← Everlearn · Tiếng Việt · Terms of use
Privacy policy
1. Who manages the data
Everlearn is a free, ad-free community project that never sells data. The data controller and processor is the individual Van Le. Contact: [email protected].
2. Data we collect
- Adults (parents, teachers, self-learners aged 18+): email, display name, password (hashed only), birth year for self-learners, language, notification settings.
- Children (under 18, created and managed by a parent): username, PIN (hashed), display name (a nickname is recommended), grade, textbook series, birth year if the parent enters it. Children have no email.
- Learning data: attempts, answers, scores, streaks, badges, stars, review cards, learning paths, reported questions.
- Technical data: last sign-in, security log, anonymous UI error reports. The session is kept in browser storage; no advertising cookies or third-party trackers.
We do not collect photos, location, phone numbers, ID numbers or biometrics.
3. Purposes
Practice and grading, review suggestions, letting parents (and teachers of classes the parent joined) see results, necessary emails, security and abuse prevention. Never advertising or resale.
4. Legal basis: consent
Adults consent when signing up and when this policy changes. For children under 18, a parent or guardian consents on the child's behalf; children aged 7+ see a plain-language explanation on first use. Withdraw consent at any time by deleting the account.
5. Where data is stored and processed
Data is stored and processed outside Vietnam by: Vultr (USA; server and database in Singapore; backups made before each software update are kept on the same server), Cloudflare R2 (backup storage, encrypted in transit and at rest; continuous backups kept up to 7 days; daily backups additionally encrypted before leaving the server, kept 30 days), Cloudflare (traffic relay and protection, encrypted), Resend (USA, email delivery – email address and message only), Anthropic (USA, only when the AI question generator is enabled – the generation request only, no names, emails or children's answers). We keep a cross-border transfer impact assessment as required.
6. Who can see the data
Parents see their own children's data; teachers only see students whose parents joined their class; friends see a display name and score only when you share. The operator accesses data only to fix problems, review reported content, or when required by authorities.
7. Retention
- Active accounts: kept while in use.
- No sign-in for 1 year: 30 days' notice by email (if any), then deleted with learning data.
- Account deletion: removed from the database immediately; backups expire within 30 days.
- Security log: 1 year.
8. Your rights
To be informed, consent, access, correct, delete, withdraw consent, restrict, object and complain. In the app: edit names on the Profile page, delete a child's account in the Family tab, delete your own account on the Profile page. Other requests: [email protected].
9. Security and incidents
HTTPS, hashed passwords, sign-in rate limits, two-step verification for staff, regular backups. Data breaches are reported to the authorities and affected people as required.
10. Changes
Material changes get a new version number at the top and adults are asked to consent again on sign-in.