This Privacy Policy describes how Coursify ("we", "us", "our") collects, uses, and protects the personal information of people who use our Service. We aim to be transparent about exactly what we collect and why.
1. What we collect
Account data
- Email + name — provided by you at signup or by your identity provider (Google, GitHub).
- Profile fields — optional bio, avatar URL, full name.
- Authentication metadata — hashed password (for email/password sign-ins), session tokens, OAuth tokens (for social sign-ins).
Usage data
- Courses you generate — the YouTube URLs you submit, the AI-generated lesson notes, quizzes, and assessments tied to your account.
- Learning progress — which lessons you've completed, quiz attempts, scores, certificates earned.
- Credit transactions — purchases, deductions, refunds.
Payment data
- Polar (our payment provider) collects card details directly — we never see or store them. We receive only the order ID, the amount, and which product was purchased.
Technical data
- IP address, browser type, device type, basic request logs — used for security, debugging, and abuse prevention. We do not currently run third-party analytics or advertising trackers.
2. How we use it
- To operate the Service — sign you in, generate your courses, track your progress, issue your certificates.
- To process payments, send receipts, and prevent fraud.
- To send transactional emails (verification, password reset, course-ready notifications, receipts).
- To communicate important account or service updates.
- To improve the Service — anonymized aggregated patterns may inform product decisions.
We do not sell your data. We do not share it with advertisers or data brokers.
3. Sub-processors
We rely on these third parties to deliver the Service:
- Neon — database hosting
- Vercel — application hosting
- Inngest — background-job processing (course generation pipeline)
- Polar — payment processing
- Hostinger — SMTP for transactional email
- Google (YouTube Data API) — video metadata lookup
- Zhipu AI (GLM) — AI generation of lesson content + assessments
- AssemblyAI — fallback transcription provider (only when the YouTube transcript is unavailable)
Each sub-processor receives only the data necessary for its specific function. Course content sent to AI providers contains the video transcript and the lesson structure; we do not send personal account data alongside it.
4. Data retention
- Account data — retained while your account is active. Deleted within 30 days of account deletion, except where retention is required by law (e.g. payment records for tax purposes, retained 7 years).
- Courses you've generated — retained while your account is active; deleted with your account.
- Email logs — retained 90 days for deliverability debugging.
- Backups — included in encrypted daily database backups; backups roll off after 30 days.
5. Your rights
Depending on your jurisdiction, you may have the right to:
- Access the personal data we hold about you
- Request correction of inaccurate data
- Request deletion of your account and associated data
- Export your data (courses, attempts, certificates) in a machine-readable format
- Withdraw consent for transactional email (note: doing so may break the Service — receipts, password reset, etc.)
- Lodge a complaint with your local data protection authority
To exercise any of these rights, email hello@coursified.app. We aim to respond within 30 days.
6. Security
We use industry-standard encryption in transit (HTTPS / TLS 1.3) and at rest (AES-256 managed by our hosting providers). Passwords are hashed with bcrypt. Webhook payloads are signature-verified. Session tokens are HTTP-only cookies. We do not have access to your plaintext password or your payment card details.
7. Children's data
Coursify is not directed at children under 13. We do not knowingly collect data from children under 13. If you believe a child has provided us with personal data, please contact us immediately and we'll delete it.
8. Changes
We may update this Privacy Policy as the Service evolves. Material changes will be announced by email. The "Effective" date above always reflects the current version.
9. Contact
Privacy questions or data requests: hello@coursified.app.