Privacy Policy

Last updated: September 3, 2026

1. Scope and Our Role

Profound Academy, Inc. ("Profound Academy," "we," "us," or "our") operates profound.academy and its learning, course-building, assessment, community, and AI features (collectively, the "Service"). This Privacy Policy explains what information we process, why we process it, and the choices available to you. Our Terms and Conditions also govern use of the Service.

For people who use the Service directly, Profound Academy generally determines why and how personal information is processed. When a school, university, employer, course creator, or other organization provides access to a managed course, that organization may control some student or member information and Profound Academy may process it on the organization's behalf. Questions about an organization's course rules, grades, or records should first be directed to that organization.

2. Information We Collect

The information we collect depends on how you use the Service.

Account and Authentication Information

We may process:

  • Your Firebase user ID, name or display name, email address, profile image, email-verification status, sign-in provider, and authentication metadata.
  • A phone number or other profile information if an authentication provider supplies it.
  • Information received when you sign in with Google, Facebook, or Microsoft, according to the permissions you grant that provider.
  • Authentication tokens, security cookies, user-agent information, and IP addresses used to keep you signed in, prevent abuse, and secure your account.

Firebase Authentication handles passwords used for email sign-in. We do not receive or store your plaintext password.

Learning, Course, and Community Information

We process information created through the educational features of the Service, including:

  • Course enrollments, invitations, groups, instructors, assignments, deadlines, course settings, and participation records.
  • Courses, exercises, editorials, tests, rubrics, templates, generated images, uploaded files, and version or edit history.
  • Code drafts, answers, runs, submissions, test outputs, grades, scores, progress, rankings, activity streaks, badges, and usage history.
  • Forum posts, private questions, replies, votes, reports, moderation status, and associated profile information.
  • Notifications and email preferences.

Course instructors or organizations may provide us with student email addresses, group membership, assignment information, or other course records when inviting and managing learners.

Coding Activity, Assessments, and Academic-Integrity Information

When you work on an exercise, the Service may save your code and work history, including code snapshots and changes, the active file, selection positions, run and submission results, and timestamps. It also records when an exercise is opened, when the browser tab becomes hidden or visible, and when the page is closed. Large changes may be analyzed as possible pasted content. A course may disable pasting or require Safe Exam Browser.

If enabled for a course, we may compare submissions, create code embeddings, and use automated systems to evaluate possible plagiarism or AI-assisted work. These systems may generate similarity results, a probability, an explanation, and an academic-integrity status. An automated result can change a submission's status or score, but course instructors can review and override it. Contact your instructor and, if necessary, us if you want a result reviewed.

AI Information

When you use AI course-building, tutoring, grading, moderation, image-generation, or integrity features, we process the information needed to provide them. This may include:

  • Your prompts, messages, feedback, and AI responses.
  • Relevant course materials, exercise text, rubrics, tests, code, code history, submissions, forum posts, and prior conversation context.
  • Tool actions and changes made to course content at your request.
  • Conversation and message IDs, user ID, course and exercise IDs, model choice, token usage, and diagnostic metadata.

AI conversations may be stored in your account. Student AI-assistant conversations and related code may also be visible to instructors for the applicable course. Do not include sensitive, confidential, or unnecessary personal information in prompts, code, course content, uploads, or forum posts.

Payments and Purchases

Stripe collects payment-card and billing details directly when you buy a subscription or top-up credits. We receive transaction and account information such as Stripe customer, checkout, subscription, invoice, payment-intent, price, status, tax, and credit-balance records. We do not store complete payment-card numbers.

Communications and Feedback

We process messages you send to us, support requests, and feedback submitted through the Service. Feedback sent through the in-app form is handled through PostHog and may include your name and email when you are signed in. We also process email delivery and preference information for account notices, course invitations, assignment calendar invitations, onboarding messages, progress summaries, streak reminders, and announcements.

Device, Log, and Analytics Information

We and our providers automatically process information such as your IP address, browser and operating system, device or cookie identifiers, referring and visited URLs, page views, clicks, feature use, timestamps, performance measurements, and error or diagnostic information.

In production, we use PostHog for product analytics, heatmaps, error and performance monitoring, and session replay. Session replay records changes to the webpage and your interactions with it. It may capture displayed page content and text entered into non-password fields. Password inputs are configured to be masked. We associate analytics with your account ID and may also provide your name, email, verification status, and sign-in provider after you sign in.

