Privacy Policy

Plain language, no dark patterns. Here is exactly what we collect, why, and how to get rid of it.

Last updated

12 June 2026

This policy covers porphy.app and the Porphy apps. It explains what data we hold, the legal basis for holding it, and the controls available to you. It applies to everyone, not just users in regions that require it.

01What we collect

We collect the minimum needed to build your courses and keep your account working. Concretely:

Account data — name, email, and a hashed password (or your identity-provider ID if you sign in with Google).
Learning data — the topics you ask for, the courses generated for you, quiz answers, flashcard results and mastery scores.
Tutor sessions — transcripts of what you and the tutor said, and whiteboard strokes, so a session can be resumed.
Technical data — device type, browser, IP address and error logs, used for security and debugging.
Billing data — handled by our payment processor. We never see or store your full card number.

02How we use it

Your data is used to deliver and improve the product you are paying for — nothing else:

Generating, personalising and scoping your courses.
Scheduling flashcard reviews and computing your knowledge graph.
Preventing abuse, fraud and automated scraping.
Sending transactional email (receipts, password resets, security alerts). Marketing email is opt-in only.

We do not sell your personal data, and we do not share it with advertisers.

03AI and your content

Porphy sends your topic prompts and lesson context to third-party model providers in order to generate courses and run the live tutor. Those providers process the content to return a response.

Your private learning content is not used to train our models or theirs unless you explicitly opt in from Settings → Privacy. Aggregate, de-identified statistics (for example, “how often quizzes are retried”) may be used to improve the product.

04Cookies

We use three kinds of cookie, and you can refuse two of them:

Essential — session and authentication. Required; the app cannot work without them.
Preference — remembers language, theme and last open course.
Analytics — privacy-preserving, aggregated usage counts. Off by default in the EU and UK.

05How long we keep it

Learning data is retained while your account is active. If you delete your account, courses, tutor transcripts and graph data are purged within 30 days, except where we are legally required to keep billing records (typically 7 years, and limited to invoice data).

Backups roll off on a 35-day cycle.

06Your rights

Wherever you live, you can exercise the following from Settings → Privacy, or by emailing us:

Export everything we hold about you, in JSON.
Correct anything inaccurate.
Delete your account and its data.
Object to analytics processing, or withdraw consent.

Requests are actioned within 30 days. If you are unhappy with our response, you may complain to your local data protection authority.

07Children

Porphy is not intended for children under 13. If you believe a child has created an account, contact us and we will remove it and its data.

08Contact

Questions about this policy, or a data request? Reach us at privacy@porphy.app or through the contact page. We answer privacy mail within one business day.