Privacy policy

This policy explains what data Freedu processes, why, and what your rights are. You can use Freedu without an account, and then we do not process your data to identify or profile you.

1. Data controller

The controller of personal data is the Freedu service. Privacy contact: freedu559@gmail.com.

2. What data we process

• Without an account: the servers running Freedu keep technical logs (such as IP address, date and the page visited) for security. Progress, saved materials and your chosen level are stored only in your browser (localStorage) and never reach us.
• With an account: email address, password (as a secure hash), display name, preferences (language, level), exercise and course progress, saved materials, exercise lists, recently viewed history, uploaded notes and their files, and reports you send.
• Sign-in with Google: we receive your email address and Google account ID. We never publish your real name. Only the display name you choose is shown next to your notes.

We do not ask for your real name, school or date of birth.

3. Purposes and legal bases

• running your account and providing the service: Art. 6(1)(b) GDPR (performance of the terms of use);
• content moderation, security and abuse prevention: Art. 6(1)(f) GDPR (legitimate interest);
• handling infringement notices and legal obligations: Art. 6(1)(c) GDPR.

4. Processors

We use processors acting on our behalf: Supabase (database, sign-in, file storage), Vercel (website hosting) and an email provider that sends account emails. If you sign in with Google, Google provides us with your data. Where data is processed outside the European Economic Area, this is based on Standard Contractual Clauses approved by the European Commission.

5. Retention

We keep account data until the account is deleted. You can delete your account yourself in the settings. We then delete your profile, progress, lists, saved materials and uploaded notes with their files. Technical logs are kept for the period set by our infrastructure providers.

6. Your rights

You have the right to access, rectify and erase your data, to restrict processing, to data portability (you can download your data as JSON in the account settings) and to object. You may also lodge a complaint with the Polish data protection authority (Prezes Urzędu Ochrony Danych Osobowych).

7. Children

Accounts may be created by people aged 16 or over, or younger with a parent’s or guardian’s permission. Browsing and downloading materials needs no account.

8. Cookies and browser storage

We only use essential cookies: the sign-in session (cookies starting with “sb-”), the chosen language (NEXT_LOCALE) and the chosen learning level (freedu_mode). We use no advertising and no tracking analytics. YouTube or Vimeo videos load only after you press play.

9. Community notes

Uploaded notes become public after moderation and are signed with your display name. Please do not include personal data, neither yours nor anyone else’s. We automatically remove metadata such as GPS location from uploaded photos (JPG, PNG).