Privacy policy

What we collect

Only what the product needs to work for you.

• Account: email, name, hashed password (bcrypt), when you signed up.
• Learning progress: which lessons you've completed, XP, streak, placement level, game scores, grapheme misses (the phonics patterns you struggle with, so we can bring them back).
• Preferences: your chosen text-to-speech voice, whether autoplay is on, your practice-reminder time.
• Read-aloud attempts: we store the accuracy score and the passage you were reading, so you can see your trend over time. We do not store the raw audio.
• Referral: if a friend invited you, we remember their code so they can be credited.
• Anonymous click events: which buttons get tapped (e.g. "landing → register") so we can improve the product. No IP addresses, no fingerprinting.

Who else touches your data

A small, deliberate list. Each one only sees the piece it needs.

• OpenAI (TTS + Whisper): when you tap a Listen button or record a read-aloud, we send that specific text or audio to OpenAI. Audio is transcribed and discarded on both ends.
• Anthropic (Claude): your messages to the AI tutor are sent to Anthropic to generate a reply. Nothing else about you is shared.
• SendGrid: transactional email — password resets and your weekly progress recap. Your email address only.
• Stripe: only used if you separately purchase one-on-one tutoring. The app itself is free.
• MongoDB Atlas / hosting: stores the account data described above, in a database only our servers can read.

Cookies and sessions

We use exactly one cookie: rw_token, which keeps you signed in. It's httpOnly and Secure, so no browser script (ours or anyone else's) can read it. No advertising cookies. No tracking pixels.

Children

Lift Up Reading is designed for adult learners. We do not knowingly collect information from anyone under 13. If you believe we have, email privacy@liftupreading.com and we'll delete it.

Your rights

You can, at any time and for any reason:

• See what we have on you.
• Correct anything that's wrong.
• Delete your account and everything tied to it.
• Ask for a portable copy of your data (JSON export).
• Turn off the weekly recap email or the daily practice reminder from your Profile page.

Email privacy@liftupreading.com and we'll act on it within 30 days.

How we keep it safe

• Passwords are hashed with bcrypt — we can never see the plaintext.
• The whole site runs over HTTPS.
• Your session is carried in an httpOnly cookie so it can't be stolen by a browser script.
• Only our own servers can read the database. No public exports.

Changes to this policy

If we ever change what we collect or who we share it with, we'll update the "last updated" date at the top and email everyone with an account before the change takes effect.