Privacy Policy
The short version
We collect the minimum needed to run the Service: the email from your Google sign-in, your practice activity and progress, and a few app preferences. Most practice content is prepared in advance; your placement answers and routine practice activity are not sent to a third-party AI provider. If you intentionally use an AI-assisted feature, we may send the topic or text you submit in that feature to Google Gemini for processing. We do not sell your data. You can delete your account at any time.
1. Who we are
“We” / “KaosLab” refers to KaosLab, the operator of the Service. Contact: abc.with.kevin@gmail.com.
2. What we collect
Account data: your email address and basic profile from Google Sign-In. If you take the initial placement assessment as a guest, you have an anonymous identifier and no email until you link a Google account; guest access is limited to the placement flow. Used to authenticate you and to send account and service emails.
Practice activity and progress: the items you attempt, your answers, scores, estimated level and readiness, and spaced-repetition (review) state, plus aggregate counts such as how many items you have studied. Stored linked to your account.
Text you intentionally submit: a topic or text entered when you choose to use an AI-assisted feature. It is used only to perform the feature you requested; do not submit sensitive personal data.
Preferences: theme (light/dark) and minor interface
choices, stored in your browser under keys beginning with
kl (for example kl-theme). These stay on your
device.
Diagnostic / error data: if the app hits an error, we may record a crash report (the error type and message and basic context) to fix bugs. We do not use autocapture, page-view tracking, session recording, or keystroke logging.
Payment data (Pro users only): handled by Lemon Squeezy, our payment provider and Merchant of Record. We never see or store your card details. We receive an order/customer reference and your plan status.
3. How we use it
- To provide and operate the Service (serve practice, score your work, track progress, schedule review).
- To process an AI-assisted feature you intentionally choose to use.
- To process payments and manage your Pro pass (Pro tier only).
- To send account and service emails.
- To diagnose errors, prevent abuse, and keep the Service secure.
We do not sell, rent, or otherwise transfer your personal data to third parties for marketing, and we do not use it for third-party advertising. We do not currently run product or behavioural analytics tracking; if we introduce it, we will describe it here and, where required, make it opt-in.
4. Third-party sub-processors
The following services process your data on our behalf. Each is contractually bound to use it only for the purposes listed.
- Supabase — authentication and Postgres database. Stores your email, account metadata, and progress.
- Google — Sign-In. When you sign in, we receive your email address and basic profile from Google.
- Lemon Squeezy (Pro users) — payment processing as Merchant of Record. Card details are entered into Lemon Squeezy directly; we never receive them.
- Railway — hosts our backend API. Processes requests and may handle IP addresses as part of normal routing.
- Vercel and Cloudflare — website hosting, DNS, and CDN. May process IP addresses as part of normal traffic routing.
- Google Gemini — processes the topic or text you submit when you intentionally use an AI-assisted feature. It does not receive your placement answers or routine practice activity.
- PostHog — feature-flag configuration and best-effort error/crash telemetry only. Not used for product analytics or session recording; with no key configured, no events are sent.
- Email delivery (Supabase or our email provider) — account and service emails.
5. Cookies and local storage
We use a cookie to keep you signed in and your browser’s localStorage for functional preferences such as your theme. These are necessary for the Service to work. We do not set advertising cookies or product-analytics tracking cookies, and there is no third-party ad tracking.
6. Your rights
You have the right to:
- Access a copy of your personal data (email us; we will respond within 30 days).
- Correct inaccurate data (email us).
- Delete your account and all associated data through the app settings, or email us and we will process the request within 30 days.
- Object to or restrict certain processing.
Because we do not currently run product-analytics tracking, there is no analytics profile to opt out of; if we add such tracking, we will provide a way to opt out. To exercise any of these rights, email abc.with.kevin@gmail.com.
7. Data retention
We keep your account data and progress while your account is active. When you ask us to delete your account, we remove your data from our production database within 30 days. Backups are managed by our infrastructure providers (such as Supabase and Railway) and cycle out on their normal rotation schedules, so residual copies are overwritten in due course.
Some operational logs (for example system usage and cost records) are de-identified — your account link is removed — rather than deleted, and may be retained for reliability and accounting. Records our payment provider must keep for tax purposes are retained by Lemon Squeezy for the legally required period.
8. International transfers
Several of our sub-processors (Google, Google Gemini, Lemon Squeezy, PostHog, Vercel, Railway, Cloudflare) operate servers outside Taiwan, including in the United States and Europe. Your data may be processed in these locations as part of normal Service operations. We rely on the standard contractual clauses or equivalent legal mechanisms each provider uses for international transfers.
9. Children’s privacy
KaosLab is not intended for users under 13. We do not knowingly collect data from children under 13. If you believe a child has provided personal data to us, please email us so we can delete it.
10. Security
We use industry-standard measures to protect your data: TLS in transit, encrypted-at-rest databases, no shared admin credentials, and least-privilege access. No system is perfectly secure; if a breach occurs affecting your data, we will notify you within 72 hours of becoming aware.
11. Changes to this policy
We may update this Policy. Material changes will be announced by email at least 14 days before they take effect.
12. Contact
For any privacy questions or requests, email abc.with.kevin@gmail.com.