Privacy Policy

This Privacy Policy explains how Almora Technology, LLC collects, uses, discloses, and protects personal information when you use LearnStack. It also describes the choices and privacy rights available to you.

1. Scope and controller

This Policy applies to LearnStack's website, accounts, courses, articles, prompts, tools, assessments, email, billing, and community features, including The Hangout and direct messages. It does not govern third-party websites, services, or tools that have their own privacy policies.

Almora Technology, LLC is the controller or business responsible for the personal information described here:

Almora Technology, LLC, 9896 Bissonnet St, Ste 415, Houston, TX 77036, United States; support@learnstackos.com

2. Personal information we collect

The information we collect depends on how you use LearnStack.

Account and identity information. Email address, display name, generated pseudonym, account identifier, authentication records, and account status. Supabase Auth handles passwords and authentication credentials; LearnStack does not receive your plaintext password.

Profile and preferences. Optional real name, biography, avatar, public contact email, timezone, interests, self-described role, motivation, skill ratings, display settings, theme and dock preferences, onboarding state, email preferences, leaderboard choice, and public-profile choices. Your pseudonym is public by default; other profile fields are displayed only as the Service and your settings indicate.

Learning and saved-content data. Course and lesson progress, completion state, notes, bookmarks, starred articles, saved prompts and templates, user-entered template values, learning events, activity streaks, experience points, missions, badges, diagnostic answers and results, attempt history, certification status, and other accomplishments. Some accomplishments or results can be displayed publicly only when you choose a corresponding public setting.

Community information. Posts, replies, article comments, reactions, mentions, images and files you share, room membership, direct messages, blocks, reports, report snapshots, moderation actions, appeals, and related safety and audit records. Public and group content is visible to the audience identified by the feature. Ordinary direct messages are visible to their participants; when a participant reports a conversation, the complete conversation snapshot is disclosed to authorized admins and moderators.

Billing and subscription information. If purchasing is available and you subscribe, Stripe collects and stores the billing address and U.S. service address entered in Checkout to confirm launch eligibility and calculate applicable tax; nothing is shipped. We receive identifiers and status information needed to manage access and support, such as your Stripe customer identifier, plan or price reference, subscription status, billing period, cancellation status, address or tax results returned by Stripe, and payment- event records. Stripe processes payment-card and payment-method details. LearnStack does not store full payment-card numbers or card security codes.

Email and invitation information. Email addresses and records associated with account messages, optional article digests, waitlists, launch or topic notifications, unsubscribe choices, and invitations. If you invite someone, you must have permission to provide their email address. We use it to deliver and administer the invitation, not to add the person to unrelated marketing.

Device, network, and service-use information. IP address, request date and time, browser and device information, pages or endpoints requested, referring URL, cookie or session identifiers, and security, diagnostic, and error logs. LearnStack and its hosting providers process this information to deliver and secure the Service, prevent abuse, rate-limit requests, and troubleshoot failures. We do not use third-party advertising trackers or behavioral advertising analytics.

Information sent to service providers. If you enter an optional role description during onboarding, that text may be sent through OpenRouter to an AI model provider to assign a broad learning-role category. Do not include confidential or sensitive personal information. Video playback and other embedded third-party content may disclose ordinary device and network information, such as your IP address and browser headers, to the provider when loaded.

Communications. Information you include when you contact support, submit a privacy or copyright request, appeal moderation, or otherwise communicate with us.

3. Sources of personal information

We collect personal information:

• directly from you when you register, submit content, change settings, purchase, subscribe to email, or contact us;
• automatically from your browser or device when you use the Service;
• from other users when they invite, mention, message, or report content involving you;
• from service providers, such as authentication, hosting, payment, email, AI, and media providers; and
• from administrators or moderators when they manage access, support, safety, or enforcement.

We do not purchase personal-information lists from data brokers.

4. How we use personal information

We use personal information to:

• create and secure accounts, authenticate users, and provide requested features;
• synchronize learning progress and personalize the learning path;
• store user choices, notes, bookmarks, saved prompts, and accomplishments;
• operate community features, deliver messages and notifications, and display information to the audience you select;
• process purchases, maintain subscription access, prevent payment fraud, and keep required transaction records;
• send transactional account, security, purchase, and service messages;
• send an optional digest, waitlist update, or other promotional email when permitted, and honor unsubscribe choices;
• provide support and respond to rights requests, complaints, and disputes;
• detect, investigate, and prevent abuse, fraud, security incidents, and violations of our Terms or Community Guidelines;
• moderate content, review reports and appeals, and protect users and the public;
• debug, maintain, measure, and improve the reliability and usability of the Service; and
• comply with law and enforce our agreements.

