Privacy
Not a finished privacy notice. What follows describes accurately what Kolanova does with data, and is checked against the database schema. It is not legal drafting and has not been reviewed by a lawyer. Do not launch on it.
What Kolanova stores
Everything, with nothing left out. This list is kept in step with the database itself rather than written from memory.
A parent's email address, and either a password (stored hashed by Supabase) or a Google account identifier if they chose that sign-in.
- Why:
- So a parent can sign in and reach their own family, and nobody else's.
- Deleted:
- When the parent closes their account.
- Where:
- auth.users, managed by Supabase
Each child's nickname, whatever the parent typed, up to 20 characters.
- Why:
- So a child sees their own name rather than an initial when they sit down.
- Deleted:
- When the child is removed, or the parent closes their account.
- Where:
- student_profiles.nickname
A hash and salt of each child's four-digit PIN. The PIN itself is never stored, and the browser is never permitted to read either column.
- Why:
- So one sibling cannot open another's lessons.
- Deleted:
- With the child's profile.
- Where:
- student_profiles.pin_hash, student_profiles.pin_salt
Which grade a parent placed each child in.
- Why:
- It decides what a child is taught and tested on.
- Deleted:
- With the child's profile.
- Where:
- student_profiles.course_slug
Per topic: whether it is mastered, how many questions were answered, how many correctly, XP earned, and when it last changed.
- Why:
- So a child resumes where they left off and is never re-taught something they know.
- Deleted:
- With the child's profile.
- Where:
- topic_progress
The dates a child did a lesson. Dates only, not times.
- Why:
- The streak counter.
- Deleted:
- With the child's profile.
- Where:
- learning_days
When each mastered topic is next due for review.
- Why:
- Spaced repetition. Currently dormant: nothing in the app offers a review.
- Deleted:
- With the child's profile.
- Where:
- review_schedule
Who else holds it
- Supabase. Stores the database above, and handles parent sign-in.
- Vercel. Serves the site. Sees request data such as IP addresses, as any web host does.
- Google. Only if a parent chooses Sign in with Google, in which case Google confirms who they are.
Cookies
- Supabase auth cookies. Keeps a parent signed in. Without them every page would ask for a password again.
- kolanova_profile. Holds only which child is currently at the keyboard. It is worthless on its own: every read re-checks that the child belongs to the signed-in parent.
What Kolanova does not do
- No analytics, no tracking pixels, no advertising, and no third-party scripts of any kind.
- No leaderboards. One child's progress is never visible to another family, or to another child.
- No marketing email. The only email Kolanova sends is the one confirming a new account.
- Nothing is sold or shared with anyone for their own purposes.
Deleting everything
A parent can remove one child from the parent zone, or close the account entirely, which deletes every child and everything they have done. Neither needs an email to anyone, and neither can be undone.