Privacy policy
GroundSkill is a certification-preparation application. This policy explains the information used to provide the service.
Information we collect
- Google account data: when you choose Google sign-in, GroundSkill receives your Google account identifier and email address through Supabase Auth. We do not request access to Google Drive, contacts, calendars, or other Google services.
- Account credentials: when you sign in with an email address and password instead, the address and password go to Supabase Auth, which stores the password as a one-way hash. GroundSkill records the email address and never receives or stores the password itself. Supabase Auth sends the confirmation and password-reset messages for those accounts.
- Learning data: course progress, answers, review state, and feedback you submit.
- Subscription data: provider checkout and subscription identifiers, trial and renewal dates, payment status, cancellation state, and refund events. Payment card details are handled by Paddle and are not stored by GroundSkill.
- Product activity: first-party events such as lesson and step starts, questions shown, answers submitted (correct or incorrect only, never the answer text), lesson completion, sample completion, trial activation, payments, and return visits, associated with your session or learner account, study session, and course version. Analytics events do not include free-form answers.
- Service data: an opaque session cookie and limited operational logs needed to run and secure the application, plus first-party visit counts for our marketing pages: which page was visited and on which day, the referrer host, campaign tags carried by the link followed to reach us, and a daily anonymous identifier that cannot be linked across days. Raw IP addresses and full browser identifiers are never stored, and no third-party trackers, advertising cookies, or cross-site identifiers are used.
- Generated-feature inputs: text you deliberately submit to an AI-assisted learning feature may be processed to produce the requested response.
How we use information
We use this information to authenticate you, preserve and synchronize learning progress, provide course features, respond to requests, maintain security, diagnose failures, and improve the beta experience.
Sharing and service providers
We do not sell personal information or use it for advertising. Information is processed only as needed by infrastructure and authentication providers, including Railway and Supabase, by Paddle for checkout and subscription management, by Resend to deliver transactional trial reminders to your verified account email, and by an AI service provider when you use an AI-assisted feature. Signing in or starting a trial does not subscribe you to marketing email.
Retention and control
Account and learning data is retained while needed to provide the service and operate the beta. You may request access to or deletion of your account data using the support address shown on the Google consent screen.
Security and changes
We use reasonable technical safeguards, including HTTPS, restricted authentication redirects, and HTTP-only session cookies. No online service can guarantee absolute security. We may update this notice as the beta evolves and will revise the effective date when we do.