Privacy Policy
Privacy Policy
Who we are
Gadfly is built and run by Dmytro Hryshchenko, who is the data controller for everything described on this page — that is, the person who decides what is collected and why, and who answers for it. There is no company between you and us. Write to [email protected] about anything here.
Your voice stays on your machine
Speech recognition and the speaking voice run inside your browser tab, on speech models the tab downloads once into the browser's own storage. Audio is never uploaded — the page opens no audio connection, which you can check in the browser's Network panel. What leaves your machine is the text of the conversation, so that the tutor can think about what you said. If you run the tutor against a local model, nothing leaves at all.
What we store
- Your account: a username, your email address, and a one-way hash of your password (we never store the password itself). If you sign in with Google or GitHub, we store the email that provider reports and no password.
- Your practice: session transcripts (as text), the code you write, the prompts and responses of the model calls, assessments, summaries, and any short notes the tutor keeps to remember your context — including the city you tell it, if you tell it. These exist so the product can bring back what went wrong.
- Your packs: for each pack you buy, a record that the purchase happened — the reference it carries at the payment provider, the amount, the currency, the date it stops being usable, and how many of its sessions are left. No card details ever reach us.
- Your survey answers: if you answer one of our short surveys about the product, the answer you clicked, what you wrote, and whether you said we may write back.
- Your messages to us: if you write to us — through the contact form on this site or in the app, or by email — your email address, the name you give, what you wrote, and our replies. The form also notes where you wrote from (the page, and your browser's name), and, if you were signed in, which account it came from, so we do not have to ask.
Why we can use it
Under UK and EU data protection law we have to say what allows us to hold your data, not only what we hold:
- To give you the product you asked for — your account, your sessions and transcripts, the model calls that produce the tutor's replies, account emails, and — if you leave them on — a message when a problem you studied comes due for its repeat. This is the contract between us (Article 6(1)(b)).
- To keep the service working and safe — rate-limiting sign-in attempts, encrypted backups, and counting page views on the landing site in aggregate. These are our legitimate interests (Article 6(1)(f)), and you can object to them.
- To find out what to fix — asking you, at most once, what got in the way, and reading what you answer. This is our legitimate interest too (Article 6(1)(f)), and you can say no to it with one click.
- To answer you — when you write to us, using your address and your message to reply and to keep the conversation in one thread. This is our legitimate interest in answering the people who ask us something (Article 6(1)(f)).
- To keep records the law requires — a record of a purchase: its reference, the amount and the date (Article 6(1)(c)).
We do not rely on consent for any of this, so there is no consent for you to withdraw — and no cookie banner to click past. Two things are still yours to switch off: the reminder about a repeat coming due, and our occasional letter asking what you think of the product. Every one of those carries a link that turns them off in a single click, without signing in and without asking you why.
Who else sees it
- The model that does the thinking receives the text of the conversation (your transcribed words and your code) to generate the tutor's replies. This is Anthropic. Your sessions are not used to train models. We keep this page current if that ever changes.
- A weather service is asked, once every few hours, for today's forecast in each city a student has named. It receives a place — the city, or the coordinates of its centre — and nothing else: no name, no email, not a word of your session. Its answer is shared by everyone in that city.
- A web search runs once a day for the same cities, so the tutor can open with something that is actually on there. It carries the name of the city and the date, and nothing else about you. Never tell us where you are and neither of these ever runs.
- Our email provider delivers account-confirmation and password-reset emails, the reminder about a due repeat if you leave those on, and the occasional letter asking what you think of the product, and our replies when you write to us. It also carries a copy of each survey answer to our own support mailbox, together with your name, your email address, when you signed up and how many sessions you have had. It handles that information only to deliver those emails.
- Paddle takes the payment when you buy a pack, as our merchant of record — it is the seller on your receipt. It receives your email address and the card details you type into its checkout; we never see or store those. What comes back to us is a record that a purchase happened — its reference, the amount, and the email it was made with.
- Cloudflare hosts this site and also counts visits to it with Cloudflare Web Analytics, a cookieless tool that stores nothing on your device. Our typefaces are served from our own servers, not from Google, so loading a page here tells Google nothing.
- PostHog counts how the site and the app are used, on our instructions and on servers in Frankfurt. It never receives your name, your email, or a word of your sessions — see below.
What we keep on your device
Nothing we put on your device advertises to you or follows you between sites. Signing you in puts one token in your browser's own storage; the law treats that exactly like a cookie, and so do we — it is there because you asked to sign in, and it goes when you sign out. Here is the whole list: that sign-in token; your own settings and progress; two short-lived cookies during Google or GitHub sign-in, deleted straight after. The contact form writes nothing to your device.
