Privacy Policy
Effective date: October 1, 2026 Version: 1.0
Who we are
StemForge (stemforge.app) is run by Adam Świerkosz, Aleja Niepodległości 37/42, 02-653 Warszawa, Poland. We are the controller of the personal data described here. Contact: aswierkosz88@gmail.com.
What we collect
- Account data — when you sign in with Google or Discord: your name, email address, profile picture and the account identifier that provider gives us.
- Your content — courses you create or copy, lessons, quiz answers and scores, notes, scratchpad drawings and AI tutor chat messages.
- Usage data — the days on which you open a course, and how you first reached StemForge (the link tag, such as
ref=centrehold, and the referring website) when you sign up. - Payment data — when you buy credits: the amount, currency, status and Stripe reference of each payment. Card details go to Stripe and never reach us.
- API keys — if you choose to store your own AI provider keys, we keep them encrypted.
- Technical data — IP addresses, used for rate limiting and abuse prevention; server and application logs, which can contain IP addresses and account identifiers; anonymous page-view statistics (Vercel Web Analytics, which uses no cookies).
Why we use it
| Purpose | Legal basis (GDPR) | |---|---| | Running your account and generating, storing and showing your courses | Performance of our contract with you (Art. 6(1)(b)) | | Processing payments and keeping accounting records | Legal obligation (Art. 6(1)(c)) | | Preventing abuse, including limiting free credits to one claim per person | Legitimate interest in protecting the service (Art. 6(1)(f)) | | Understanding which channels bring learners and whether they keep learning | Legitimate interest in improving the service (Art. 6(1)(f)) |
AI processing
To generate courses, quizzes and tutor answers, we send the relevant text (your topic and preferences, lesson content, your questions) to an AI provider: Anthropic, OpenAI or Google, depending on the model used. If you use your own API key, the request goes to that provider under your own account and its terms.
Who processes data for us
- Vercel — hosting and page-view statistics
- Turso — database
- Upstash — rate-limit counters
- Stripe — payments
- Anthropic, OpenAI, Google — AI generation
- Google, Discord — sign-in
Some of these providers are in the United States. Transfers rely on the EU–US Data Privacy Framework where the provider is certified, and otherwise on the European Commission's Standard Contractual Clauses.
How long we keep it
- Account data and your content: until you delete your account.
- Payment records: as long as tax and accounting law requires (in Poland, generally five years after the end of the year of payment). After you delete your account they are kept without a link to you.
- AI generation logs: prompts and outputs stored for troubleshooting expire automatically; the remaining technical records (model, duration, token counts) are kept without your user ID after you delete your account.
- Rate-limit counters: up to 24 hours.
- Application logs: up to 30 days. They can contain IP addresses and account identifiers, including for up to 30 days after you delete your account.
Your rights
You can access, correct, export or delete your data, object to processing based on legitimate interest, and ask us to restrict processing. On the Settings page you can download your data ("Download my data") and delete your account ("Delete my account"). For anything else, contact us at the address above. You also have the right to lodge a complaint with a supervisory authority; in Poland that is the President of the Personal Data Protection Office (UODO).
Cookies and local storage
We use a sign-in cookie to keep you logged in. Your browser's local storage holds your preferences (language, theme, model choice), cached course copies for offline use, and the link tag you arrived with until you sign up. We use no advertising or third-party tracking cookies.
Changes
If we change this policy in a way that matters, we will tell you in the app before the change takes effect.