video is rendered on GitHub-hosted build machines from that lesson content only. Finished videos are stored privately in your account until you delete them or your account.

5. Email, notifications & communications (CASL)

We send two kinds of email. Service messages — welcome, security codes, password resets, billing notices — are part of operating your account and cannot be disabled while you have one. Optional messages — study reminders (including check-ins when you haven’t studied for a while), streak alerts, progress and reward updates, weekly and monthly reports, and news & offers. Optional email keeps coming while your account is open, including when you haven’t started or have taken a break, until you unsubscribe or switch it off. In line with Canada’s Anti-Spam Legislation (CASL) and the U.S. CAN-SPAM Act, every optional message identifies EngBot Academy and our postal address and carries a one-click unsubscribe link for that kind of email, which takes effect immediately. Study reminders, streak alerts, progress emails and news & offers each have their own switch in Settings → Notifications (Email) and their own unsubscribe link.

What you agree to at sign-up. The sign-up screen tells you that you’ll receive study reminders and product updates by email. Where the law allows it, product news is then on from the start, based on that notice and your ongoing account with us (implied consent under CASL; the opt-out model under CAN-SPAM). In the European Economic Area, the United Kingdom, Switzerland and Quebec, product news stays off until you say yes — we may ask you once, in the app or on the website, and saying no changes nothing else. We record when consent was given and when it was withdrawn.

How reminders are chosen. Reminder timing and wording are picked automatically from your own activity on EngBot — when you usually study, your streak and streak freezes, your course progress and Field Notes, and which earlier reminders were followed by a lesson. Nothing is bought from or combined with other sources, nothing is used for advertising, and no decision with legal or similarly significant effect is made this way. We never send them in the middle of the night in your timezone. You can ask us at any time to stop using learned timing.

App notifications. The iOS and Android apps send notifications only if you allow them on your device, and never require them. When you create your account in the app, or turn notifications on from EngBot’s own screen in the app, you agree to study reminders, streak alerts and occasional news about new features as notifications (in the EEA, the UK, Switzerland and Quebec, news waits until you turn it on). Each has its own switch in Settings → Notifications (Push notifications), and your phone’s settings can turn all of them off. Notifications appear on your lock screen, so they never include your email address or the contents of materials you uploaded. They are delivered through Apple Push Notification service (iPhone) and Firebase Cloud Messaging (Android).

6. Cookies, local storage & analytics

• Strictly necessary — sign-in session state (Firebase Auth tokens), and local storage for on-device preferences: your theme, an in-progress onboarding draft, a last-activity timestamp used for the 24-hour inactivity sign-out, and small flags such as whether you have seen the first-run tutorial. These stay in your browser; the Service cannot work without them.
• Analytics — Google Analytics 4 measures aggregate usage (page views, feature events like “lesson complete”). We use it to understand what to improve, not to build advertising profiles. If you are in the EEA, the UK, Switzerland, or Quebec, analytics runs only after you allow it in the banner we show on your first visit; elsewhere it is on by default. You can change your choice at any time in Settings → Data & privacy, and you can also block it with standard browser tools, an ad-blocker, or Google’s opt-out add-on without affecting the Service. No analytics cookie is set before you allow it where consent is required. The iOS and Android apps do not use Google Analytics or any other third-party analytics, advertising or tracking SDK; they set no analytics or advertising cookies, only the sign-in state and preferences above.
• First-party visit counts — we also count page visits ourselves, without cookies and without storing anything in your browser: the page, your country and region, a device class (phone, tablet, computer) and the site that referred you. To count unique visitors we combine your IP address and browser signature with a salt that changes every day and keep only the resulting hash; the IP address itself is never stored and the hash is deleted within 48 hours. Because this identifies no one, it runs regardless of the analytics choice above.

We honor the Global Privacy Control (GPC) signal where the law gives it effect. We do not respond to legacy “Do Not Track” headers, which have no settled meaning.

7. Who we share information with

Only service providers (“processors”) acting on our documented instructions, each bound by contract to protect your data and use it solely to provide their service to us:

• Google (Firebase / Google Cloud) — authentication, database, hosting infrastructure, analytics. United States.
• Vercel — application hosting and delivery. United States.
• Stripe — payments and subscription management. United States / Canada.
• Anthropic (and optionally Google) — AI content generation as described in section 4. United States.
• Google (Cloud text-to-speech), Higgsfield and GitHub — lecture-video narration, illustrations and rendering, from lesson content only (section 4). United States.
• Apple App Store and Google Play — in-app subscription billing for the iOS and Android apps; RevenueCat — subscription status for the Android app. United States.
• Resend — transactional and notification email delivery. United States.
• Apple (Apple Push Notification service) and Google (Firebase Cloud Messaging) — delivering app notifications, only if you allow them. They receive the device token and the notification text. United States.

Beyond processors, we disclose personal information only: with your direction (for example a certificate page you choose to share); to comply with law or valid legal process; to protect the rights, safety, or property of users, the public, or EngBot; or as part of a merger, acquisition, or asset sale, in which case this policy continues to apply and we will notify you. We have never received a national-security request; we review every government request for legality and narrowness.

