Privacy Policy

Effective Date: August 25, 2026

Learning Whistle is operated by Learning Whistle LLC, an Ohio limited liability company (“we,” “us,” or “our”). We are committed to protecting your privacy. This Privacy Policy explains what information we collect, how we use it, and your rights in relation to it. By using the Platform you agree to the practices described here.

1. Information We Collect

1.1 Account Data

When you sign in with Google via Firebase Authentication, we receive your Google display name, email address, and Google profile photo URL. We store only your email address from Google. Your Google display name and profile photo are not stored. During onboarding you choose a separate public display name (your in-platform identity); this name is entirely your own choice and is not derived from your Google account. We also store a unique identifier (Firebase UID) that links your account data within our systems.

1.2 Usage and Learning Data

We collect data about how you use the Platform, including the learning paths you generate, stations you complete, quiz results, Miles earned, your Reading Level setting, category heatmap data, and your equipped avatar. Note that the topics you enter and the resulting learning path content are published publicly for Standard paths, without any attribution to you, as described in Section 5; your quiz results, Miles, Reading Level, and heatmap data are never published.

1.3 Payment Data

Gold Ticket and Season Ticket purchases are handled by Stripe, Inc. as merchant of record (through its affiliate Sold through Link, LLC, which is the name you will see at checkout and on your card statement). Stripe takes the payment, issues your receipt, and handles any sales tax, VAT or GST that applies where you live. It therefore decides how it handles the payment data you give it, as an independent controller of that data, under Stripe’s own privacy policy— not on our instructions. We do not store your full payment card number, CVV, or bank details. We receive from Stripe a transaction record and your Gold Ticket balance is updated in our database accordingly.

1.4 Technical Data

We may collect technical data such as your browser type, device type, operating system, IP address, and general geographic region. We also collect your local timezone (via your browser) at sign-in; this is used solely to determine the local time for time-sensitive collectible awards and is never shared with third parties. Technical data is used for security, abuse prevention, and improving Platform performance.

2. How We Use Your Information

We use the information we collect to:

Provide, operate, and improve the Platform;
Personalise AI-generated learning paths to your Reading Level setting and interests;
Publish completed Standard learning paths to our public catalogue, without any attribution to you;
Calculate and display your Miles balance, rank, and category heatmap;
Process Gold Ticket purchases and maintain your balance;
Send important account and service communications;
Detect and prevent fraud, abuse, or violations of our Terms of Service;
Comply with legal obligations;
Analyse aggregated, anonymised usage trends to improve the Platform.

2.1 Email We Send You

We send two kinds of email, and they are governed differently.

Service email relates to your account and to things you asked us for: your welcome message, confirmation of a Gold Ticket or Season Ticket purchase and what you were charged, notice of a renewal or cancellation, confirmation that a refund was issued, confirmation that a learning path you requested is ready, notice that a Gold Ticket generation failed and your tickets were returned, and replies to reports you send us. We send these under Article 6(1)(b) (contract) — they are how we tell you what happened to something you did, and several of them are required by law or by our Terms of Service.

Opt-in email is everything else. Today that is the Announcements list, which is off unless you turn it on and which we use to remind you about a learning path you started and have not finished, and a separate opt-in for status updates about a complimentary Season Ticket. Every opt-in email carries a one-click unsubscribe link that needs no sign-in. Unsubscribing takes effect immediately, including cancelling any message already scheduled to you, and you can change the setting at any time in Profile › Settings. We do not sell or rent your email address, and we do not send third-party advertising by email.

If you mark our email as spam, or your address repeatedly bounces, we stop sending you email of any kind — including service email. To enforce that we store a one-way, non-reversible fingerprint of the address, never the address itself.

3. Cookies and Similar Technologies

We use two strictly necessary cookies: __session (Firebase Authentication, maintains your login state — cannot be disabled without preventing sign-in) and lw_loading_screen (stores your equipped loading-screen animation preference). Neither is used for tracking. We do not use tracking, advertising, or third-party profiling cookies.

