Privacy Policy

When you create an account we collect your email address, a password (stored only as a hash), an optional display name, a generated username, and your birth year (used once to confirm you meet our minimum age, and retained so we can apply age-appropriate settings). As you learn, we store your learning activity (placement results, quiz answers, progress, and review schedules) because the product is a map of what you know.

During public beta, Consiliae is for learners aged 16 and over. We do not knowingly collect personal information from anyone under 16, and account creation asks your date of birth to enforce this. This minimum also meets or exceeds every national age of digital consent in the EU (for example 16 in Germany and the Netherlands, 15 in France, 14 in Austria and Spain).

We default all accounts to high-privacy settings: analytics run only with consent, and we never sell personal data or show third-party advertising. Email notifications about your learning are on by default and you can turn any of them off at any time in your account settings, or from the unsubscribe link in any email. If you believe someone under 16 has created an account, email hello@consiliae.com and we will delete it.

We use a small set of service providers, each for one job:

• Resend: Transactional and notification email delivery. Data involved: Email address, message content.
• Mixpanel: Product analytics (only with your consent). Data involved: Usage events, pseudonymous ID.
• Google Analytics: Site analytics (only with your consent). Data involved: Page views, device info.
• Sentry: Error monitoring so we can fix crashes. Data involved: Error context; no session recording during normal use.
• Meta: Facebook/Instagram ad measurement (only with your consent). Data involved: Pseudonymous ID, page views, signup event.
• Reddit: Reddit ad measurement (only with your consent). Data involved: Pseudonymous ID, page views, signup event, plus your email address and account ID once you have an account, so Reddit can match your signup to an ad you saw.
• TikTok: TikTok ad measurement (only with your consent). Data involved: Pseudonymous ID, page views, signup event.
• Stripe: Payment processing for subscriptions. Data involved: Payment details (we never see full card numbers).
• Vercel: Web hosting. Data involved: Standard server logs.
• Google Cloud Provider: Backend hosting and database. Data involved: Account and learning data at rest.

Essential cookies keep the product working and need no consent. What happens to the rest depends on where you are. In the UK, the EU and the wider EEA (and Switzerland) nothing analytics- or marketing-related runs until you choose in the cookie banner. Elsewhere, where the law works on an opt-out basis, they are on by default and you can turn them off at any time. Either way the control is the same: “Cookie settings” in the footer, and a choice you have already made is always respected.

• cln_session, authjs.* (Essential): Keeping you signed in securely. Lifetime: Session / 30 days.
• cln_signup_intent (Essential): Completing signup after onboarding. Lifetime: 30 minutes.
• cln_consent (Essential): Remembering your cookie choices. Lifetime: 12 months.
• cln_geo (Essential): Your country, so we know which consent rules apply to you. Lifetime: 6 months.
• _ga, _gid (Analytics (consent)): Google Analytics usage measurement. Lifetime: Up to 24 months.
• mp_* (browser storage) (Analytics (consent)): Mixpanel product analytics. Lifetime: Until cleared.
• cln_affiliate_ref (Marketing (consent)): Crediting the person who referred you. Lifetime: 30 days.
• cln_hero_bucket (Marketing (consent)): Consistent homepage variant testing. Lifetime: 90 days.
• _fbp, _fbc (Marketing (consent)): Meta (Facebook/Instagram) ad measurement. Lifetime: Up to 90 days.
• _rdt_uuid (Marketing (consent)): Reddit ad measurement. Lifetime: Up to 90 days.
• _ttp (Marketing (consent)): TikTok ad measurement. Lifetime: Up to 13 months.

We process account and learning data because it is necessary to provide the service you signed up for (performance of a contract). Error monitoring runs under legitimate interest in keeping the product working. Analytics and marketing cookies run on your consent where consent is the legal basis (the UK, EU, EEA and Switzerland); in opt-out jurisdictions they run until you tell us to stop.

We keep your data while your account exists. You can request a copy of your data or ask us to delete your account and its data by emailing hello@consiliae.com. We answer within 30 days.

Questions about this policy: hello@consiliae.com.