Privacy Policy

Who we are

MECH is a robotics learning app and website (mechlearn.app), operated from Texas, USA. This policy explains what we collect, why, who helps us process it, how long we keep it, and your choices. Questions or requests: support@mechlearn.app.

What we collect, and why

• Account: email, display name and username, and the basic profile Apple or Google share if you sign in with them (Apple may give us a private relay email). Used to create and secure your account.
• Profile photo (optional): a picture you choose to upload as your avatar. We only access the one photo you pick (or take); never your whole library. It is deleted with your account.
• Age range: whether you are under 13, 13–17 or 18+, stored on your device, plus any age range or parental-consent status the App Store provides. Used only to send under-13s to the parent consent flow and to follow age and consent laws. We don’t ask for your birthdate.
• Learning progress: lessons, answers and mistakes, XP, Elo, gems, hearts, streaks, quests and arena results. Used to run the app, save progress and personalize your path.
• Onboarding answers: the goals and challenges you pick at setup. Used to personalize lessons.
• Purchases: your plan (Basic or Pro), its renewal dates, trial dates, and transaction IDs from Stripe. Used to unlock what you paid for and prevent fraud. Whoever pays (you, a parent or a coach) gives their email and payment details to Stripe, and we keep a record that they agreed to the subscription terms.
• Teams: which team you joined, and for coaches, the team name and email. Used to run Team and League plans.
• Parent link: the private code you share. It shows only your first name (if added), streak, lessons completed, XP and rank.
• Messages you send us: feedback, support emails, and sponsor inquiries (business name, email and message).
• Usage analytics: which screens and features are used, app version and device type, tied to a random account ID (never your name or email). Used only to keep the app working and fix problems. No session recordings, no keystrokes, no ad tracking.
• Technical data: IP address and request logs, handled by our hosting and database providers for security and abuse prevention. Short-lived rate-limit counters keyed by IP are kept for under a day.

We don’t collect precise location, contacts, microphone data, or your device’s advertising ID, and we only use the camera or photo library when you choose a profile photo.

What we never do

• We don’t sell or rent personal information, and we don’t “share” it for targeted (cross-context behavioral) advertising.
• We don’t show ads based on your activity, and we don’t use ad networks or data brokers. MECH doesn’t track you across other companies’ apps or websites, so it never asks for Apple’s tracking permission.
• Sponsors (“Presented by”) and stores we link to receive no personal information about you.
• We don’t use teens’ data for marketing or to train AI models.

Who sees your data

• You. Other users can’t read your account data.
• Your coach, if you join a team with their code: your username, lessons completed, XP, rank and streak. They can remove you from the team.
• Your parent, if you share a parent link: the progress summary described above.
• Service providers who process data for us under contract and only for MECH, with protections at least as strong as ours:
  • Supabase: database, sign-in and storage (privacy)
  • Lovable and Cloudflare: website and server hosting
  • Apple: Sign in with Apple, App Store purchases and age signals (privacy)
  • Google: optional Google sign-in (privacy)
  • RevenueCat: manages App Store purchases; gets your account ID and purchase history, not your name or email (privacy)
  • Stripe: web payments (privacy)
  • PostHog: product analytics, configured without session recording or IP storage; on our website it runs cookieless (privacy)
• Legal reasons. If the law requires it, or to protect the safety and rights of users or MECH. If MECH is ever sold or merged, data may transfer with it under this policy, and we’d tell you first.

Cookies

• We don’t use advertising or tracking cookies, and we don’t sell or share your data for ads.
• Analytics on our website are cookieless: no analytics cookies or device identifiers are stored in your browser.
• We only store what the site needs to work, like keeping you signed in and remembering your settings.
• Payments on our website are handled by Stripe, which may set its own cookies to prevent fraud.