We do not use personal information to make decisions that produce legal or similarly significant effects about employment, credit, housing, insurance, education admission, health care, or access to essential services.

5. Lawful bases for EEA, UK, and similar jurisdictions

Where a law requires a lawful basis, we rely on:

• Contract: to create and administer your account, provide requested learning and community features, process a subscription, and deliver transactional communications.
• Legitimate interests: to secure and improve the Service, prevent fraud and abuse, provide support, keep appropriate business records, understand aggregate service operation, and moderate the community. We consider the impact on your rights before relying on this basis.
• Consent: for optional digest or promotional email where consent is required, optional public display settings, and other processing presented as optional consent. You may withdraw consent at any time without affecting earlier lawful processing.
• Legal obligation: to comply with tax, accounting, consumer-protection, law-enforcement, court, and other legal requirements.
• Protection of vital interests: in a rare emergency involving a person's safety.

If we ask for information needed to create an account, provide a requested feature, or complete a purchase, failing to provide it may prevent us from providing that part of the Service. Optional fields may be left blank.

6. When we disclose personal information

We disclose personal information only as described here:

Service providers. Vendors process information for us under contracts and instructions appropriate to their role. Current categories include:

• Supabase for authentication, database, and file storage;
• Vercel for website hosting, delivery, and operational logs;
• Stripe for checkout, payment processing, and subscription management;
• Emailit for account, invitation, waitlist, and optional digest email;
• OpenRouter and the model provider it routes to for optional onboarding role classification; and
• Gumlet for embedded video delivery.

Other users and the public. We disclose profile fields, accomplishments, community content, and activity to the audience indicated by the feature and your settings. Public information can be copied or indexed outside LearnStack. Direct messages are disclosed as described in Section 2, including through a participant-initiated report.

At your direction. We disclose information when you ask us to, authorize an integration, follow a link, or otherwise direct the disclosure.

Safety and legal reasons. We may preserve or disclose information when we reasonably believe it is necessary to comply with law or valid legal process; enforce our agreements; detect or prevent fraud, abuse, or security incidents; protect the rights, safety, and property of users, LearnStack, or others; or respond to an emergency.

Business transactions. Information may be disclosed in connection with a financing, merger, acquisition, reorganization, bankruptcy, or sale of all or part of the business. A recipient may use it only as permitted by this Policy unless it gives you legally required notice and choices.

We do not sell personal information for money. We do not share personal information for cross-context behavioral advertising, use it for targeted advertising, or profile users in furtherance of decisions that produce legal or similarly significant effects. Because we do not engage in those practices, there is currently no separate sale, sharing, or targeted-advertising opt-out. If those practices change, we will update this Policy and provide legally required controls before the change takes effect.

7. Cookies and local storage

LearnStack uses cookies and similar browser storage that are necessary or useful for the Service you request. These include authentication and security cookies, as well as local storage for theme, dock, window, onboarding, tour, and anonymous lesson-progress preferences.

We do not currently use advertising cookies, cross-site tracking pixels, or third-party analytics cookies. Because current browser storage is limited to authentication, security, requested functionality, and preferences, we do not display a consent banner. If we add non-essential cookies or similar tracking, we will provide notice and obtain consent where applicable law requires it.

You can clear cookies and local storage through your browser. Doing so may sign you out, reset preferences, or erase progress stored only on that device.

Global Privacy Control and Do Not Track signals do not change current behavior because LearnStack does not sell, share for cross-context behavioral advertising, or use personal information for targeted advertising. We will honor legally required browser-based opt-out signals if our practices change.

8. Email and communication choices

Account confirmations, password resets, security alerts, receipts, billing notices, and important Service or legal notices are transactional. You may not be able to opt out of them while maintaining an account or active subscription.

The article digest is opt-in and off by default. Marketing and digest email includes an unsubscribe method, and we honor valid opt-out requests as required by law. You can also change available email settings or contact support@learnstackos.com. Opting out of marketing does not stop transactional messages. We may retain a minimal suppression record so we do not resubscribe you accidentally.

Waitlist and notification signups are used for the subject described when you sign up. Invitation recipients may ask us to remove their address. Commercial email identifies Almora Technology, LLC and includes our valid postal address and required opt-out information.

