Placeholder — final Privacy Policy copy is drafted by counsel, not generated here. Key facts counsel should reflect: no student data of any kind is collected; personal data is never sold or shared with third parties; on cancellation, access is revoked immediately and data is retained for a 90-day grace period before permanent deletion; on account deletion, personal library data is deleted while minimal billing records are retained as legally required; hosting is US-based with Standard Contractual Clauses for EU users. Subprocessors: Stripe (payments), Supabase (auth/database), Postmark (transactional email), an S3-compatible object store (file storage), Sentry (error monitoring), and — only once a visitor explicitly accepts via the cookie banner, never before — Microsoft Clarity (behavior analytics: session recordings, heatmaps, click/scroll tracking). Declining the banner means Clarity never loads for that visitor. Clarity's masking is set to its strictest mode, and specific free-text fields (song comments, game/teaching instructions) are additionally excluded from recording at the code level regardless of that setting.