Your data, clearly explained.

Last updated: 26 October 2026.

We store your authentication email, progress (XP, crowns, streak), submissions, feedback and a daily tutor request counter in your Supabase account. We do not sell data. Cookie-free visit analytics is enabled only when configured. Sessions use strictly necessary cookies. When you use “Explain it to me” or “Ask for a hint”, the exercise and your answer (not your email) are sent to OpenRouter and the AI model provider to generate the explanation; we do not store them. You can delete your account and associated data in your profile. Do not include secrets in code or feedback.

Payments and billing

Stripe processes payments, manages subscriptions and provides invoices. Toca receives Stripe account, plan and subscription status identifiers, but does not receive or store the full card number. This data is needed to perform the contract and comply with accounting and legal obligations.

Retention and rights

Account and learning data are kept while the account exists. Deleting your account removes associated Toca data; Stripe may retain transaction records for the applicable legal period. You can request access, correction, portability, objection or restriction through Feedback and complain to the competent supervisory authority.

Providers

We use Supabase for authentication and data, Vercel for hosting, Stripe for payments, and OpenRouter and the model provider for tutor responses. These providers may process data outside the EEA using the safeguards described in their policies.