8. International transfers

We serve users worldwide from infrastructure primarily in the United States and Canada, so your information may be processed outside your own jurisdiction, where privacy laws may differ. Where the GDPR/UK GDPR applies, transfers to our processors rely on adequacy decisions or Standard Contractual Clauses (and the UK Addendum); contact us for details. For Quebec residents: your information may be communicated outside Quebec as described here, following an assessment of the protections in place, per Law 25.

9. How long we keep things

• Account, profile, progress, uploads, sessions — while your account exists. When you delete your account, sign-in is blocked immediately and the data is kept for 30 days so you can recover it (and so we can answer lawful requests about that period); it is then permanently erased. A minimal deletion record (account id, email, the dates) is kept for 12 months. See academy.engbot.app/delete-account.
• Guest accounts — deleted after 90 days without activity, unless an email has been added.
• 2FA code hashes — 10 minutes.
• Notification records (what was sent, when, and whether a lesson followed) — 90 days; aggregate per-wording counts contain no personal information. Push tokens — until you sign out on that device, turn notifications off, the token stops working, or you delete your account. Consent and unsubscribe records — kept for as long as we might need to show when consent was given or withdrawn.
• Billing records — as tax, accounting, and fraud-prevention law requires (typically 7 years in Canada).
• Certificates — completion certificates are share pages; on account deletion they are detached from your identifiers.
• Server logs — up to 90 days unless part of an active security investigation.
• Cached AI curriculum content — indefinitely; it contains no personal information.
• Error reports and bug reports — while the issue is open, and deleted with your account.
• Uploaded originals — until you remove the material or delete your account (then purged with the rest after the 30-day window).

10. Security

All traffic is encrypted in transit (TLS 1.2+); data is encrypted at rest by our cloud providers. The database accepts no direct client connections — every read and write passes through our authenticated server layer, and database security rules deny everything else. Passwords are held only by Firebase Authentication; 2FA codes exist only as short-lived hashes; payment credentials are held only by Stripe. Production access is limited to personnel who need it. No system is perfectly secure: if a breach creates a real risk of significant harm we will notify affected users and the appropriate authorities (including the Office of the Privacy Commissioner of Canada) as applicable law requires, and we keep the records of security safeguards PIPEDA expects.

11. Your rights

Wherever you live, you can: access your data (Settings → Data & privacy → Download my data gives a complete machine-readable export, instantly); correct it (edit in-app or ask us); delete it (Settings → Delete account, effective immediately, or ask us); and withdraw consent to optional communications (the unsubscribe link in any email, or Settings → Notifications on the website or in the app). We answer verified requests within 30 days and never charge for reasonable ones. Additionally:

• Canada — PIPEDA rights of access and correction; you may challenge our compliance with the person accountable for privacy (contact below) and complain to the Office of the Privacy Commissioner of Canada, 30 Victoria Street, Gatineau QC K1A 1H3, priv.gc.ca. Quebec residents have Law 25 rights including data portability and may complain to the Commission d’accès à l’information.
• EEA/UK — rights of access, rectification, erasure, restriction, portability, and objection (including to legitimate-interest processing), and to withdraw consent without affecting prior processing; you may complain to your supervisory authority (in the UK, the ICO).
• California and other U.S. states — rights to know, access, correct, delete, and non-discrimination. We do not sell or share personal information, nor process it for targeted advertising or profiling with legal effects, so there is nothing to opt out of; we still honor GPC. You may use an authorized agent with proof of authority. Appeals: if we decline a request, you may appeal by replying to our decision or writing to engbot.app@gmail.com with “privacy appeal” in the subject; we will respond within 45 days with our decision and reasons, and if we deny the appeal we will tell you how to complain to your state Attorney General. This appeal right is available to everyone, and is required for residents of Virginia, Colorado, Connecticut, and other states with equivalent laws.

12. Children

The Service is not directed to children under 13, and we do not knowingly collect personal information from them. Where local law sets a higher age of digital consent (up to 16 in parts of the EEA), that age applies, and minors need a parent or guardian’s permission per our Terms. If you believe a child has an account, contact engbot.app@gmail.com and we will delete it promptly. Quebec: under Law 25 we collect personal information from a minor under 14 only with the consent of a person having parental authority; if you are under 14 in Quebec, ask a parent or guardian to set up and supervise the account.

13. Changes to this policy

We may update this policy as the Service or the law evolves. Material changes will be announced by email or in-product notice before they take effect, with the “Last updated” date revised above. Continued use after the effective date means the updated policy applies; where a change requires fresh consent, we will ask for it.

14. Contact

Privacy Officer, Luxiac Inc., 375 University Avenue #3231, Toronto, ON M5G 2J5, Canada · engbot.app@gmail.com. We will identify the specific person accountable for privacy compliance on request, per PIPEDA Principle 1, and we respond to every privacy inquiry — including from regulators — without dodging.