Effective October 14, 2026
This policy explains what personal data Tubeglow collects, why, who processes it and what rights you have. Contact: use our contact form.
What we collect
- Account data: your email address, a hashed password if you set one, and sign-in timestamps.
- Learning data: lessons you mark complete, clean takes you log (exercise and tempo), the practice plan you follow and the sessions you tick off, and which lessons you open (first and last time, and how often).
- Purchase data: whether you bought full access, the Stripe checkout and payment references, the amount and currency, and a record of your checkout consent to immediate access and the loss of the right of withdrawal (time, language and policy version), stored with the Stripe checkout. We never see or store your card details; Stripe handles them.
- Technical data: IP address and request logs kept by our hosting and authentication providers for security and troubleshooting.
- Messages you send us through the contact form (your name, email address and message) or by email. Contact-form messages are delivered to our inbox by email and aren't stored in our database.
We don't use analytics, advertising or tracking tools, and we don't sell or share your data for advertising.
Why we use it
- To provide the course: sign-in, saving your progress, unlocking paid lessons, and showing your recently viewed lessons so you can pick up where you left off (performing our contract with you).
- To process payments and meet tax and accounting obligations (contract and legal obligation).
- To keep the service secure and fix problems (legitimate interest).
- To send account emails such as sign-in links and password resets, and a purchase confirmation that also records your withdrawal waiver (contract and legal obligation). We don't send marketing emails.
- To answer messages you send us (legitimate interest).
Who processes it
We use these service providers. Each processes data only to provide its service to us:
- Supabase: authentication and database.
- Stripe: payments, as merchant of record via Stripe Managed Payments. Stripe is an independent controller for the payment data it collects; see Stripe's privacy policy.
- Microsoft Azure: hosting.
- Resend: sending account and purchase emails, and delivering contact-form messages to us.
Our providers may process your data in countries other than your own, including the United States, under safeguards such as the EU Standard Contractual Clauses or adequacy decisions.
Cookies
We only use cookies needed for the site to work:
- Supabase session cookies (
sb-…): keep you signed in. lang: remembers your language.tz: your time zone, so practice streaks count days correctly.
No analytics, advertising or third-party tracking cookies. Stripe sets its own cookies on its checkout page.
How long we keep it
We keep your account and learning data until you delete your account. Deleting it removes your account, progress, lesson view history, takes, practice plans and purchase record from our database right away. Server logs kept by our providers expire on their own schedules, typically within 30 days. Stripe keeps payment records for as long as tax and financial laws require.
Your rights
Depending on where you live (for example under the EU and UK GDPR or other national and state privacy laws), you can:
- Access and export your data: use "Export my data" on your account page to download everything we store about you as JSON.
- Delete your data: use "Delete account" on your account page. Deletion is immediate and can't be undone.
- Correct your data: change your password on your account page, or email us to change anything else.
- Object, restrict processing or withdraw consent, and complain to your local data protection authority.
For any request, write to us through the contact form. We'll answer within 30 days.
Children
Tubeglow isn't directed at children under 16. If you're under the age of digital consent where you live, ask a parent or guardian before creating an account.
Security
Data travels over HTTPS. Learning and purchase data sits in a private database schema that only our server can reach. No system is perfectly secure; if a breach affects your data, we'll notify you and the relevant authorities as the law requires.
Changes
If we change this policy materially, we'll tell you by email or on the site before the change takes effect.