Privacy Policy

learning-tracks · Last updated 8 October 2026

learning-tracks is run by Bluefox Software, a sole proprietorship in British Columbia, Canada ("we", "us"). This policy explains what personal information learning-tracks collects, why, who else handles it, how long we keep it and what you can ask of us. Questions go to privacy@bluefox.software.

What we collect

• Your account: your name, your email address and your password. The password is stored only as a one-way hash; nobody, including us, can read it.
• Your sessions: when you sign in, the IP address and the browser or device description (user agent) of that session. A session ends when you sign out, when you reset your password, after 30 days without use, or when you delete your account. The record of an ended session is kept until you delete your account.
• What you put in learning-tracks: the content you create in the app.
• Technical records: for each request to our servers, the page or address asked for, the time, the result, your IP address and your user agent, and the IP address a limit on repeated requests applies to. We use these only to run, secure and fix the service.
• Assistants you connect: if you let an AI assistant use learning-tracks for you, a record of that assistant and what you allowed it to do, until you revoke it, reset your password or delete your account. What the assistant reads (your name, your email address and the content its tools reach) goes to that assistant's provider, under its own terms.

What we do not do

No analytics, no advertising, no tracking pixels, and we never sell your information or share it for advertising. The website uses one cookie, the session cookie that keeps you signed in, and keeps your account's id in your browser's local storage; the home page and this page use neither. The iOS app keeps your session in the device's Keychain.

Why we use it

• To provide the service you signed up for (performing our agreement with you).
• To keep it secure and working, and to stop abuse (our legitimate interests).
• To send the emails the service needs, such as a password reset or the confirmation that your account was deleted. We send no marketing.
• To meet our legal obligations.

Who else handles it

We use these service providers, under contracts that limit them to processing on our behalf:

• OVHcloud: our servers and database, in Beauharnois, Quebec, Canada.
• Resend, a United States company: delivers our emails through its servers in Brazil, so it receives your email address and the message.
• Cloudflare: its R2 storage holds our database backups and technical records.
• Cloudflare R2 also stores the files you upload; your device sends and fetches them directly.
• Cloudflare Turnstile: when you create an account on the website, it checks that you are a person and not a bot. It sees your browser and IP address for that check.

Some of these providers process information outside Canada, including in the United States and Brazil, where it may be subject to those countries' laws.

How long we keep it

• Your account and content: until you delete them, or your account.
• Technical records: about 30 days.
• Database backups: about 14 days.

When you delete your account, it is removed from our live database at once, and your files within minutes. It survives only in backups and technical records until those expire as above. Automatic rules in our storage remove any backup or technical record a failure leaves behind: backups within 90 days, technical records within 120.

Your rights

You can ask to see, correct, export or delete your personal information, and to withdraw a consent you gave. You can delete your account yourself, at any time, in the app: Account → Delete account. For anything else, write to privacy@bluefox.software; we answer within 30 days.

If you are not satisfied with our answer, you can complain to the Office of the Information and Privacy Commissioner for British Columbia, the Office of the Privacy Commissioner of Canada, or, in the European Union or the United Kingdom, your local data protection authority.

Security

Information travels encrypted (HTTPS), passwords are hashed, and access to our systems is limited to what running the service needs. No system is perfectly secure; if a breach puts you at risk, we will tell you and the authorities as the law requires.

Children

learning-tracks is not intended for children under 16, and we do not knowingly collect their information.

Changes

We will post any change here with a new date. If a change matters to how we use your information, we will also tell you by email before it takes effect.