Privacy Policy

What we collect

• Email address and display name — when you create an account with email and password.
• Google profile data (email and name only) — when you sign in with Google. We do not access Google Drive, Contacts, or any other Google services.
• Progress data — lesson progress and scenario attempt history, saved to your account when you are signed in. Guests store practice data in their browser only (see Data retention below).
• Contact form messages — the name, email address, topic, and message you submit through the contact form. With each message we also store a scrambled (hashed) form of your IP address, used only to limit repeated submissions. We do not store the raw address.

How we use it

• To save your practice record across devices when you are signed in.
• To send password reset emails for email/password accounts. We do not send marketing emails.
• To read and answer messages sent through the contact form, and to block spam and automated submissions.
• To measure aggregate usage (e.g., how many training sessions were started) so we can improve the app. Analytics is optional and consent-based — see Cookies and your choices below. We never sell this data or use it to identify you personally.

Third-party services

We use the following services to operate the app:

• Supabase — database and authentication infrastructure. Your account data and practice records are stored on Supabase servers.
• Google OAuth — optional sign-in provider. If you use “Continue with Google,” Google shares your email and name with us for account creation only.
• Vercel — hosting provider and anonymous page-view analytics. Vercel Analytics does not use cookies and does not track individual users.
• Google Analytics (GA4) — optional usage analytics, loaded only when we enable it and used in “Consent Mode” with analytics storage denied by default. No analytics cookies are set unless you choose “Accept” on the cookie banner; if you decline, Google receives only aggregate, cookieless measurement that does not identify you. We do not use this data for advertising.
• Cloudflare Turnstile — a bot check on the contact form. When the form loads, Cloudflare receives your IP address and browser signals to tell people from automated programs. Cloudflare handles that data under its own privacy policy.
• Resend — transactional email delivery used to send password reset emails for email/password accounts. Resend receives your email address only to deliver the reset message.

What we do not do

• We do not sell your data. We do not share your data with third parties beyond the services listed above.
• We do not use your data for advertising.
• We do not collect sensitive data such as location, financial information, or health records.

Cookies and your choices

We set three kinds of cookies:

• Sign-in cookies (strictly necessary) keep you signed in when you have an account.
• A one-time Google sign-in cookie. When you sign in with Google, we set a short-lived cookie that says only whether the sign-in created a new account or signed in an existing one. The page you land on reads it once so we can count new accounts versus return visits accurately, then deletes it. It lasts at most two minutes, holds no identifier, and is set whatever your analytics choice.
• Optional Google Analytics cookies, only after you choose “Accept” on the cookie banner shown on your first visit. Until then, and if you choose “Decline,” no analytics cookies are stored and analytics runs in a cookieless, aggregate-only mode.

Your choice is saved in your browser. To change it at any time, use Cookie preferences in the site footer.

Data retention

• Account data (email, display name, practice records) is retained until you delete your account.
• Guest practice data is stored only in your browser's local storage and is never sent to our servers. Clearing your browser data removes it.

Contact

Questions about this policy? Contact: hello@tanktopump.com