Privacy Policy

This Privacy Policy explains what information celpora ("we", "us") collects when you use our website and services, and how we use it.

Information we collect

• Account information: your email address (and name, if you sign in with Google) when you create an account.
• Practice data: your answers, written responses, recordings, and scores, so we can give feedback and save your progress.
• Billing information: handled by our payment processor, Stripe. We do not store your card details.
• Usage data: basic, privacy-respecting analytics (page views, device type) to improve the product.

How we use it

• To provide practice tests, AI feedback, and saved progress.
• To process subscriptions and manage your account.
• To protect the service from abuse and to improve it.

Service providers

We share data only with providers that help us run the service: Supabase (authentication and database), Stripe (payments), Anthropic and OpenAI (AI grading and transcription of the responses you submit), and Cloudflare (bot protection). Each processes data on our behalf.

Advertising & measurement

We advertise celpora on platforms including Google Ads, Meta and OpenAI, and we measure which ads lead to sign-ups and subscriptions so that we do not waste money showing ads to the wrong people. To do this we use Google Tag Manager to send those platforms a record of the action you took, such as creating an account or starting a subscription.

So that a platform can match that action to an ad you were shown, we may also send your email address in hashed form. Hashing is one-way: it turns your address into a fixed string of characters that cannot be reversed back into your email. The hashing happens in your browser before anything is sent, so these advertising platforms never receive your email address in a readable form, and we never send them your name, your test answers, your scores or your progress.

If you would rather not be included in this measurement, most browsers and ad blockers can block these scripts, and you can also opt out of personalized advertising in your Google Ad Settings.

How we understand what is and is not working

We use PostHog to understand how people move through celpora: which pages they visit, where they get stuck, and where they give up. This is how we find out that, say, a practice set is confusing before dozens of people quietly abandon it. PostHog processes this data on our behalf and does not sell it.

This includes session recordings, which replay how a page was used: clicks, scrolling, and where the cursor went. What gets recorded depends on whether you are signed in.

When you are signed in, all text is masked before it is recorded, on every page, without exception. That means no recording of ours ever contains what you write in a practice task, the transcript of anything you say, the feedback you receive, the levels shown on your screen, or your email address. We mask everywhere rather than only on the obvious pages, because once you have an account your own numbers follow you around the site: your level and your day streak appear on the practice pages, not just on your dashboard. We see that you clicked a button and hesitated for ten seconds; we do not see what you wrote.

When you are not signed in, our public pages, such as the home page, the practice guides and the score calculators, are recorded as you saw them. Until you have an account, none of that exists: no work of yours, no feedback and no celpora scores. This is the only recording we find genuinely useful, because it tells us which parts of the site help someone decide that celpora is worth trying. Every other page, including practice tasks and mock tests, stays masked whether you are signed in or not.

Alongside recordings we log the events that make up a journey: an account was created, a practice set was opened, submitted and graded, a mock test was finished, a subscription was started. Being straight with you about one of them: because the entire point is to find out whether people actually improve, the "graded" event carries the level that set was graded at and which set it was, and the onboarding event carries the level you told us you are aiming for. So we do hold those numbers, and they are linked to your account through an internal id rather than your email address. What these events never carry is the substance: not a word of what you wrote, nothing you said, none of the feedback you were given, and never your email.

We do not show a cookie banner, so we would rather be plain about how to opt out than leave you to guess. We serve the PostHog script from our own domain and send its data back through our own domain, which means an ad blocker that works by blocking known analytics domains will usually not stop it. We do this so that our numbers are not quietly skewed towards the people who do not block anything, but it does mean a blocker alone is not a reliable way to opt out, and we are not going to pretend otherwise.

Two things do work. If your browser sends the Do Not Track signal, we honor it: PostHog is told to capture nothing at all about your visit, including session recordings. Or simply email us at support@celpora.com and ask to be excluded, and we will exclude you.

Data retention & your rights

We keep your data while your account is active. You can request access to or deletion of your data at any time by contacting us. Deleting your account removes your personal data, subject to legal retention requirements.

Contact

Questions about privacy? Email support@celpora.com.