Your learning data should work for you.

Account information. When you create an account, we receive your email address and the account details you choose to provide, such as your name, phone number, and location. If you use Google to sign in, we receive basic profile information authorized through that provider, such as your email address, name, and profile image.

Learning activity. We store information needed to operate and personalize the platform, including practice attempts, answers, timing, bookmarks, flashcards, saved practice sets, progress, and AI-generated study analyses.

Interview practice. If you use AI interview practice, we collect the profile and school context you choose to provide, provider session identifiers, interview transcripts, and the feedback generated from those transcripts. Video recording is disabled for the initial pilot.

Coaching and support. If you request coaching or contact us, we collect the information in your request and our related communications.

Purchases. Payments are processed by Stripe. We receive transaction, customer, subscription, and entitlement details, but we do not store your complete payment-card number.

Device and usage data. We and our service providers may process IP addresses, browser and device details, timestamps, request logs, cookies, and local storage needed for security, authentication, preferences, and service operation.

Analytics and advertising measurement. We use PostHog to understand visits, navigation, feature use, conversion steps, errors, and performance. We may also record visual replays of sessions so we can see where the experience is confusing or broken. Form inputs are masked, sensitive account text is obscured, request bodies are not recorded, and payment-card details are handled on Stripe rather than in our application.

We use the Reddit Pixel and Reddit Conversions API to understand whether Reddit ads lead to site visits, diagnostic activity, account creation, checkout starts, and purchases. This may involve a Reddit click identifier, page and event details, purchase value and currency, and a transaction identifier used to avoid double-counting. We do not send payment-card details, email addresses, or account identifiers to Reddit.

We use information to:

• create and secure your account;
• save and synchronize your learning progress across devices;
• provide practice, flashcards, progress insights, and coaching;
• personalize recommendations and generate requested AI features;
• process purchases and manage access to paid features;
• measure and improve the effectiveness of our advertising;
• send transactional messages and respond to support requests;
• detect abuse, troubleshoot problems, and improve the service; and
• comply with legal obligations and enforce our terms.

When you request an AI study analysis or follow-up explanation, relevant learning data may be sent to our AI service providers. Depending on the feature, this can include aggregated performance metrics, question context, your selected answer, and the related explanation. We limit the information sent to what is reasonably needed to provide the feature. AI output can be incomplete or inaccurate and should be reviewed critically.

For live interview practice, Tavus processes camera, microphone, and conversation data to provide the interactive AI interviewer. We use the resulting transcript to generate evidence-linked feedback. We do not use appearance, inferred emotion, or body language to score interview performance, and interview text is excluded from product-analytics event properties and session-replay capture.

We share information with vendors that help us run the service, including Supabase for authentication and data storage, Vercel for hosting, Stripe for payments, Resend for transactional email, Google when you choose social login, PostHog for product analytics and privacy-masked session replay, Tavus for live AI interview practice, Reddit for advertising measurement and attribution, and OpenAI or Anthropic for requested AI features. These providers process information under their own terms and privacy policies.

We may also disclose information when reasonably necessary to comply with law, protect rights or safety, investigate abuse, or complete a merger, financing, acquisition, or sale of assets. We do not sell your personal information.

Authentication cookies keep you signed in securely. Browser local storage may retain learning progress and preferences, including before you create an account. Analytics and advertising cookies and local storage help us connect a visit across 528.academy and app.528.academy and understand whether the product is useful and whether an ad led to a conversion. You can clear cookies and site data through your browser, but doing so may sign you out or remove progress that has not been synchronized to your account.

We retain information while your account is active and as reasonably needed to provide the service, maintain records, resolve disputes, prevent fraud, and meet legal obligations. Retention periods vary by data type and purpose. We use administrative, technical, and organizational safeguards designed to protect information, but no online service can guarantee absolute security.

You can update certain profile details in your account and clear locally stored learning progress through the platform. You may also contact us to request access to, correction of, or deletion of your personal information. We may need to verify your identity, and some information may be retained where required by law or for legitimate security, accounting, or dispute-resolution purposes.

Interview-practice sessions include a control to request deletion of the corresponding session, transcript, feedback, and provider data. Provider deletion may take time to complete, and the platform will not show the local record as deleted until provider deletion is confirmed.

You can disconnect 528 Academy from your Google account in your Google account settings. Disconnecting Google does not automatically delete your 528 Academy account or records.

We honor browser Global Privacy Control and Do Not Track signals by disabling Reddit advertising measurement in that browser. You can also clear cookies and site data to remove stored advertising attribution.

The service is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child has provided information to us, please contact us.

We and our providers may process information in Canada, the United States, and other countries. Privacy protections and government-access rules may differ from those where you live.

We may update this policy as the service changes. We will post the revised version here and update the date above. If a change materially affects how we use personal information, we will provide additional notice when appropriate.

For privacy questions or requests, email hello@528.academy. Please do not include sensitive medical, financial, or identification information in your message.