Civlso
Civlso
This Privacy Policy explains how Denad Labs LLC ("we", "us") handles information when you use Civlso: the website, the app, and the tools inside it.
Civlso is operated by Denad Labs LLC, Tacoma, Washington, USA. For any privacy question or request, email help@denadlabs.com or use Support in the app.
When you sign in, the following is stored in our database (hosted by Supabase):
Answers you send for checking (homework checks, Read and practice completion checks, and numbers checked by the Coach in a Collaborate room) are compared with Civlso's answer key. Only the completion record described above is kept, not the answer you typed. Our hosting provider processes your IP address to deliver pages and to apply rate limits.
If you arrive from a recognised Civlso campaign link, an approved campaign, source, medium, and creative identifier is kept in that browser tab for up to 2 hours. It is sent to Vercel Web Analytics with a few events (campaign landing view, sign-up started, sign-up completed and whether email or Google was used) to understand which Civlso campaign led to a visit or signup. It is not saved to your account.
Many Civlso tools save your work in your browser's local storage on this device. This data is not sent to us, and other devices do not see it. Clearing your browser storage deletes it. The full list, with each storage key, is in the Cookie Policy. It includes:
The FE study plan's daily reminder is a calendar file (.ics) made in your browser and saved to your device; nothing is sent. Files you open in local tools (for example a CSV in Research Studio or a resume in the Career plugin) are read in your browser and are not uploaded.
FE debrief reports. Debrief reports to Civlso are not sent automatically today. If a debrief finds an area where Civlso's coverage was the problem, you can copy an anonymised report (area, verdict and score only) and send it to Support yourself. If we ever add automatic sending, we will update this policy and tell you before it starts.
The Learning Coach is a rule-based tutor that runs in your browser. It does not send what you type to an AI provider or any other third party, and Civlso does not use an AI model provider today. What is kept is described above: the first 200 characters of a question that starts a session (on your account and in the recent-sessions list on your device), and counts about your attempts. When the usage system is on, each Coach response is counted against your allowance (the feature and subject are recorded). The Coach in a Collaborate room makes practice problems from Civlso's own templates on our server. It receives the subject, level and room code and the numbers you check, and does not store them.
Room boards, chat, cursors and presentations travel in real time through Supabase to the people in the room. They are not saved in our database. People in a room see the display name on your profile (or, if you have none, the part of your email address before the @), and your public profile card: your first name and last initial, avatar colour, and anything you chose to show. Your email, scores, notes, mistakes and activity are not shown. Each participant's browser keeps its own copy of the room for up to 7 days, which we cannot delete for them.
To run the Service and your account. That covers keeping your progress, notes and settings in sync, checking answers, awarding badges, applying plan access and usage limits, processing payments and upgrades, answering support requests, reviewing reports and keeping the Service secure (rate limits, abuse checks and suspensions). We also look at aggregate website analytics. We do not sell your information, use it for advertising, or use session recording.
These providers handle data on our behalf under their own security and privacy terms:
Civlso does not use an AI model provider, an email marketing service, advertising trackers or session recording. Our fonts are served from our own site, not from Google Fonts. Links to outside websites (such as references, DOI links, Google Scholar searches and government sites) take you to sites with their own privacy policies.
Authorised Civlso staff use an internal admin tool to answer support tickets, review Collaborate reports, manage videos, look at abuse signals and suspend accounts. Staff access is limited to approved operator accounts, and staff actions are logged. We share information with the providers above to run the Service, or where the law requires it.
Civlso does not set its own cookies. We use your browser's local storage to keep you signed in and to remember your progress and preferences. See the Cookie Policy for every storage key, what it does and whether it is essential.
Regardless of where you live, you can do the following.
We'll respond to requests within 30 days.
Under the California Consumer Privacy Act (CCPA/CPRA), California residents have the right to know what personal information we've collected about them, request deletion of it, and opt out of the "sale" or "sharing" of personal information. Civlso does not sell or share personal information as those terms are defined by the CCPA. We will not discriminate against you for exercising any of these rights.
Under GDPR and the UK GDPR, we process your data on these legal bases: performance of our contract with you (to provide the Service you signed up for), our legitimate interests (such as keeping the Service secure and understanding aggregate usage), and your consent where we ask for it separately. You have the right to access, correct, delete, restrict, or port your data, and to object to processing based on legitimate interest. If you believe we haven't handled your data properly, you have the right to lodge a complaint with your local data protection supervisory authority.
Civlso is run from the United States, and your data is processed and stored in the United States by us and the providers above. The code libraries are delivered by content networks with servers in many countries. By using the Service, you understand your data will be transferred to the United States.
The Service is not directed to children under 13, and we do not knowingly collect their data. When you create an account, or first set up an account made with Google, we ask for your birth month and year without saying where the line is. If you are under 13, no account is created, and that browser cannot try again for 24 hours. The birth date is never stored; only the time you confirmed you are 13 or older is. If an under-13 visitor signs in with Google, they are signed out before any profile is saved, and we delete the basic sign-in record when we become aware of it. If you believe a child under 13 has an account, contact help@denadlabs.com and we will close it and delete its data.
Civlso is served only over HTTPS. Database rules let each student read only their own rows. Purchases, completion checks, usage and protected content are handled by our server, not trusted from the browser. Requests are rate-limited, video links expire after 5 minutes, and email verification is required before upgrading. No system is perfectly secure; if you find a problem, tell us at help@denadlabs.com.
We may update this policy as Civlso changes and will revise the date above when we do. Before we start collecting a new kind of information or sending something new off your device, such as debrief reports, we will update this policy and tell you in the app.