Privacy Policy

1. Overview

tinybyte.ai (“we,” “us,” or “our”) is committed to protecting your privacy. This Privacy Policy explains what information we collect, how we use it, and your rights regarding that information when you use tinybyte.ai (the “Service”).

2. Information We Collect

Information you provide directly:

• Name and email address when you create an account.
• Password (stored as a one-way hash — we never store your plaintext password).
• Learning preferences you set during onboarding (skill, level, duration, goals).

Information collected automatically:

• Usage data: which weeks and resources you complete, exercise scores, and streak data.
• Technical data: browser type, device type, IP address, and session identifiers.
• Timestamps: account creation, last login, and terms acceptance.

3. How We Use Your Information

• To provide and personalise the Service, including generating your curriculum.
• To track your learning progress and maintain streaks and badges.
• To send transactional emails such as your email verification code.
• To respond to support requests.
• To detect and prevent fraud, abuse, and security incidents.
• To improve the Service through aggregated, anonymised analytics.

We do not sell your personal data. We do not use your data to train AI models without your explicit consent.

4. Third-Party Services

We use the following third-party services to operate the platform:

• Configured AI provider — Anthropic, OpenAI, Google Gemini, or DeepSeek may be used to generate curricula and exercises. Prompts may include your skill and level preferences.
• Google OAuth — Optional sign-in method. Governed by Google's privacy policy.
• Neon / PostgreSQL — Database hosting for your account and progress data.
• SMTP provider — Email delivery for verification and transactional messages.

Each third party is bound by their own privacy policies and data processing terms.

5. Cookies and Local Storage

We use session cookies to keep you signed in and browser local storage to track your module progress client-side. We do not use advertising or third-party tracking cookies.

6. Data Retention

We retain your account data for as long as your account is active. If you request account deletion, we will delete your personal data within 30 days, except where we are required to retain it for legal or compliance reasons.

7. Your Rights

Depending on your location, you may have the right to:

• Access the personal data we hold about you.
• Request correction of inaccurate data.
• Request deletion of your account and associated data.
• Object to or restrict certain processing of your data.
• Data portability where technically feasible.

To exercise any of these rights, contact us at support@tinybyte.ai.

8. Security

We use industry-standard measures to protect your data, including encrypted connections (HTTPS), hashed passwords, and access controls. No method of transmission or storage is 100% secure; we cannot guarantee absolute security but we will notify you of any breach that affects your personal data as required by law.

9. Children's Privacy

The Service is not directed at children under 13. We do not knowingly collect personal data from children under 13. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by updating the date at the top of this page and, where appropriate, by email.

11. Contact

Questions or concerns about this policy? Contact us at support@tinybyte.ai.