3. How We Obtain Information

We obtain information:

  • Directly from you when you create an account, create or join a course, complete work, upload content, use AI, make a purchase, change preferences, or contact us.
  • From authentication providers such as Google, Facebook, and Microsoft.
  • From course instructors, schools, employers, or other organizations that invite or manage you.
  • Automatically from your browser, device, cookies, local storage, and use of the Service.
  • From service providers involved in authentication, payments, hosting, email, analytics, search, AI, and security.

4. How We Use Information

We use information to:

  • Provide accounts, courses, exercises, forums, assignments, grading, progress tracking, rankings, notifications, and other Service features.
  • Save and synchronize work, maintain edit history, process uploads, and make content available according to course settings.
  • Provide AI-generated content, tutoring, grading, moderation, search, and academic-integrity analysis.
  • Process purchases, administer subscriptions and credits, calculate tax, prevent fraud, and maintain transaction records.
  • Send service, course, assignment, security, onboarding, progress, reminder, and announcement communications.
  • Provide support and respond to requests.
  • Analyze use, diagnose errors, improve usability and performance, develop features, and understand whether the Service works as intended.
  • Protect users and the Service, enforce our Terms, investigate abuse or academic-integrity concerns, and comply with law.

Where applicable, our legal bases include performing our contract with you, our legitimate interests in operating and securing the Service, complying with legal obligations, and your consent. You may withdraw consent where processing is based on consent, without affecting earlier processing.

5. How Information Is Shared

Other Users and Course Administrators

Your display name, profile image, and basic profile information may be visible to other signed-in users. Depending on course settings and your actions:

  • Course instructors and editors can access participant records, progress, assignments, code drafts and history, submissions, test results, private questions, AI-assistant conversations, and integrity reports for their courses.
  • Submission results, including profile details, score, language, status, and time or memory results, may be visible to signed-in users. Submitted code and detailed results may be visible to instructors and, when enabled, learners who have solved the exercise.
  • Progress and rankings may be visible to course participants when public rankings are enabled.
  • Approved public forum posts and replies are visible to signed-in users. Private questions are limited to the author, relevant instructors, and participants in that thread as applicable.
  • Public courses can be viewed by anyone; unlisted courses can be viewed by people with the link; private courses are intended for invited users and course staff.

Profile pictures and files uploaded into course content are served from cloud storage and may be retrievable by anyone who has the file URL, even when the surrounding course is private. Do not upload confidential information or personal information that should not be accessible in this way.

Service Providers

We disclose information to providers only as reasonably needed for their services. Current categories and providers include:

  • Google Cloud and Firebase for authentication, databases, cloud functions, and file storage.
  • Google, Meta (Facebook), and Microsoft when you choose one of their sign-in methods.
  • Google Gemini and OpenAI for generative AI, grading, moderation, image generation, and academic-integrity analysis. They may receive prompts, responses, course context, code, submissions, or forum content needed for a request.
  • PostHog for analytics, session replay, product feedback, error monitoring, and AI telemetry.
  • Stripe for checkout, subscriptions, top-up payments, tax calculation, and billing management.
  • Resend for transactional and optional email delivery.
  • Algolia for user and public-exercise search.
  • Amazon Web Services for private test assets and assessment infrastructure.
  • Vercel and other infrastructure providers for hosting, content delivery, logging, and application operations.

These providers process information under their own terms, privacy notices, and our applicable agreements with them. AI-provider retention and use can depend on the service and account configuration used for a request.

Legal, Safety, and Business Transfers

We may disclose information when we reasonably believe it is necessary to comply with law or valid legal process; protect the rights, safety, and security of Profound Academy, our users, or others; investigate fraud or abuse; or enforce agreements. Information may also be transferred as part of a merger, financing, acquisition, reorganization, bankruptcy, or sale of all or part of our business, subject to appropriate protections.

We may disclose information at your direction or with your consent. We may also use and disclose aggregated or de-identified information that cannot reasonably identify you.

6. Cookies, Local Storage, and Tracking Choices

We use cookies and browser storage for authentication, security, Firebase session persistence, locale and editor preferences, analytics, and session replay. Our signed authentication cookie can remain valid for up to 12 days. Other technologies may remain for different periods based on their purpose and configuration.

You can block or delete cookies through your browser. Doing so may sign you out, reset preferences, or prevent parts of the Service from working. Browsers do not apply a uniform "Do Not Track" standard, and we do not currently respond to Do Not Track signals. We do not use the Service to serve targeted advertising.

