Privacy Policy

1. Who we are

How Models Learn is run by the operator of How Models Learn, the controller of your personal data. Contact: hello@howmodelslearn.com.

2. What we collect

Account

Name, email address, time zone (for your streak), when you joined and last signed in. If you set a password, we store only a one-way Argon2 hash of it.

Google sign-in

If you sign in with Google or connect Google: your Google account ID, the email address and name Google shares with us. We never see your Google password and get no other access to your Google account.

Learning

Lessons started and finished, the step you reached, quiz scores, XP and the days you studied.

Sessions

For each signed-in device: when it signed in and was last used, its IP address and browser description.

Subscriptions

Plan, status, renewal date, and the customer and subscription IDs from Dodo Payments, plus the billing notifications Dodo Payments sends us. We never receive your card details.

Mistake reports

Your message, any quoted text, the lesson and step, and your IP address. If you’re signed out, the email address you choose to give.

Security log

Account events, with time and IP address: password changes and resets, email changes, connecting or disconnecting Google, accepting the terms at checkout, account deletion, and changes an admin makes to your account (such as changing your role, granting Pro or signing you out).

Server logs

Each request to our servers: time, address requested, IP address and browser.

We use no advertising or analytics trackers. The interactives run in your browser; what you do in them isn’t sent to us. Only your progress and quiz answers are.

3. Why we use it

• To run your account and Pro, including account emails (confirming your email, password resets, security notices). Legal basis: performing our contract with you.
• To keep accounts and the service secure: sessions, rate limits, abuse prevention, the security log. Legal basis: legitimate interests.
• To fix and improve lessons: mistake reports and totals such as how many people finish a lesson. Legal basis: legitimate interests.
• To meet legal duties, such as tax records. Legal basis: legal obligation.

4. Cookies and browser storage

Only what the site needs to work, so there’s no cookie banner:

• Session cookie: keeps you signed in. Your session ends after 30 days without use, and 90 days after you signed in at most; the cookie expires at that 90-day mark.
• Security cookie: protects forms against cross-site request forgery. Lasts 90 days.
• Google sign-in cookie: links a sign-in you start to its return from Google. Lasts 10 minutes.
• Browser storage: small preferences, such as a dismissed banner.

Fonts and all other files come from our own servers. Pages don’t contact any third party.

5. Who we share it with

We don’t sell personal data. We share it only with providers we need to run How Models Learn:

• Dodo Payments, our merchant of record for payments (privacy policy). When you start a checkout we send your email address, name and account ID; Dodo Payments collects your payment details itself.
• Google, only if you choose to sign in with it (privacy policy).
• Our hosting provider, which runs our servers, database and backups.
• Our email provider, which delivers account emails.
• An error-monitoring service, if enabled, which receives technical details when our servers hit an error.

We also disclose data where the law requires it.

6. How long we keep it

• Your account and learning data: until you delete your account. Deleting it immediately and permanently removes your profile, password hash, Google connection, progress, XP, sessions and subscription records.
• Backups: nightly database backups are kept for 14 days, so deleted data leaves them within 14 days.
• Server logs: rotated automatically by size (about 100 MB per service) and then deleted.

Some records are kept after you delete your account, because we need them:

• Security log: the events above, with their time, IP address, your former account ID and a one-way hash of your email address. They let us investigate abuse and show what happened to an account.
• Mistake reports: kept to maintain the lessons, no longer linked to your account (a signed-out report keeps the email address given with it).
• Billing records: the billing notifications Dodo Payments sent us (including your email address and name), kept as accounting records for as long as tax and accounting law requires. Dodo Payments keeps its own.

7. Your rights

Depending on where you live (for example under the GDPR or UK GDPR), you can:

• Get a copy: Export my data on your account page downloads your profile, sign-in methods, progress, XP, sessions, subscriptions, mistake reports and security log entries.
• Correct it: change your name, email address and time zone on your account page. A new email address takes effect once you confirm it from that inbox.
• Delete it: Delete account on your account page (cancel any active subscription first).
• Object, restrict, or ask anything else: email hello@howmodelslearn.com.
• Complain to your data protection authority.

We answer requests within one month.

8. Security

All traffic is encrypted (HTTPS). Passwords are hashed with Argon2, and session and email-link tokens are stored only as hashes. Admin access is restricted by role and logged. If a breach affects you, we’ll tell you without undue delay.

9. International transfers

Our providers may process data outside your country, including in the United States. Where the law requires, those transfers rely on safeguards such as the European Commission’s standard contractual clauses.

10. Children

How Models Learn is for people aged 16 and over. If you believe a child under 16 has an account, tell us and we’ll delete it.

11. Changes to this policy

We’ll tell you by email or on the site before a significant change takes effect. The date at the top shows the current version.