Privacy

Who we are

Coursium is a mobile learning app operated by Deca Limited ("we", "us"). This policy covers the Coursium app on iOS and Android and this website, www.coursium.ai. If you want anything on this page explained, or acted on, write to us at the address at the bottom.

What we collect

Only what the app needs to keep your place in a course, run a subscription, and tell which lessons work. In practice that is:

• Account details. If you sign in, the email address returned by Sign in with Apple or Google. Apple lets you hide your real address, in which case we only ever see the relay address Apple generates.
• The name you put on a certificate. You choose it, and it is the name that appears on the certificate itself.
• Learning activity. Which lessons you start and finish, your answers to the checks inside them, your streak, and the certificates you have earned.
• Preferences. Language, light or dark appearance, sound, haptics, and whether the daily reminder is on and at what time.
• Subscription status. Whether you have an active subscription, plus the transaction identifiers our billing provider returns. We never see or store your card number.
• Usage analytics. Which screens you open and which lessons you complete, together with app version, device model, operating system version, and region. Session replay is switched off.
• Practice text you write. Where a lesson asks you to write a prompt and have it graded, the text you submit is sent to be assessed and the feedback returned to you.

What we do not collect

We do not collect your contacts, your location, your photos, your camera or microphone, health data, or anything you write outside the app. Coursium carries no advertising SDKs, does not track you across other companies’ apps and websites, and does not build advertising profiles. We do not sell personal data, and we do not share it for cross-context behavioural advertising.

Why we are allowed to hold it

We process your account details, progress and subscription status because we cannot provide the app you asked for without them — that is performance of our contract with you. Analytics and product diagnostics rest on our legitimate interest in knowing which lessons work and which are broken, balanced against the fact that the events describe app usage rather than anything sensitive. Where the law of your country requires consent instead, we ask for it.

Certificates are public to anyone holding the link

A Coursium certificate exists to be shown to someone else, so the verification page at coursium.ai/verify carries the name it was issued to, the course, the date, the issuer and the twelve-letter reference. Anyone given that reference can see those details.

• Certificate pages are not indexed by search engines.
• Codes cannot be listed or guessed from the site — there is no way to browse certificates, only to look one up exactly.
• Ask us and we will withdraw a certificate, after which its page stops resolving.

Who processes it

We keep the list of companies that touch your data short, and every one of them is a processor acting on our instructions rather than a party we sell to.

• Supabase — stores your account, progress and certificates.
• RevenueCat — manages subscription entitlements.
• Apple and Google — process the payment itself, provide sign-in, and deliver push notifications. Neither passes us your payment details.
• Mixpanel and PostHog — process product analytics events.
• OpenAI — grades free-text practice answers. Only the text of that exercise is sent; your name, email and account identifier are not.
• Expo — delivers app updates and notification tokens.
• Vercel — hosts this website and keeps standard server request logs.

Where your data is held

Our providers process data on servers in the United States and, in some cases, elsewhere. If you are in the United Kingdom, the European Economic Area or Switzerland, that means your data leaves your country; where the law requires a transfer safeguard, we rely on the standard contractual clauses our providers offer.

How long we keep it

Your account, progress and certificates stay while your account exists. Delete your account and they are removed. Analytics events are retained for as long as they are useful for product decisions and are not tied to a name or an email address once your account is gone. Apple and Google keep their own record of a purchase under their own terms, which we cannot shorten.

Deleting your data

In the app, open Profile → Settings → Delete account. It removes your account and everything attached to it, and it cannot be undone. If the deletion cannot reach our server — you are offline, for instance — the app tells you, and emailing us finishes the job. You can also simply ask us to delete the account and we will do it.

Your rights

Depending on where you live you may have the right to ask for a copy of your data, to have it corrected or deleted, to object to or restrict how we use it, and to complain to your data protection regulator. Ask us and we will act on it; we do not charge for this and we will not treat you differently for exercising it.

Your choices in the app

The daily reminder is a switch under Profile → Settings, and your phone’s own notification settings override it. Analytics cannot currently be switched off from inside the app — we would rather say so than describe a control that is not there. If you want your analytics profile deleted, or want to be excluded from analytics while keeping your account, email us and we will do it by hand.

This website

Coursium.ai sets no advertising or tracking cookies and runs no third-party analytics. Your light or dark preference is stored in your own browser and never reaches us. Our host records standard request logs — IP address, page, timestamp — for security and diagnostics.

Security

Data is encrypted in transit, access to production systems is limited to the people who need it, and payment details never reach us in the first place. No service can promise perfect security, and we do not; if a breach affects you, we will tell you and the relevant regulator as quickly as the law requires.

Children

Coursium is written for working adults and is not directed at children. Do not use it if you are under 13, or under the minimum age of digital consent where you live if that age is higher. If we learn that we hold data from a child below that age, we delete it.

Changes to this policy

We update this page when the app changes, and the date at the top always tells you when it last moved. If a change materially affects what we collect or what we do with it, we will say so in the app rather than rely on you re-reading this page.