This policy explains what personal data we process when you use Teachify, why we process it, who we share it with and what rights you have under Regulation (EU) 2016/679 (GDPR) and Romanian law. We only collect what the platform needs to work; we do not sell data and do not show ads.
1. Data controller
The controller of your personal data is [Operator name], [Operator registration number and registered office]. For any question about your data, write to [contact email address].
2. What data we process
Depending on how you use the platform, we process:
- account data: email address, username, display name and password (stored only as an irreversible hash; nobody can see it, not even administrators);
- data received from Google if you sign in with Google: your name, email address and profile picture;
- optional profile data: your school and county, if you fill them in;
- content you post: questions, answers, images uploaded to the forum, votes and the reports you send;
- progress data: completed lessons, quiz scores, daily challenge answers, XP, level and streak;
- a record of accepting the terms: the version of the terms accepted when you created your account, and when;
- technical data: IP address, browser type and request times, kept in our providers' security and operational logs.
3. Why we process it and on what legal basis
- to create and manage your account and to provide the forum, lessons, quizzes and progress system, that is, to perform our contract with you (Art. 6(1)(b) GDPR);
- to send the emails your account needs (address confirmation and password reset), also to perform the contract;
- for security, preventing abuse and automated sign-ups, moderating content and handling reports, based on our legitimate interest in keeping the platform safe (Art. 6(1)(f) GDPR);
- to comply with legal obligations, for example lawful requests from authorities (Art. 6(1)(c) GDPR);
- for users under 16, with the consent of a parent or legal guardian (Art. 8 GDPR).
4. What is public
Your profile is public: username, display name, profile picture, role (student, teacher or administrator), school and county (if you added them), XP, level, streak and join date. Your questions and answers are public, shown with your name, and may be indexed by search engines.
Images uploaded to the forum can be opened by anyone who has their link. Your email address, detailed lesson progress and the reports you send are not public.
5. Where data is stored and who receives it
We use a few providers who process data on our behalf under a contract (data processing agreement):
- Supabase (Supabase, Inc.): database, authentication and image storage. Data is hosted in the European Union, in the Frankfurt, Germany data centre;
- Vercel (Vercel Inc.): website hosting. Pages are delivered through a global network, and server code runs in the Frankfurt region;
- authentication emails are sent through Supabase Auth and [email provider, if a custom one is used];
- Google (Google Ireland Limited), only if you choose to sign in with Google;
- hCaptcha (Intuition Machines, Inc.), only if bot protection is enabled on the sign-in forms.
6. Transfers outside the European Economic Area
Some providers (Supabase, Vercel, hCaptcha) are US companies and may access certain data from outside the EEA, for example for technical support or operational logs. These transfers are protected by the EU-US Data Privacy Framework where the provider is certified, or by the standard contractual clauses approved by the European Commission.
7. How long we keep data
- account data, profile, content and progress: for as long as you have an account;
- after your account is deleted: your profile, questions and answers (including answers others gave to your questions), votes, progress, XP and reports are deleted from the database immediately, and backups expire on their normal rotation;
- providers' technical logs: short periods set by them, generally no more than a few weeks;
- reports that led to moderation action: as long as needed to handle appeals or repeated abuse.
8. Your rights
You have the right to access your data, have it corrected or erased, restrict its processing, receive it in a portable format, object to processing based on legitimate interest, and withdraw consent at any time without affecting earlier processing. You can change much of your data (display name, school, county, posts) directly in your account.
To exercise your rights, write to [contact email address] from your account's email address. We reply within one month. You also have the right to lodge a complaint with the Romanian data protection authority (ANSPDCP), www.dataprotection.ro.
9. Children
The platform is designed for students, including minors. Users under 16 may create an account only with the consent of a parent or legal guardian. Parents and guardians can exercise the rights above on their child's behalf by writing to [contact email address]. We advise students not to post personal data about themselves or others in the forum.
10. Security
Connections to the platform are encrypted (HTTPS), passwords are stored only as hashes, and database-level rules make sure each user can only see and change what they are allowed to. Correct quiz answers stay on the server until grading. If you find a security problem, write to [contact email address].
11. Automated decisions
We do not make decisions based solely on automated processing that have legal effects on you. XP, levels and quiz scores are calculated automatically but only serve as motivation.
12. Cookies
We only use cookies and local storage that are strictly necessary or that you explicitly ask for (for example your sign-in session, language and theme). We do not use analytics or advertising cookies. See the Cookie policy for details.
13. Changes
We may update this policy when the platform or the law changes. The date of the last update is shown at the top of this page, and we announce important changes on the platform or by email.