Privacy Policy

Overview

Protégé is a learning product that helps you teach concepts out loud while an AI Protégé extracts claims, finds gaps, and builds a personal knowledge ledger. Because you share voice, text, and sometimes code, we treat your data as sensitive and design retention and controls around that.

Information we collect

Account information from Google sign-in (such as email, name, and profile identifier) when you use OAuth.
Teaching sessions: messages, transcripts, extracted claims, ledger updates, session metadata, and optional code or notes you enter in the workspace.
Voice input when you use speech features — processed for transcription; raw audio is not kept by default (see Retention).
Technical data: device/browser type, IP address, and product analytics events needed to operate and improve the service.
Session replay data only when enabled — with masking for editor and message content as described below.

How we use information

Provide teaching sessions, gap detection, ledger projection, and account features you request.
Run AI models (via our gateway) to respond, judge understanding, and extract ledger updates.
Secure the service, prevent abuse, and debug operational issues.
Measure product usage in aggregate when analytics are enabled.
Comply with law and enforce our Terms of Service.

We do not sell your personal information. We share data only with service providers that help us run Protégé, under contracts appropriate to their role:

Google — OAuth sign-in.
Cloud hosting and database providers (for example Cloudflare and Postgres-compatible hosts) — application and data storage.
AI model providers (such as OpenAI and Anthropic) — inference for teaching and extraction; configured for API/business use without training on your content where the provider offers that posture.
PostHog — product analytics and optional session replay with client-side masking on sensitive UI.

Retention

Live session buffers: discarded shortly after a session ends (operational data, not a long-term archive).
Transcripts and session events: kept until you delete the session or your account, unless you choose a shorter retention window when that setting is available.
Raw audio: not stored by default after transcription. Optional debug retention, when offered, is opt-in and time-limited.
Ledger entries: kept as your learning record until you delete them or your account; deleting source sessions does not automatically remove every derived ledger entry — you may remove entries manually.
Account deletion: initiates a soft-delete with a recovery window, then permanent deletion of profile, sessions, ledger, and related artifacts when the hard-delete job runs.

Your choices

Export your data from Settings as a JSON archive (profile, sessions, ledger, and related records).
Delete individual sessions or your entire account from Settings.
Disable session replay for a session or by default in Settings when that control is available.
Sign out and revoke Google access from your Google account security settings.

Security

Artifacts such as audio exports are served via short-lived signed URLs, not public buckets. We use HTTPS, authenticated access to your sessions and ledger, and server-side validation for writes. No system is perfectly secure; report concerns using the process in our security policy on GitHub.

Children

Protégé is not directed at children under 13 (or the minimum age in your jurisdiction). We do not knowingly collect personal information from children. Contact us if you believe a child has provided data.

Changes

We may update this policy. We will post the new version with an updated date. Continued use after changes means you accept the revised policy. Material changes may be communicated in-product or by email where appropriate.

Contact

Questions about privacy or data requests:

castleridgelabs@gmail.com