Privacy

• Account: your email address, and your name if you type one (for the certificate) or if Google sign-in provides it.
• Your answer to “What brings you here?” on first visit, if you answer it.
• Progress: which lessons you've completed and when, and which checklist items you've ticked.
• Self-audit: your Present/Absent ticks for the 7 behaviors and the task types you selected, with the date and the score. Only the ticks, never the conversation you scored.
• Purchase status: whether you have the full course, when it was granted or refunded, and the Lemon Squeezy order reference.
• Where you came from: campaign tags in the link that brought you here (for example from a video), kept so we know which links work.
• Server logs: standard technical logs (IP address, browser type, pages requested) kept by our hosting provider for a short time for security and debugging.

Your AI chats. The course asks you to run prompts in your own AI tool. Nothing you type there, nothing the AI answers, and no coursework or files you upload to an AI tool ever reach us. The self-audit asks only for ticks.

We don't store payment card details; Lemon Squeezy handles payment. We don't buy data about you from anyone.

• Supabase: the database and sign-in (it sends the sign-in email links).
• Vercel: hosting; serves the pages and keeps the server logs.
• Lemon Squeezy: checkout, receipts, taxes and refunds, as merchant of record. Your name, email and order go to them under their own privacy policy.
• Google: only if you choose “Sign in with Google”, which shares your email and name with us.
• PostHog: usage analytics (which pages and lessons are used, by anonymous counts and by your account ID so we can see where students get stuck). No session recordings, no click tracking beyond the course's own events.

These providers may store data outside Canada. We don't sell or rent your data, and we don't share it with anyone else except when the law requires it.

• A sign-in cookie that keeps you signed in. Required.
• A first-party cookie that remembers the campaign link you arrived with, until you sign up. No advertising cookies.
• Your browser may keep small preferences (such as where you were in a lesson) on your device. They never leave it.

As long as your account exists. If you ask us to delete your account, we delete your profile, progress and self-audit records. Order records stay with Lemon Squeezy for refunds and accounting, as the law requires, and server logs expire on their own.

Email support@hummingbird.study from your account email to ask what we hold about you, to correct it, or to delete your account and everything in it. We answer within 30 days, usually much sooner. An account page with a delete button is planned; until then, email is the way.

You can change the name on your certificate yourself, on the certificate page.

We send sign-in links, your purchase receipt (from Lemon Squeezy), and notices about your account or the course. If we add optional emails, such as study reminders, you'll be able to turn them off with one click, and we'll ask first.

The course is for students aged 16 and over. If we learn that someone younger has an account, we delete it. Parents or guardians can write to the support address.

hummingbird.study is based in Ontario, Canada, and handles personal information under Canada's federal privacy law (PIPEDA). The privacy contact is the support address below; you can also complain to the Office of the Privacy Commissioner of Canada. The date at the top shows the current version; material changes are announced on the site or by email.