How long we keep it

• Account, progress, onboarding answers and team membership: while your account exists. Deleted within 30 days after you delete your account.
• Inactive accounts without an active subscription: we may delete accounts with no sign-in for 24 months, after an email warning when we have an email.
• Analytics events: up to 12 months, then deleted or aggregated so they can’t identify anyone.
• Feedback and support emails: up to 24 months.
• Sponsor inquiries: up to 24 months, or as long as the business relationship lasts.
• Purchase, tax and subscription-consent records: up to 7 years, as tax and consumer-protection laws require (these don’t include lesson activity).
• Security and rate-limit logs: under 1 day for our counters; hosting providers keep their own logs for short periods.
• Children under 13 with parental consent: the child’s account and progress are kept only while the account is active and deleted within 30 days after the parent or child deletes it or the parent withdraws consent. The parent’s consent record is deleted with the account.
• Under-13 pairing codes that were never used: no personal information; deleted within about 9 days of expiring.
• Data from a child under 13 collected without a parent’s consent: deleted as soon as we learn about it.

Teens, parents and children under 13

Children under 13 (COPPA notice): a child under 13 can’t create an account or give us personal information on their own. When a child enters an age under 13, the app collects nothing personal and shows a code for their parent. The parent opens mechlearn.app/parent/consent, reads our direct notice, enters their email and gives verifiable consent by paying with a card through Stripe. Only then do we create the child’s account.

• What we collect from the child: a username we generate (no real name), lesson answers and progress (XP, Elo, streak, rank, lessons done), the setup answers they chose (role, goal, daily minutes, challenges), and the technical data needed to keep them signed in. Children can’t upload a photo, edit their username, chat, post, send feedback, or follow links to Discord, sponsors or other sites.
• From the parent: email, the consent record (time, method, notice version) and payment through Stripe (we never see card numbers).
• How it’s used: only to provide MECH to the child (lessons, progress, rank, subscription, support, security). No advertising, no selling or renting, no analytics on children’s accounts, no profiling.
• Disclosure: only to the service providers that run MECH for us (Supabase, Lovable/Cloudflare, Stripe, and Apple if the App Store is used), under contract and only for that purpose, or where the law requires.
• Parent rights: a parent can review their child’s information, have it deleted, or withdraw consent and stop further collection at any time by emailing support@mechlearn.app from the email used for consent. We verify the request and act within 10 business days. Deleting the account also cancels the web subscription.
• Contact: MECH, Texas, USA, support@mechlearn.app.

If we learn that a child under 13 has an account without a parent’s consent (for example, from a parent, coach or app store signal), we delete it and its data.

Teens (13–17): we collect only what’s needed to provide the learning service you asked for and to keep it working and secure. We don’t use teens’ data for advertising, marketing or profiling. A teen’s parent or guardian can review, correct, download or delete their teen’s data, or stop further collection, by emailing support@mechlearn.app from any address; we verify the request before acting. In states where app stores share a parent’s consent status (like Texas), we respect it, including when a parent withdraws consent.

Your rights and choices

• Access and copy: see your data in the app or ask us for a copy.
• Correct: edit your profile in the app or ask us.
• Delete: Profile → Delete Account removes your account and data, or email us. Deleting your account also cancels any MECH subscription on it.
• Notifications: turn off reminders in your device settings.
• State privacy rights: depending on where you live (for example Texas, California, Colorado, Virginia, Connecticut or New York), you may have rights to know, access, correct, delete and port your data, to opt out of sale, targeted advertising and profiling (we do none of these), and to not be treated differently for using your rights. You can appeal a decision by replying to our answer; if you disagree with the appeal, you may contact your state attorney general.

Email support@mechlearn.app from your account email (or as a parent or authorized agent, with enough detail for us to verify). We answer within 45 days and won’t charge you.

Security

Data travels over encrypted HTTPS (TLS) and is stored encrypted at rest (AES-256). Database access rules let each user reach only their own records, secret keys stay on our servers, and purchases are verified with Apple, RevenueCat or Stripe on our servers. Payment card numbers never reach us. No system is perfect; if a breach ever affects your personal information, we will notify you and the authorities as the law requires (in Texas, within 60 days).

Changes

We’ll update the effective date when this policy changes. For material changes we’ll notify you in the app or by email before they take effect, and ask for consent again where the law requires.

Contact

Privacy questions or requests: support@mechlearn.app.