Privacy Policy

Account information: when you register, we store your email address, display name, and basic learning-profile details. Passwords are handled by our authentication system and stored only as hashes — we never store passwords in readable form.

Learning data: lessons started and completed, the furthest step reached in each lesson, practice exercise results, experience points, and study streaks. This data is necessary to save learner progress and to measure lesson quality.

Anonymous aggregate data: when learning without an account, we only record aggregate counters per lesson and per day (for example, how many starts and completions). This data is not tied to any identity and cannot be used to recognise any individual student.

Minimal technical data: our hosting platform keeps basic server logs (such as access times and system error information) to operate and protect the service.

stemezy is designed for primary-school students. An account for a child must be created by a parent or guardian, or with a parent or guardian's clear consent.

Parents and guardians may view, correct, and request deletion of all of their child's data at any time by contacting us (see section 9).

If we learn that a child's account was created without guardian consent, we will delete the account and its associated data as soon as we are notified.

Students can always learn in signed-out mode without providing any personal information.

To provide lessons and save learning progress and practice results.

To measure learning quality — for example, which step students most often stop at — so we can improve lesson content. Internal measurement data is accessible only to the operator of stemezy.

To protect the service against abuse and fraud.

We never use children's learning data for advertising.

We never sell personal data to anyone.

We never show advertising targeted at children.

We never install third-party marketing trackers and never build behavioural profiles of children.

We never share personal data outside the technical processors listed in section 5, except where the law requires it.

We use Supabase for user authentication and database storage, and Vercel for website hosting and delivery, aggregate visit statistics (Vercel Analytics), and anonymous page performance measurement (Vercel Speed Insights). These providers process data only to operate the service for stemezy and under their own security commitments.

stemezy uses only essential cookies: keeping you signed in and remembering your language choice. We do not use advertising cookies or behavioural analytics cookies.

Our visit statistics (Vercel Analytics) are entirely cookieless and collect no personal data: the system records only aggregate figures such as page views, referring sources, and country, which cannot be used to identify or track any individual. Likewise, performance metrics (Vercel Speed Insights) record only anonymous figures such as page load speed and rendering stability.

Account data is kept while the account is active. When you ask us to delete an account, personal data is deleted within 30 days, except records we are legally required to keep.

Anonymous aggregate data may be kept indefinitely because it cannot identify any individual.

All connections to stemezy are encrypted with HTTPS. Even so, no online system is perfectly secure; if an incident affects personal data, we will notify as required by law.

Under Vietnam's Decree 13/2023/ND-CP on personal data protection, you have the right to be informed about data processing, to give and withdraw consent, to access, correct, and delete your data, to restrict or object to processing, and to complain to the competent state authority.

Parents and guardians exercise these rights on behalf of their children. To do so, contact us using the details in section 9 — we respond within the time limits set by law.

When this policy changes materially, we will announce it on this page and, if you have an account, by email. The date at the top of this page shows the current version.

For all privacy questions and all personal-data requests — including requests to delete a child's data — contact: [email protected].