Privacy Policy
Last updated: October 2026
This is a document that explains what we collect, why, and what we do with it. We’ve written it in plain English on purpose. You deserve to know what’s happening with your information.
What Data We Collect and Why
Your email address
Collected when you sign up for the newsletter or create a free preview or membership account. You can sign up with an email code, a password, or via Google. If you sign in with Google, we receive your email address and basic profile name from your Google account. We use your email to send you the content you signed up for, account information, and (if you’re a member) tutorial notifications. We do not use it to contact you for reasons unrelated to why you gave it to us.
Our free downloads never need an email. If you choose to join the newsletter from one of them, we also record which download you came from, the exact sign-up wording you agreed to, and when, so we can show how you opted in. You can unsubscribe from any newsletter email. To avoid offering you the newsletter twice, your browser keeps a small note on your device (it holds no personal information); clearing your browser’s site data removes it.
Your name
Collected at signup (or from your Google account if you sign in with Google) and through the Ask Kevin form. Used to address you in correspondence and to personalise your account.
Payment information
Collected only when you begin a paid membership or purchase a guide. Payment processing is handled entirely by Paddle, our payment partner. We do not store your credit card details on our servers. Paddle’s privacy policy applies to the payment transaction.
Questions submitted through Ask Kevin
When you write to Kevin through the Ask Kevin form, your question is stored with your account and sent to our support inbox. AI tools help us draft a response, which our founder reviews before it is sent to you by email. Please leave out personal details we don’t need to answer it.
Usage data
Analytics about how the site is used: which pages are visited, which buttons are clicked, where visits come from, and how long people spend on content. We collect this with PostHog and use it to improve the platform. When you are signed in, these events are linked to your account ID so we can understand how members use the platform. We never use them for advertising.
Visitors from the EU, EEA, UK and Switzerland get cookieless analytics that are not linked to an account. Anyone can turn analytics off at any time with the Cookie Preferences link at the bottom of every page, and we treat your browser’s Global Privacy Control signal as a request to turn it off.
Text you give our AI-assisted tools
Some member tools, such as AI Prescription and The Second Opinion, work by sending what you type or paste to an AI model to produce your result. That text goes through OpenRouter, a service that routes it to the AI model provider. Your monthly recap is also written with AI, from a summary of your activity on the site. Your results may be saved to your account so you can come back to them. Please don’t paste passwords, account numbers, or personal details you wouldn’t want to share.
Ask Kevin, the AI helper
The Ask Kevin helper in the member area is an AI. When you ask it something, your question goes through OpenRouter to an AI model provider to write the answer, together with the page you’re on, your first name if you’ve saved one, your membership status and which of our guides you own, but never your email address or your saved prompts. We keep your questions and Kevin’s answers for 90 days, so you can look back at them and so we can improve the answers, and then delete them. You can see them, and delete them all at any time, in Account, under Data & Privacy. If a message suggests that someone may be in danger or that a scam is happening right now, Kevin shows a fixed safety message and we keep only the fact that it happened, not your words.
Kevin’s prompt coach
When you press “Check my prompt”, the prompt you’re checking goes through OpenRouter to an AI model provider, together with your membership status and, for a prompt built in Prompt Builder, the answers you gave the builder. We don’t keep the prompt or Kevin’s notes on it. We record only that a check happened, when, what kind of result it was and what it cost, so we can apply the daily limit, and we delete that record after 90 days.
How We Use Your Data
We use your data to:
- Send you what you signed up to receive
- Maintain and improve your membership account
- Improve the platform based on how it’s being used
- Respond to questions submitted through Ask Kevin
- Process payments through our payment gateway
We do not use your data to build advertising profiles. We do not use it for purposes beyond what you’d reasonably expect from a platform you’re paying to use.
Who We Share It With
We do not sell your data. We do not rent your data.
We share data only with the services required to run the platform:
Supabase: provides our authentication system and database. Your email, profile data, and account information are stored securely on Supabase’s infrastructure.
