Privacy policy

1. What we collect

You can read every lesson without an account. When you log in, we store:

• Account data: your email address, the name you give us (or the name from your Google profile), your avatar (an emoji or a photo you upload), your interface language and the ways you have logged in.
• Learning data: your answers to exercises, scores, lesson progress, topic mastery and certificates.
• AI usage records: when and how much AI feedback you used, so we can apply daily limits. These records contain token counts and costs, not your answers.
• Technical data: our hosting providers keep standard server logs (IP address, browser, requested page) for security and troubleshooting.

We use Google Analytics and PostHog to understand how the site is used. Until you allow analytics in the cookie banner (or if you decline), they only receive cookieless usage pings such as pages viewed and approximate location, and nothing is stored in your browser. If you allow analytics, they may set cookies, and PostHog records sessions: how you move, scroll and click on our pages, with everything you type masked. If you are logged in, this data is linked to your internal account ID, never to your email or name.

2. Google sign-in

If you log in with Google, we ask Google only for your basic profile: a unique account ID, your email address, whether it is verified, and your name. We do not get your password or access to your Gmail, Drive, contacts or any other Google data.

We use this data only to create your account and log you in. We do not sell it, use it for advertising, or share it with anyone except the providers listed below that help us run the service. Our use of information received from Google APIs follows the Google API Services User Data Policy, including the Limited Use requirements.

3. Mobile app

This policy also covers the Productovi app for Android (package com.productovi.learning), published on Google Play. The app uses the same account and stores the same account and learning data as the website, as described above.

• Without an account, your progress, settings and lesson positions stay on your device only.
• When you log in, the app keeps a login token in the device's encrypted storage and syncs your progress with our server.
• If you choose a photo as your avatar, the app asks for access to that one photo and uploads only it.
• Learning reminders are scheduled on your device; the app asks for permission to show notifications, and you can turn reminders off in the app at any time.
• The app sends usage events to Google Analytics for Firebase: screens opened, lessons and exercises started and finished, the app version, device model, operating system and approximate location (country or city). If you are logged in, these events are linked to your internal account ID, never to your email or name. They are used only to understand how the app is used and to improve it. You can turn them off at any time in the app: Menu → Usage analytics.
• Google Play itself may collect data under Google's own privacy policy when you install or update the app.

You can delete your account in the app (Menu → Delete account) or on the website; uninstalling the app removes the data stored on your device.

4. Why we use your data

• To provide the service you asked for: your account, saved progress, exercise feedback and certificates (performance of a contract).
• To send you login links by email (performance of a contract).
• To keep the service secure and within budget: rate limits, abuse prevention and AI usage limits (legitimate interest).
• To understand how the site is used, only if you agree (consent).

We do not send marketing emails and we do not sell personal data.

5. AI feedback

For open-ended tasks, the text of your answer and the task are sent to our AI provider, DeepSeek, to generate feedback. We do not send your name or email with it. Please do not include personal or confidential information in your answers.

6. Who processes your data

We use a small number of providers who process data on our behalf:

• Vercel (website hosting) and Render (API and database hosting).
• Resend (sending login emails).
• Google (sign-in with Google, Google Analytics, Google Analytics for Firebase in the app, and Google Play app distribution).
• PostHog (product analytics and, if you allow it, session recordings).
• DeepSeek (AI feedback, as described above).

Some of these providers are located outside Ukraine and the European Economic Area, including in the United States and China. Where required, transfers rely on the providers' contractual safeguards.

7. Certificates

When you complete a course, your certificate gets a public verification link. Anyone with the link can see the name on the certificate, the course, your average score and the date. The link is not listed anywhere; you decide whom to share it with.

8. Answers shown to other learners

When your answer to a written task or a case passes the AI check, other logged-in learners who have answered the same task can see it, so they can compare approaches. They see your name, your avatar, the text of the answer and, for cases, its score. They never see your email address or the AI feedback. Guests only see how many learners answered.

This is on by default, and a note under every answer box says so. You can turn it off for all your answers with "Show my answers to other learners" on your account page, or hide a single answer under its result. When you delete your account, your answers are deleted too. We rely on our legitimate interest in running a learning community; you can object at any time with these settings.

9. Cookies and local storage

• pl_session: keeps you logged in (30 days). Required.
• pl_oauth_state: protects Google sign-in (10 minutes). Required.
• PL_LOCALE: remembers the language you picked. Required.
• Browser storage for your theme and your cookie choice. Required.
• Browser storage for what you enter in the RICE, ICE, cohort retention and TAM/SAM/SOM tools, so it is still there when you come back. It never leaves your browser, and "Start empty" clears it.
• _ga cookies from Google Analytics, and ph_ cookies and browser storage from PostHog, only if you allow analytics.

You can change your analytics choice at any time with "Cookie settings" in the footer.

10. How long we keep data

We keep your account and learning data until you delete your account. Login links expire after 15 minutes. When you delete your account, your profile, answers, progress and certificates are deleted immediately; AI usage records stay only as anonymous cost statistics. Server logs are kept by our hosting providers for a limited period.

11. Your rights

You can view and change your name and avatar on your account page, and delete your account there at any time (step by step, including the app and email: productovi.com/delete-account). You can also ask us for a copy of your data, to correct it, to restrict or object to its processing, or to delete it by writing to serhii@productovi.com. We will reply within 30 days.

If you think we handle your data unlawfully, you can complain to the Ukrainian Parliament Commissioner for Human Rights or to the data protection authority in your country.

12. Children

The service is intended for people aged 16 and over. We do not knowingly collect data from younger children. If you believe a child has created an account, write to serhii@productovi.com and we will delete it.

13. Changes

If we change this policy, we will update the date at the top. If the changes are significant, we will tell logged-in users on the site.