Clear notice for a focused learning tool.

This Privacy Policy applies to the LearnStack website and its Cloudflare Pages Functions. LearnStack lets users generate practice tests, submit answers, see correct answers or feedback, save missed questions, review session history, upload rubric images for analysis, use paid Pro or Teacher Mode features, and create temporary teacher share codes.

This policy does not apply to external websites or services that LearnStack links to or redirects to, including Stripe Checkout and OpenAI websites. Those services process information under their own privacy policies.

Account and profile information

• Email address. Collected when you create or update a local account, log in locally, request owner or premium entitlement checks, start Stripe Checkout, or use Teacher Mode sharing.
• Display name. Collected when you create or update a local account profile.
• Password hash. If you use a password, the current local account flow stores a hash of that password in browser localStorage. LearnStack does not send the password to its Cloudflare payment, entitlement, sharing, rubric, or AI endpoints.
• Guest status. If you continue as a guest, the app stores a guest profile with the email value guest@learnstack.local in that browser.

Practice and learning information

• Subjects, learning goals, current ability level, target domain, difficulty settings, question counts, question style settings, calculator-question settings, rubric settings, and extra information that you enter.
• Generated questions, answer choices, expected answers, explanations, references, thinking shortcuts, user answers, grading results, scores, correct-question IDs, missed-question IDs, and open questions.
• Session history, saved missed questions, completed test records, and retention or review schedules.
• Similar-problem regeneration state, including the original question, regenerated question, answer options, correct answer, explanation, calculator label, and whether the answer for that question was reset.

Rubric and upload information

• Rubric image files uploaded for analysis. The app accepts PNG, JPG, and WebP images up to 5 MB.
• File type, file size, file name, extracted rubric title, extracted rubric text, and extracted rubric criteria.
• Image content verification data used to confirm that the file content matches the declared image type.

Teacher sharing information

• Teacher share codes, creation time, expiration time, and revocation requests.
• Shared test subject, record ID, questions, correct answers, explanations, topics, and question types.
• Student answers, score, and shared-test completion record when a student submits a shared test. In the current site code, this completion record is saved in the student's browser session history.

Payment and entitlement information

• Email address sent to Stripe Checkout when provided.
• Stripe Checkout session ID, Stripe customer ID when returned for Pro checks, subscription mode, checkout status, payment status, plan metadata, and whether Pro or Teacher Mode is active.
• LearnStack does not collect or store full payment card numbers, card security codes, or bank account numbers.

Technical and security information

• IP address or proxy IP address from Cloudflare request headers, used for rate limiting, abuse prevention, security logging, and delivery of the site.
• Request method, request path, query parameters, request headers needed for CORS, content type, authorization checks, entitlement checks, and rate limiting, response status, and timestamps that may appear in Cloudflare logs.
• Hashed rate-limit identifiers derived from IP address and, when present, an authenticated user identifier or authorization header.
• Browser storage values used by the app, including learnstack_user_account, learnstack_tutorial_done, learnstack_completed_tests, learnstack_retention_schedule, learnstack_teacher_entitlement, learnstack_pro_entitlement, learnstack_exam_upgrades, learnstack_rubric_analysis, learnstack_question_regenerations, learnstack_question_reset_answers, learnstack_question_reset_pending, learnstack_local_share_codes, learnstack_force_practice_start, and learnstack_account_reminder_dismissed.

Information not collected by the current site code

• No advertising cookies or advertising pixels.
• No third-party marketing analytics scripts.
• No precise geolocation, contacts, camera recordings, microphone recordings, or device files other than rubric images you choose to upload.
• No full card numbers, card security codes, or bank account numbers.

• To generate practice tests and simulated exams from the subjects, settings, questions, answers, rubrics, and extra information you provide.
• To show correct answers, feedback, explanations, references, thinking shortcuts, scores, missed-question review items, and saved session history.
• To save practice progress, completed tests, missed questions, review schedules, account state, and premium state in browser storage.
• To operate Pro features, including calculator-question generation, rubric-guided simulated exams, and similar-problem regeneration.
• To operate Teacher Mode features, including shared test links, temporary share codes, and teacher editing controls.
• To create, verify, and manage Stripe Checkout sessions for Pro and Teacher Mode subscriptions.
• To verify owner access for configured owner email addresses.
• To validate requests, sanitize inputs, reject unsafe uploads, apply rate limits, prevent abuse, troubleshoot errors, enforce CORS, and apply security headers.
• To comply with applicable legal obligations and protect LearnStack, users, payment security, and the rights and safety of others.

