Privacy

Privacy policy

Draft of 2026-09-26 · covers the website aiforthecurious.com only

Draft. To be reviewed by a qualified lawyer before launch.This is a starting draft, not legal advice. Everything in [brackets] is still to be filled in.

The short version

Without an account, everything you do stays in your own browser. We don’t see it.
With a free account, we store your email address and your progress: lessons done, exercise ticks, and exam results.
Your practice notes stay on your device unless you switch on note sync. We never read, share, or analyse them.
We never sell your data, and we never use it to train AI models.
Curious Kids (ages 8 to 12) needs no account and collects nothing.
You can download your data or delete your account at any time.

Who we are

AI for the Curious is a free, self-teaching AI academy, run by [Company or owner name], [Address]. We are responsible for your data on this website (the “controller”, in legal terms). Questions about privacy: [Contact email].

This policy covers the website only. If there is ever an iOS app, it will have its own policy and its own App Store privacy details.

What we store, and where

In your browser (with or without an account)

The site saves your learning in your browser’s own storage on this device, so it works without an account: which lessons you’ve completed and when, which exercises you’ve ticked off and the notes you typed into them, your exam attempts and results, your placement result from “Start here”, the name you put on certificates, and a few settings (light or dark theme, grown-ups or kids side). It stays on this device until you clear it. Without an account, none of it is sent to us.

With a free account

The first 5 lessons are open to everyone. Every other lesson is free too; it just needs a free account (email and password, or a sign-in link by email). With an account, we store:

your email address, and your password in a scrambled form (a “hash”) that our sign-in provider keeps; we never see or store your password itself;
your progress: lessons completed and when, exercise ticks, and exam attempts, results, and dates;
your practice notes, only if you switch on note sync (see below).

We use these to keep your progress and certificates across devices, and to run the service (for example, to send a sign-in link you asked for). The legal basis is providing the service you signed up for (performance of a contract). [Lawyer to confirm the legal bases]

Your practice notes

The text you type into exercises is yours, and it can contain personal information: about your work, your family, or yourself. So it stays on your device by default. It is copied to your account only if you switch on note sync (on the account page), and you can switch it off again at any time. Whether synced or not, we never read, share, or analyse your notes. Your progress, exercise ticks, and exam results sync either way once you’re signed in.

Merging: when you sign up or sign in on a device, anything you already completed there (lessons, exercise ticks, exam results) is merged into your account, so nothing is lost. Notes are included only if note sync is on.
Sign-in by email link: to send the link, your email address is processed by [Auth provider] and its email delivery service, [Email delivery provider].
Security: sign-in is handled by [Auth provider]; we never store passwords or sign-in tokens ourselves.

Teams

If you join a team through your employer or school, the team’s admin sees only which lessons you’ve completed, which exams you’ve passed, and the dates. Never your notes, your answers, or your placement result. We tell you this before you join a team, and you can leave a team at any time.

What we never do

We never sell your data, or share it for advertising.
We never use your data, answers, or notes to train AI models, ours or anyone else’s.
We don’t show ads.

Who processes data for us

A few companies help us run the service, under contract, and only for that purpose:

Sign-in: [Auth provider]
Database (your account and progress): [Database provider]
Sending emails (sign-in links, password resets): [Email delivery provider]
Hosting the website: [Hosting provider]
Analytics: [Analytics provider or "none"]

Your data is stored in [Countries / data transfer safeguards].

How long we keep it

We keep your account data for as long as you have an account. When you delete your account, we delete its data within [Retention period after deletion, e.g. 30 days], apart from anything the law requires us to keep. Data in your browser stays there until you clear it; clearing this site’s data in your browser settings removes it.

Your rights

You can ask to see, download, correct, or delete your data, and to object to or restrict how we use it. Most of this you can do yourself:

Download: “Download my data” on the account page saves everything this device holds for you, notes included.
Delete: “Delete my account” on the account page deletes your account and everything saved in it.
Everything else: write to [Contact email]. We’ll reply within one month.

Cookies and browser storage

The site uses no cookies today. It uses your browser’s local storage (on your device) for these items:

Item	What it’s for
`afc-done-NNN`, `afc-done-at-NNN`	Which lessons you’ve completed, and when (for certificates).
`afc-practice-NNN`	Your exercise ticks, and the notes you typed into exercises.
`afc-exam-…`	Your exam attempts, results, and which questions you had (so a retake gets fresh ones).
`afc-placement`	Your result from the “Start here” placement quiz.
`afc-name`	The name you put on certificates.
`afc-sync-notes`	Whether you switched on note sync.
`afc-theme`, `afc-side`	Light or dark theme; grown-ups or kids side.
`afc-kids-…`	Curious Kids progress and stickers. Never sent anywhere.

When accounts go live, signing in will need [Auth provider]’s sign-in cookie or token, which is strictly necessary for the service. [Lawyer to confirm the cookie wording]

Other sites and tools

Python in some lessons: in some Level 3 and 4 lessons, pressing “Run” downloads a Python runtime from a public content network (jsDelivr). That request shows your IP address to the network, as any website visit does. Your code runs in your browser and is never sent anywhere.
Links and exercises: lessons link to other websites, and many exercises use AI assistants and tools you choose. Their own privacy policies apply. Think about what you share with them; the lessons show you how.

Children and Curious Kids

Accounts are for people aged 13 and over. We don’t ask for a date of birth or ID: you confirm your age when you sign up. If we learn that someone under 13 has an account, we delete it. [Lawyer to confirm the minimum age for the countries we serve]

For parents: Curious Kids (ages 8 to 12)

Curious Kids is a separate area of the site made for children. It needs no account and collects nothing: no names, no email addresses, no analytics. A child’s progress and stickers stay in the browser on your device and are never sent to us, never synced, and never merged into an account, even if a grown-up is signed in on the same device. Clearing the browser’s data for this site removes them. The lessons use a pretend AI, so children never need a real AI tool.

Changes, contact, and complaints

If we change this policy, we’ll update the date at the top, and tell account holders by email before important changes take effect.

Contact: [Contact email], [Company or owner name], [Address].

If you’re unhappy with how we handle your data, please tell us first. You also have the right to complain to [Supervisory authority].