Privacy Policy
Version v0.6.0 · Last updated July 16, 2026
1. What We Collect
Anonymous users: we collect your IP address temporarily for rate limiting and abuse prevention. We do not create a profile or store it beyond the current day. Signed-in users: we collect your email address and username via Clerk (our authentication provider). We store your run history, modules, subscription status, and learning progress.
2. Content You Submit
Text, topics, and URLs you submit are processed by AI to generate game content. Processed transcripts are cached globally (not linked to your account) to avoid redundant processing. The same input from any user returns the cached result.
3. How We Use Your Data
Account data: to provide the service, manage your subscription, and communicate about your account. Content data: to generate game maps and AI-powered retrieval quizzes from your input. Quiz data: we store your quiz answers, accuracy, and confidence ratings to track learning progress and improve question quality. AI processing: your submitted content is sent to OpenAI for transcript processing, quiz generation, and summary creation — only the content necessary for generation is sent, and it is not used for model training. Usage analytics: to improve the service (via PostHog). Payment data: processed exclusively by Stripe — we do not store credit card numbers or bank details on our servers. We do not sell your data.
4. Advertising
Free-tier users may choose to watch opt-in rewarded video ads to extend their session limits. When the run limit is reached, watching an ad earns +1 bonus run. When the play time limit is reached, watching an ad earns +5 minutes of bonus play time. These ads are served by Google (via the Ad Placement API / AdSense). When ads are displayed, Google and its advertising partners may collect device identifiers, IP addresses, and cookies to serve and measure ads. Ad viewing is entirely voluntary — you are never required to watch an ad to use core functionality. Paid subscribers (TrainRun Pro) are never shown ads and no ad-related data collection occurs for them. You can opt out of personalized ads via Google's Ads Settings (https://adssettings.google.com) or the Network Advertising Initiative opt-out page (https://optout.networkadvertising.org). For users in the EEA, UK, and Switzerland: we use Google's certified Consent Management Platform (Privacy & Messaging) integrated with the IAB Transparency and Consent Framework (TCF) v2.2 to obtain your consent before serving personalized ads. You may withdraw your consent at any time via the consent settings available on our site.
5. Third-Party Services
We use: Clerk (authentication), Supabase (database hosting), OpenAI (content processing), Stripe (payment processing), Mailchimp/Mandrill (transactional email), PostHog (analytics), YouTube (embedded video player), and Google AdSense/AdMob (optional rewarded ads for free-tier users). Each service processes data under its own privacy policy. When you use the YouTube player, Google's Privacy Policy applies to that interaction. When rewarded ads are displayed, Google's Advertising Privacy Policy applies. Stripe processes payment data under its own privacy policy — we receive only your subscription status, not your full payment details.
6. Payment and Billing Data
When you subscribe, Stripe collects and processes your payment information directly. We receive from Stripe: your Stripe customer ID, subscription status, and plan type. We do not receive or store your credit card number, CVV, or bank account details. Your billing history and payment methods are managed through the Stripe Billing Portal, accessible from within the app.
7. Data Retention
Cached transcripts (not linked to any user): retained indefinitely. Account data: retained until you delete your account. Deleted modules and groups: recoverable for 7 days, then permanently removed. Generated audio (TTS): cached for performance and automatically cleaned up when no longer accessed. Quiz questions and answers: retained while the associated module exists, deleted when the module is permanently removed. Question reports: retained for quality improvement and may be reviewed by our team. Analytics: aggregated and anonymized. Rate-limiting counters: expire after 24 hours. Ad reward counters: expire after 24 hours. Payment records: retained as required by tax and financial regulations.
8. Your Rights
You may request access to, correction of, or deletion of your personal data at any time by contacting admin@trainrun.io or through your account settings. EU/EEA users have additional rights under GDPR including data portability, the right to object to processing, and the right to withdraw consent. California users have rights under CCPA including the right to know and the right to delete. We will respond to verified requests within 30 days.
9. Children's Privacy
TrainRun is not directed at children under 13. We do not knowingly collect personal information from children under 13. If we learn that we have collected data from a child under 13, we will delete it promptly. Anonymous gameplay does not collect personal information. Rewarded ads are not shown to users under 13.
10. Data Security
We use industry-standard measures to protect your data including encrypted connections (TLS), access controls, and secure infrastructure providers. All payment processing occurs over encrypted channels directly between your browser and Stripe. No system is perfectly secure — we cannot guarantee absolute security.
11. International Data Transfers
Your data may be processed in the United States and other countries where our service providers operate. For EU/EEA users, data transfers to countries outside the EEA are protected by Standard Contractual Clauses or other approved transfer mechanisms maintained by our infrastructure providers (Supabase, Clerk, Stripe, OpenAI, Google).
12. Changes to This Policy
We may update this policy from time to time. Signed-in users will be asked to review and accept updated versions. The current version number and date are displayed at the top of this document.
13. Contact
For privacy inquiries or data deletion requests, contact us at admin@trainrun.io.