LearnStack does not sell personal information and does not share personal information for targeted advertising.

OpenAI

LearnStack sends prompts, questions, answer choices, expected answers, user answers, learning settings, rubric text, and related learning content to OpenAI through LearnStack server functions when AI generation, grading, feedback, references, thinking shortcuts, similar-problem regeneration, or rubric analysis is requested. If you upload a rubric image, the image is converted to an image payload and sent to OpenAI for extraction. OpenAI returns generated content to LearnStack, and LearnStack returns that content to your browser.

Stripe

LearnStack sends checkout information to Stripe when you start Pro or Teacher Mode checkout. This may include email address, plan price ID, success URL, cancel URL, feature metadata, plan metadata, and client reference ID. Stripe processes payment details. LearnStack receives checkout session and payment status information needed to unlock paid features.

Cloudflare

LearnStack is hosted on Cloudflare Pages and uses Cloudflare Pages Functions. Cloudflare processes site requests, API requests, IP addresses, headers, timestamps, response status, and logs needed to deliver and secure the site. When Cloudflare KV is configured, Cloudflare KV stores temporary teacher share codes and rate-limit counters.

Teachers and students using share codes

When a teacher creates a share code, anyone with the active code can load the shared test subject, questions, correct answers, explanations, topics, and question types while the code remains valid. A student who submits answers through a shared test creates a completion record in that student's browser.

Legal and safety disclosures

LearnStack may disclose information if required by law, subpoena, court order, or valid government request, or if disclosure is reasonably necessary to protect the site, users, payment security, or the rights, property, or safety of others.

• Browser localStorage. Local account data, completed tests, missed questions, review schedules, premium state, rubric summaries, and similar-problem state remain in the browser until you delete the relevant item, sign out where the app clears the item, or clear browser storage.
• Browser sessionStorage. Local preview share codes, force-practice-start flags, and account-reminder dismissal state remain for the browser session or until the browser clears session storage.
• Teacher share codes. Server share codes are designed to expire after 15 minutes and are also revoked when the teacher closes the share panel. Local preview share codes exist only in sessionStorage.
• Rate-limit records. Rate-limit counters use a 60-second window. When Cloudflare KV is configured, each counter is written with an expiration of about 120 seconds.
• Rubric uploads. The server validates and forwards rubric images for analysis. LearnStack does not intentionally store the original rubric image after processing. Extracted rubric title, text, and criteria may be saved in browser localStorage.
• Payment records. Stripe retains checkout, subscription, and payment records under Stripe's own retention practices. LearnStack checks the session and status information needed to confirm access.
• Cloudflare logs. Cloudflare may retain request logs and security logs according to the Cloudflare account settings and Cloudflare's own retention practices.

• You may use LearnStack as a guest. Guest progress is tied to the browser where it was created.
• You may create or update a local account profile with an email address and display name.
• You may delete individual session history cards using the remove control in the session history interface.
• You may clear local browser data to remove local LearnStack storage from that device.
• You may choose not to upload rubric images if you do not want rubric images sent for AI analysis.
• You may choose not to create teacher share codes if you do not want shared test content stored temporarily and made available to code holders.
• You may contact LearnStack to request access, correction, or deletion of records that LearnStack can identify and control.

LearnStack uses HTTPS through Cloudflare, content security policy headers, security response headers, CORS controls, request validation, input sanitization, upload type and size checks, image magic-byte checks, payment verification through Stripe, server-side API keys, and rate limiting. Standard API endpoints are limited to 60 requests per minute. API paths beginning with /api/auth, if added, are limited to 5 requests per minute. Rate limits are applied by IP address and by user identifier when a user identifier is present.

No website can guarantee perfect security. Do not upload sensitive personal, medical, financial, confidential school, or confidential employer records unless you are authorized to do so.

LearnStack is designed for high school, early college, and similar learners. It is not directed to children under 13. Teachers, schools, parents, or guardians are responsible for obtaining any permissions required before asking students to use the site or shared test codes.

LearnStack may update this Privacy Policy as the product changes. The effective date above shows when the current version took effect. Material changes should be posted on this page before or when they take effect.

For privacy questions or requests, contact LearnStack at djoseb2007@gmail.com.