We do not sell personal information or share it for cross-context behavioral advertising as those terms are defined under California law. Because we do not engage in those practices, a Global Privacy Control signal does not change how the Service operates. Third parties may collect information as described in this Policy when they provide analytics, authentication, embedded content, or other Service functionality.

7. Email Choices

You can manage onboarding, weekly-progress, announcement, and streak-reminder emails from your account preferences or use an unsubscribe link where provided. You may still receive necessary security, authentication, billing, assignment, course-invitation, or other service communications.

8. Retention

We retain personal information for as long as reasonably necessary to provide the Service and for the purposes described in this Policy. Retention depends on the type of information, whether your account or course remains active, course and organization requirements, the need to preserve academic records or shared content, provider settings, and legal, security, tax, accounting, dispute-resolution, and enforcement obligations.

Deleting an account or leaving a course does not necessarily remove information already shared with course administrators or other users, incorporated into course records, retained in edit history, or required for legitimate recordkeeping. We may retain de-identified information and information in backups until those backups are overwritten in the ordinary course.

To request account or personal-information deletion, email contact@profound.academy. We may need to verify your identity and may retain or restrict certain information where permitted by law.

9. International Transfers

Profound Academy is a United States company, and many of our providers operate in the United States and other countries. Your information may therefore be stored or processed in jurisdictions with different data-protection laws. Where required, we rely on recognized transfer mechanisms or other appropriate safeguards.

10. Security

We use reasonable administrative, technical, and organizational measures designed to protect personal information. No Internet transmission or storage system is completely secure, so we cannot guarantee absolute security. You are responsible for protecting your account credentials and for using appropriate course visibility and sharing settings.

11. Your Privacy Rights

Depending on where you live, you may have the right to request access to, correction of, deletion of, or a portable copy of your personal information; object to or restrict certain processing; withdraw consent; or appeal a denied request. You may also have the right not to receive discriminatory treatment for exercising a privacy right.

Residents of California may request the categories and specific pieces of personal information we collected, the sources and purposes of collection, and the categories of recipients to whom information was disclosed. The categories collected and disclosed for business purposes are described in Sections 2 through 5. We do not use or disclose sensitive personal information to infer characteristics about you.

For purposes of California's notice-at-collection requirements, the categories we have collected in the preceding 12 months may include identifiers and customer records; commercial and transaction information; Internet or other electronic-network activity; electronic or visual information such as profile images, uploads, and session replay; education or professional information reflected in courses; the contents of communications sent through the Service; sensitive account-login information; and inferences such as progress, moderation, similarity, and academic-integrity results. We collect these categories from the sources in Section 3, use them for the purposes in Section 4, and disclose them for business purposes to the recipients in Section 5. We retain them using the criteria in Section 8.

Residents of the European Economic Area, United Kingdom, or Switzerland may also complain to their local data-protection authority. If an organization controls the relevant course information, we may direct your request to that organization or assist it in responding.

To exercise a privacy right, email contact@profound.academy. Describe your request and the account or email address involved. We may verify your identity or authority before responding. Rights are subject to applicable exceptions.

12. Children and Students

The Service is designed for education, including use by secondary schools, but it is not directed to children under 13. A child under 13 must not create or use an account independently. Such use must be arranged by a parent, guardian, or authorized educational institution and must have any consent required by applicable law.

When a school authorizes use for a child, the school may act as the parent's agent only in the educational context and is responsible for providing notices and obtaining any required permissions. Schools using the Service with children under 13 should contact us before student use and configure courses to avoid unnecessary public sharing.

If you believe we collected personal information from a child without legally valid authorization, contact us so we can investigate and take appropriate action. A parent or guardian may also contact us to review or request deletion of a child's information, subject to school recordkeeping requirements and applicable law.

13. Third-Party Sites and Embedded Content

Course creators may include links, files, iframes, or embedded content such as YouTube videos. Loading or visiting third-party content can disclose your IP address, device information, and cookies to that third party. Their privacy practices, not this Policy, govern their independent processing.

14. Changes to This Policy

We may update this Privacy Policy to reflect changes to the Service, our providers, or legal requirements. We will post the updated Policy here and change the "Last updated" date. If changes are material, we may provide additional notice through the Service or by email when appropriate.

15. Contact Us

For privacy questions or requests, contact:

Profound Academy, Inc., 16192 Coastal Highway, Lewes, Delaware 19958, United States

contact@profound.academy