9. Data retention

We keep personal information only as long as reasonably necessary for the purposes described here, including to provide the Service, maintain security, resolve disputes, enforce agreements, and satisfy legal, tax, accounting, and reporting obligations. Retention depends on the information and context:

• account, profile, learning, and saved-content data is generally kept while your account is active and then deleted or de-identified after a valid deletion request, subject to the exceptions below;
• community content remains until you delete it, the account is deleted, or we remove it, but content-free markers may remain to preserve conversation structure;
• direct-message report snapshots, moderation records, security logs, and audit records may be retained longer when reasonably necessary for safety, enforcement, fraud prevention, legal obligations, or disputes;
• subscription, payment-event, tax, and transaction records are retained for the period required by financial and legal obligations;
• optional email addresses are kept until the relevant list ends, you opt out, or continued retention is no longer necessary; and
• technical logs are retained for a limited period appropriate to security, troubleshooting, and hosting operations.

Deletion from active systems may not immediately remove encrypted backup copies. Backups are isolated, expire on a schedule, and are not restored except for recovery, security, or legal needs. We may retain information when law requires it and may retain de-identified information that can no longer reasonably identify you.

10. Security

We use reasonable administrative, technical, and organizational safeguards designed to protect personal information, including access controls, authentication, encrypted transmission, restricted administrative access, and database row-level security. No online service can guarantee absolute security. You are responsible for using a unique password, protecting your account, and notifying us promptly of suspected unauthorized access.

11. International data transfers

LearnStack is operated from the United States. If you use the Service from another country, your information is transferred to and processed in the United States and in other locations where our providers operate. Those countries may have different data-protection laws.

Where European data-transfer law applies, we use a lawful transfer mechanism appropriate to the transfer, such as an adequacy decision, the EU-U.S. Data Privacy Framework where a recipient validly participates, or approved standard contractual clauses with supplementary measures as appropriate. You may contact us for information about the mechanism relevant to your data.

12. Your privacy rights

Depending on where you live and subject to legal exceptions, you may have the right to:

• know whether we process your personal information and access or obtain a copy of it;
• correct inaccurate information;
• delete information;
• obtain portable information you provided in a structured format;
• restrict or object to certain processing;
• withdraw consent at any time;
• opt out of sale, targeted advertising, or qualifying profiling;
• limit certain uses of sensitive personal information; and
• receive equal service and not be discriminated or retaliated against for exercising a privacy right.

To exercise a right, email support@learnstackos.com and identify the request. We may verify your identity or authority using information associated with your account. We will use verification information only for the request. If we cannot verify a request, we may ask for additional information or deny it as the law permits.

You may use an authorized agent where applicable law allows. We may require proof of the agent's authority and may ask you to verify your identity directly. If we deny a request, you may appeal by replying with "Privacy Appeal" and an explanation. We will respond within the timeframe required by applicable law.

For California residents, the categories collected in the preceding 12 months are the categories described in Section 2: identifiers and account data; customer and commercial records; internet or electronic activity; profile, learning, community, visual, and user-generated information; and inferences such as learning-role categories. We collect, use, retain, and disclose those categories for the purposes and to the recipient categories in Sections 4, 6, and 9. We do not sell or share them as those terms are defined by the California Consumer Privacy Act.

Residents of the EEA or UK may also lodge a complaint with the data-protection authority where they live, work, or believe a violation occurred. We encourage you to contact us first so we can try to resolve the concern. You have the right to object at any time to processing for direct marketing. LearnStack does not make solely automated decisions that produce legal or similarly significant effects about you.

13. Sensitive information

LearnStack is not designed to collect government identifiers, financial-account credentials, precise geolocation, health records, biometric identifiers, or other highly sensitive or regulated information. Do not place such information, another person's personal data, confidential business information, or secrets in community content, notes, prompts, templates, messages, role descriptions, or support requests unless the feature expressly requests it and you are authorized to provide it.

Account credentials and payment information are handled by specialized providers as described above. We do not use sensitive personal information to infer characteristics about you or for purposes unrelated to providing and securing the Service.

14. Children

LearnStack is intended only for adults age 18 or older. We do not knowingly collect personal information from children under 18. If you believe a child has provided personal information, contact support@learnstackos.com so we can investigate and delete it as appropriate.

15. Changes to this Policy

We may update this Policy as the Service, vendors, or law changes. We will post the revised Policy with a new effective date. If a change materially affects your privacy rights or how we use personal information, we will provide additional notice or obtain consent when applicable law requires it.

16. Contact and complaints

Questions, complaints, and privacy requests may be sent to:

Almora Technology, LLC, 9896 Bissonnet St, Ste 415, Houston, TX 77036, United States; support@learnstackos.com