Legal

Privacy Policy

Effective July 29, 2026

This Privacy Policy explains how Hugh Nguyen (an individual), operator of Professor Lockin (“Professor Lockin,” “we,” “us”), collects, uses, and protects your information when you use our website and services (the “Service”). By using the Service you agree to this Policy and our Terms of Service.

1. Information we collect

Information you provide

• Account: your email address (for passwordless sign-in) and the username you choose (shown publicly on Explore).
• Profile settings: optional exam date, the guide you’re studying (or a custom “studying for” label you type in), whether you want reminder emails, and — if enabled — your preferred reminder send time.
• Content you create: the decks and flashcards you make (terms, definitions, and any image URLs you paste or select). If you publish a deck, its content and your username become publicly visible. Ratings you give a guide or deck are aggregated into a public average (your individual star rating is private — only you and admins can see it). Comments you post on a guide are public together with your username. If you become a guide writer, the bio you add in Account is shown publicly on your author page.
• Purchases: when you buy a guide or a Gold Star pack, our payment processor records the transaction. We store only a purchase record (a Stripe identifier and what you bought — for star packs, a currency-ledger entry). We never see or store your full card number. If a purchase is refunded or disputed, we record that outcome on the purchase (payment disputes may suspend purchasing on your account — see the Terms).
• Subscriptions (only if you subscribe to Pro or Dean’s List): we store your subscription tier, its status and renewal date, and a Stripe customer identifier so we can apply your benefits and let you manage or cancel your plan. Card details and billing are handled entirely by Stripe.
• AI features (only if you use them): the text you submit (typed notes, uploaded PDF, or tutor questions) is sent to Google’s Gemini API to generate the result and is subject to Google’s terms; under those terms your input is not used to train Google’s models. We do not store the content of your prompts — we store only a usage record (which AI feature you used, the credits it cost, and token counts) to enforce your monthly limits and monitor costs.
• Writer applications (only if you apply): the exam you passed, your score, an optional note, and the verification links or image URLs you submit as proof. Reviewed by our admins; retained with the application decision.
• Author payouts (only if you sell guides): payout onboarding happens directly with Stripe, which collects your identity (KYC), tax, and bank details under its own privacy policy — we never see or store those. We store only your Stripe account identifier, whether payouts are enabled, and a sales ledger for your guides (sale amounts, fees, your earnings, and whether a sale came from your referral link).
• Referral attribution (marketplace): visiting a guide through an author’s share link sets a small cookie (~30 days) so the author is credited if you buy that guide. It identifies the author, not you, and is not used for advertising or cross-site tracking.

Information collected automatically

• Usage & device data (analytics): if you consent, we collect pages viewed, clicks, and basic device/browser info to understand and improve the Service.
• Diagnostics: if the app errors, we collect technical details (error message, browser, route) to fix bugs.
• Network/security: your IP address is processed transiently to protect the Service (rate limiting, abuse prevention) and is not used to build a profile of you.
• Study progress & rewards (gamification): as you study we record XP events (a batched count of what you did — e.g. cards reviewed, tests finished — never the content of your answers), your level and rank points, daily/weekly totals, streak days, quest progress, in-app currency balances and their transaction history, the cosmetic items you own and equip, crate openings (including the odds used for the roll), and potion use. You can download all of it with “Download my data” and it is deleted with your account.
• Leaderboards: your username, avatar, rank and scores can appear on public leaderboards, weekly league standings, and Pantheon seats. You can hide your identity there at any time with the “Anonymous Scholar” toggle on the Account page — your row then shows no name or avatar, only the score.
• Friends & invites: friendships are mutual-consent — when you accept a request, that friend can see your username, avatar, streak, weekly XP and rank on your shared friends board (the Anonymous Scholar toggle does not hide you from friends you accepted). If you join through a friend’s invite link, we record who invited you so both of you receive the reward.
• Classes (only if you join or teach one): when you join a class you explicitly consent to share your study progress with that class’s teacher — the assigned decks you’ve mastered, your streak, XP, and when you were last active. Your individual answers and private ratings are never shared. You can leave a class at any time to stop sharing. When you create a class, we store the class, its members, assignments, and announcements. Classmates on a class leaderboard see your username + XP unless you enable Anonymous Scholar.
• Faction War: your faction choice contributes to house totals shown publicly as aggregates (points and member counts) — individual contributions are not published.
• Local storage: if you are not signed in, decks and study progress are stored only in your browser, not on our servers.

2. How we use your information & our legal bases

• To provide the Service — accounts, deck sync, studying, purchases (legal basis: performance of a contract).
• To send reminder emails you opt into (legal basis: consent; withdraw any time at Account).
• To secure the Service and prevent abuse (legal basis: legitimate interests).
• To understand and improve the Service via analytics (legal basis: consent — analytics stays off until you accept).
• To diagnose and fix errors (legal basis: legitimate interests in a reliable, secure product).
• To comply with legal obligations.

3. Cookies & similar technologies

We use a small number of technologies that store data on your device:

• Essential (always on): a sign-in/session cookie so you stay logged in, and a local setting that remembers your light/dark theme. These are required for the Service to work.
• Analytics (consent required): set only after you choose “Accept” on our cookie banner. You can change your choice any time via “Cookie preferences” in the footer. We do not run analytics until you opt in.

4. Who we share information with

We do not sell your personal information, and we do not share it for cross-context behavioral advertising. On the free tier we may show ads through Google AdSense in non-personalized mode (contextual only — no cross-site behavioral profiling); Pro and Dean’s List subscribers see no ads. When you use an AI feature, the text you submit is sent to Google’s Gemini API to generate the result. We use the following service providers (“processors”), who handle data only on our behalf:

We may also disclose information if required by law, to protect our rights, or in connection with a business transfer.

5. International data transfers

Our providers may process data in the United States and other countries. Where required, transfers rely on appropriate safeguards (such as Standard Contractual Clauses) offered by those providers.

6. How long we keep your data

We keep your account data while your account is active. If you delete your account, your profile, decks, and purchase records are deleted promptly. Limited records may be retained where required for legal, accounting, or fraud-prevention purposes (for example, payment records held by Stripe).

7. Your rights & choices

Depending on where you live (including under the GDPR and California’s CCPA/CPRA), you may have the right to:

• Access and export your data — use “Download my data” on the Account page.
• Correct your information — edit your profile, username, and decks at any time.
• Delete your account and data — use “Delete account” on the Account page (this is the “right to be forgotten”).
• Withdraw consent — turn off analytics via “Cookie preferences,” or turn off reminder emails in Account.
• Opt out of sale/sharing — we don’t sell or share your data for advertising, so there is nothing to opt out of, but you may always decline analytics.
• Complain to your local data-protection authority.

To exercise any right you can also email us at ProfessorLockin@gmail.com. We will not discriminate against you for exercising your rights.

8. Children

The Service is not directed to children under 13, and we do not knowingly collect personal information from them. You must be at least 13 years old to create an account. If you believe a child under 13 has provided us data, contact us and we will delete it.

9. How we protect your data

We use industry-standard safeguards: encryption in transit (HTTPS), database-level access controls (row-level security), passwordless authentication, and least-privilege handling of secrets. No method of transmission or storage is 100% secure, but we work to protect your information and will notify you and the authorities of a breach as required by law.

10. Changes to this Policy

We may update this Policy from time to time. We will post the new effective date here and, for material changes, provide additional notice.

11. Contact

Questions about this Policy or your data? Email ProfessorLockin@gmail.com.