4. Analytics Providers

We use Google Analytics and Firebase Analytics to understand how users interact with the Platform. These services may collect anonymised usage data including page views, session duration, and feature engagement. Google’s data processing terms apply to these services. We do not use analytics data to build individual user profiles for advertising purposes.

5. How We Share Your Information

We do not sell, rent, or trade your personal data to third parties. We share data only in the following limited circumstances:

Public publication of completed learning paths: When a Standard learning path finishes generating, it is published automatically to the public Departures catalogue, where it can be read by anyone and indexed by search engines. Published Standard paths are never attributed to you — they do not carry your name, display name, email address, avatar, or Google profile photo — and they do not include your quiz results, Miles, Reading Level, or other account data. Only the learning topic and the AI-generated educational content are published. Gold Ticket paths are not published unless you choose to share them; a shared Gold Ticket path does display your chosen public display name, crediting you as its creator (never your real name, email address, or Google profile photo). Deleting your account does not unpublish paths already in the catalogue. See Terms of Service Section 5.7, which also explains how to request removal of a published path.
Service providers: Google (Firebase, Cloud Run, Gemini, Analytics). These providers act as data processors under appropriate agreements — they handle data only on our instructions.
Stripe: Stripe is not one of those processors. Because it sells Gold Tickets and Season Tickets to you as merchant of record (see Section 1.3), it is an independent controller of the payment data you give it and handles that data under its own privacy policy rather than on our instructions.
Legal requirements: If required by law, court order, or to protect the rights, property, or safety of Learning Whistle, our users, or others.
Business transfers: In the event of a merger, acquisition, or sale of assets, user data may be transferred as part of that transaction. We will notify you via email or an in-app notice before your data becomes subject to a different privacy policy.

6. Data Retention

We retain your account data for as long as your account is active or as needed to provide the Platform. If you request deletion of your account (see Sections 8 and 9), we will delete or anonymise your personal data within 30 days, except where we are required by law to retain it longer. Aggregated, anonymised analytics data may be retained indefinitely.

6.1 Record of Email Sent

We keep a dated record of every email decision we make: what was sent, to which list, under what subject line, and whether you were opted in at that moment — and, equally, every time we decided not to send because you had unsubscribed or asked us to stop. The record identifies the address only by a one-way fingerprint, never in readable form.

This exists so that a question about consent is answered by the record rather than from memory. We keep each entry for three years. If you delete your account we remove your account identifier from these entries, leaving a record that shows an email decision was made and honoured but that no longer points to you. We do not delete the entries themselves — deleting the record of a refusal would destroy the proof that we honoured it.

7. Children and Young People

7.1 Nobody under 13

The Platform is not directed to children under 13 years of age. We include a mandatory age gate during onboarding. If a user indicates they are under 13, their Firebase Authentication token is revoked immediately server-side using the Firebase Admin SDK, and no personal data is written to our database.

If you tell us that someone under 13 has an account, we will close it and delete everything on it within 7 days, and we will email you to confirm it is done. You do not need to prove you are their parent, and we will not ask you to. Contact us at learn@learningwhistle.com.

7.2 Users aged 13 to 17

Learning Whistle is used by people aged 13 and up, which means some of our users are under 18. In the United Kingdom, the Information Commissioner’s Children’s Code treats everyone under 18 as a child, and we apply its data-minimisation and privacy-by-default expectations to those users: we collect only what the Platform needs to work, we do not profile users for advertising, we run no third-party ad networks, and public surfaces never display your real name or Google profile photo.

Terms of Service Section 2 explains who can agree to our Terms, and requires a parent or guardian to agree on behalf of anyone under 18.