We measure how the site and the app are used with PostHog, configured so that it keeps nothing on your device — no cookies, no stored identifier, nothing that outlives the page. On this site it writes nothing and reads nothing at all: to tell two visits apart, its server works out a code from your IP address and your browser, with a key thrown away every night, so nobody is followed from one day to the next.
Inside the app two things are counted. Our own server reports the milestones — a session started, a session finished, the write-up opened. Your browser reports which screens you open and what you click — the buttons and links, never the text you type or say — and sends that through our server, not to PostHog directly, so PostHog never sees your address. Both are tied to your account number, because a funnel that cannot tell one person's first session from another's tenth answers nothing. Alongside it they carry what you did, not who you are: which track and mode a session was, which problem, how long it ran and how far it got; which company and level you are aiming at; the operating system your browser runs on; and the campaign tags of the link that brought you. They never carry your name, your email, or a word of what you said or wrote in a session.
When you click through from this site to the app we put a random tag in the link, so we can see that a visit here and a sign-up there belong together. The tag travels in the address bar and is never written to your device; it is kept with those two events in our analytics, and it means nothing outside them.
We ask PostHog to keep all of it in Frankfurt, inside the EEA, and they process it only on our instructions. Our lawful basis is our legitimate interest in knowing whether the product works. Inside the app you can ask us to stop counting your activity — write to [email protected] and we will exclude your account. On this site the counter holds no identifier at all, so there is nobody to exclude; blocking the analytics host, or any tracker blocker, stops it at your end.
The contact form sends what you type straight to our own server when you press Send. It loads nothing from anyone else — before you open it or after — and nothing is written to your device. There is no live chat: a person reads your message and answers by email.
Your IP address is used briefly, in memory, to rate-limit sign-in attempts and messages sent through the contact form; it is not written to the product database. Our mail server keeps ordinary connection logs, which include IP addresses, for a short time to block abuse.
One exception, and only if you take a guest pass — a session without an account. To keep the pass to one per computer, we store a single code worked out from your network (the block your address belongs to, not the address itself) and a few traits of your browser — screen size, time zone, language, graphics chip. It is a one-way hash: it cannot be turned back into your address or your browser, it is not linked to the account you may create afterwards, and it is deleted 180 days after that computer was last seen at the guest door. Nothing is written to your device for this.
Your controls
From Settings → Your data you can download everything as one JSON file, and delete your data with the word DELETE. A signed-in person deleting their own account removes the account, its sign-in and any purchase record too — that is a full deletion and cannot be undone.
You also have rights the law gives you regardless of what our buttons do: to get a copy of your data, to have it corrected, deleted or restricted, to receive it in a portable form, and to object to anything we base on our legitimate interests. Write to [email protected] — we answer within one month, free of charge. If we get it wrong, you can complain to the UK Information Commissioner's Office (ico.org.uk) or to the data protection authority where you live, though we would rather have the chance to put it right first.
Your scores and assessments are produced automatically, and they are practice feedback: we do not use them to decide anything about you.
Where the data lives
Account and practice data live in a database on a server we operate in Germany, inside the European Economic Area, reached over an encrypted (HTTPS) connection. The messages you send us live on the same server, in our helpdesk — a separate program we run ourselves, not a service of anyone else. Our email provider is in the EEA too.
One thing does leave that area: the text of your session goes to Anthropic in the United States, because that is where the model that answers you runs. Anthropic's data processing terms cover that transfer with the Standard Contractual Clauses and the UK International Data Transfer Addendum — the safeguards UK and EU law require for sending data abroad.
The payment is the one thing that never lands here at all: it happens on Paddle's own systems, under Paddle's privacy notice, and what reaches our server is the record described above. We hold no card data, so there is none of it to send anywhere.
We keep encrypted daily backups on a two-week horizon — on the server and as an offsite copy — so that a failure cannot wipe your work. We keep your data while your account exists. When you delete your account it disappears from the live database immediately; the backups still hold it until they age out, which takes up to 15 days. We never restore a single account from a backup, and if a disaster ever forced us to restore the whole database, your deletion is re-applied before it goes back into service — we keep a note that an account was deleted, holding only a number, a one-way hash of the address and the date, precisely so that a restored copy carries its own list of what to remove.
Messages you send us stay in the helpdesk after the conversation ends, so that a later question still has the earlier answer behind it. The helpdesk is separate from your account, so deleting your account does not reach it: ask us, and we delete your messages there too. Its backups follow the same two-week horizon.
Contact
Questions about your data, or a request about it, go to [email protected] — that reaches Dmytro Hryshchenko, the controller named at the top. Using Gadfly is also subject to the Terms of Service.