Privacy Policy

Information we process

Account information

We process your email address, Supabase user identifier, authentication provider, and basic profile fields. If you choose Google, this may include your Google account identifier, verified email, display name, and profile image. We never receive your Google password.

We do not request or access Gmail, Google Drive, Contacts, Calendar, or other Google content.

Learning information

We process question identifiers, submitted answers, skips, hint use, timestamps, mastery scores, missed-question queues, and practice history to provide feedback, adaptive practice, and synchronized progress.

Browser and operational information

The site uses essential authentication cookies and an account-scoped browser cache for progress and pending synchronization events. Hosting, authentication, security, and email systems may also process request, device, network, security, delivery, bounce, and diagnostic metadata.

Why we use information

• Authenticate users and maintain account security.
• Save, synchronize, and restore learning progress.
• Provide adaptive practice, hints, solutions, and mastery feedback.
• Send confirmation, recovery, and other transactional account email.
• Prevent abuse and troubleshoot service problems.

We do not sell or rent personal information, use it for targeted advertising, or send unrelated marketing email.

Service providers

• Supabase provides authentication and the account database.
• Vercel hosts the application and operational logs.
• Resend delivers transactional account email.
• Google provides optional account authentication.
• Cloudflare Turnstile, when enabled, helps prevent automated account abuse and may process network, device, and security signals for that purpose.

Retention and deletion

Account and learning data are generally retained while the account exists. Provider security, delivery, and backup records may follow each provider's retention schedule. Limited records may be retained when reasonably necessary for security, legal compliance, or backup integrity.

See Account deletionto request permanent deletion. Browser-local copies can be removed through the account menu or your browser's site-data settings.

Your choices

Email/password authentication is available instead of Google. You may revoke Google access in your Google Account's third-party connection settings. Revoking Google does not itself delete the Mastery Lab account.

Security, age, and changes

We use access controls, row-level database security, encrypted network connections, and limited-purpose service providers. No online service can guarantee absolute security. This service is not directed to children under 13. Material policy changes will be posted here with a new effective date.

Google API data

Use of information received from Google APIs complies with the Google API Services User Data Policy, including its Limited Use requirements.

Contact

Use the developer contact address displayed on the Google consent screen. A monitored public support address is being added to this page.