8. EU & UK Privacy Rights (GDPR / UK GDPR)

If you are in the European Economic Area (EEA), the United Kingdom, or Switzerland, the following applies to you. For the purposes of the GDPR and UK GDPR, the data controller is Learning Whistle LLC, an Ohio limited liability company (United States), reachable at learn@learningwhistle.com.

8.1 Legal Bases for Processing

We rely on the following legal bases under Article 6 of the GDPR:

Contract (Art. 6(1)(b)): operating your account, generating the learning paths you request (including sending the topics you enter to our AI provider to produce your path), publishing completed Standard learning paths to the public catalogue on an unattributed basis as described in Section 5, tracking your progress and Miles, and processing Gold Ticket purchases.
Consent (Art. 6(1)(a)): optional analytics and our opt-in email lists (see Section 2.1). You may withdraw consent at any time; withdrawal does not affect processing carried out before you withdrew.
Legitimate interests (Art. 6(1)(f)): security, fraud and abuse prevention, and maintaining and improving Platform performance. We balance these interests against your rights.
Legal obligation (Art. 6(1)(c)): retaining anonymised financial and transaction records where required by tax and accounting law.

8.2 International Data Transfers

Learning Whistle is operated using infrastructure located in the United States (Google Cloud and Firestore), so your personal data is transferred to and processed in the US. Where we transfer personal data out of the EEA or UK, that transfer is covered by the EU-US Data Privacy Framework and, where applicable, the European Commission’s Standard Contractual Clauses and the UK International Data Transfer Addendum, as incorporated into our providers’ data processing agreements. You may request a copy of the relevant safeguards by emailing us.

8.3 Your Rights

You have the right to:

Access — obtain a copy of the personal data we hold about you. You can download your data at any time from your profile settings.
Rectification — correct inaccurate or incomplete data.
Erasure — delete your account and personal data (see Section 9); we complete this within 30 days.
Restriction — ask us to limit processing in certain circumstances.
Portability — receive your data in a structured, commonly used, machine-readable format (our data download provides JSON).
Objection — object to processing based on our legitimate interests.
Withdraw consent — for any processing based on consent, at any time.

To exercise any of these rights, email learn@learningwhistle.com. We respond within one month. You also have the right to lodge a complaint with your local supervisory authority — in the UK, the Information Commissioner’s Office (ICO); in the EEA, your national data protection authority.

9. California Privacy Rights (CCPA)

If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA):

Right to Know: You may request details about the categories and specific pieces of personal information we have collected about you.
Right to Delete: You may request deletion of your personal information, subject to certain exceptions.
Right to Non-Discrimination: We will not discriminate against you for exercising your CCPA rights.
Do Not Sell: We do not sell personal information.

To exercise these rights, email us at learn@learningwhistle.com. We will verify your identity and respond within 45 days.

10. Security

We implement reasonable technical and organisational measures to protect your information, including the use of HTTPS, Firebase Authentication (Google OAuth), server-side session management, and access controls. However, no method of transmission over the internet is 100% secure, and we cannot guarantee absolute security. You are responsible for keeping your Google account credentials safe.

11. Third-Party Links and Affiliate Content

The Platform may display affiliate links to Amazon (via Amazon OneLink). Clicking these links will take you to third-party websites that have their own privacy policies. We are not responsible for the privacy practices or content of these third-party sites. We do not track your purchases on third-party sites beyond the commission event reported by the affiliate network.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we make a material change — one that meaningfully affects your rights or how your data is handled — we will tell you at least 30 days before it takes effect, by email to the address on your account and by a notice in the app. This matches the commitment in Terms of Service Section 15.2; this page previously said we “may” send an email, which promised less than our Terms already bind us to. Changes that do not affect your rights — fixing a typo, updating our contact details — take effect when we post them, with the Effective Date at the top updated. Your continued use of the Platform after a change takes effect constitutes acceptance of the updated policy.

13. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact us:

Email: learn@learningwhistle.com
Website: LearningWhistle.com

We will respond to all privacy-related requests within 30 days.