Google: if you choose to sign in with Google, Google provides us with your email address and display name for authentication purposes only. We do not access your Gmail, Google Drive, contacts, or any other Google services. Google’s use of your data is governed by their own privacy policy.
Paddle: our payment partner. Handles all billing, subscription management, and purchase transactions. We do not see or store your card details.
Resend: handles newsletter and account email delivery.
PostHog: product analytics, as described under “Usage data” above.
Mux: handles video streaming for member tutorials. Mux may collect technical viewing data (device type, connection quality, viewing duration) to deliver and optimise video playback. No personal identifying information beyond what is technically necessary for streaming is shared.
hCaptcha: used on some forms to verify that submissions are from a human, not a bot. hCaptcha may collect behavioural signals (mouse movements, interaction timing, device information) for this purpose. hCaptcha’s privacy policy applies to the data it collects.
OpenRouter (AI tools): routes the text you give our AI-assisted member tools, and the activity summary behind your monthly recap, to the AI model provider that produces the result. We also use AI tools in producing and researching our content, and to help draft replies to Ask Kevin questions. We don’t send your name or email address with what you type; the text itself is shared, so please leave out personal details.
These providers are selected because they are necessary to operations. They are not provided with your data for their own marketing purposes.
Cookies and Tracking
We use cookies to keep you logged in, remember your preferences, and understand how the site is being used. We do not use cookies to track you across other websites.
Analytics run by default, and you can turn them off at any time with the Cookie Preferences link at the bottom of every page. If your browser sends a Global Privacy Control signal, we turn analytics off for you automatically. Visitors from the EU, EEA, UK and Switzerland get cookieless analytics.
Children and Teens
Accounts are for adults aged 18 and over. A young person aged 13 to 17 may use the platform only under a parent or guardian’s membership and supervision, as our Terms of Service describe. We do not knowingly collect personal information from children under 13.
AI Together is designed for a grown-up to use with a child, with the grown-up at the keyboard. To suggest activities, it stores only the short label and age band you choose for each person (for example “my youngest, 6 to 9”). We suggest a nickname or relationship rather than a child’s full name. You can edit or remove these at any time.
If you believe a child under 13 has given us personal information, please contact us and we will delete it.
Authentication
You can create an account and sign in using one of three methods:
- Email code: we send a one-time code to your email address. No password required.
- Password: you can optionally set a password in your account settings.
- Google: you can sign in using your Google account. We receive only your email address and display name. We do not request access to your Gmail, Google Drive, calendar, contacts, or any other Google service. Your Google data is used solely for authentication and is not sold, transferred, or used for advertising.
Third-Party Services
The services listed in the “Who We Share It With” section above operate under their own privacy policies. We recommend reviewing those policies if you have questions about how they handle data.
Your Rights
You have the right to:
- Access the personal data we hold about you
- Correct inaccurate data
- Delete your data. Account deletion removes your personal data from our active systems
- Object to specific uses of your data
To exercise any of these rights: contact us.
For EU and UK visitors: you have additional rights under GDPR, including the right to data portability and to lodge a complaint with a supervisory authority. For Canadian visitors: your rights under CASL apply to email communications.
Data Retention
We keep your data for as long as your account is active. If you cancel your membership and request data deletion, we delete your personal data within 30 days.
If your free preview ends and you don’t join, we keep your account and anything you saved for 90 days after the preview ended (and in any case until at least 15 November 2026), then delete the account automatically. The date is shown on your account page. If you were a paying member and cancel, your account stays until you delete it, so you can rejoin where you left off. You can delete your account yourself at any time under Account, Data & Privacy.
Some data may be retained longer where required by law.
Changes to This Policy
We will update the “Last updated” date when this policy changes. For significant changes, we will notify active members by email.
Contact for Privacy Concerns
If you have questions about this policy or how your data is handled: contact us.
This policy is written in plain English for clarity. It is subject to legal review and may be updated to meet regulatory requirements.