Privacy Policy

Last updated: 2026-08-28

This is a plain-language disclosure, not formal legal advice. LetItCrash is a small, independently-run learning app. This page describes what data the app actually collects and what happens to it, in plain terms. If this app ever grows to a large user base, the operator should get real legal review (a proper privacy policy drafted or checked by a lawyer, ideally one familiar with applicable laws like GDPR/CCPA) before relying on this page as a substitute.

What we collect

• Email address — collected when you register an account. It's used to sign you in — by magic link, or as the identifier for a password if you set one — and, if you change your email, a confirmation link. We do not sell or share your email with anyone.
• Alpha waitlist — if you join the public waitlist (name, email, and an optional note), that is stored as a waitlist row, not an account. The operator is emailed a notice, and you get an auto-reply confirming we received the request. When a spot opens, the operator may email you an invite code. Submitting the form is the consent for that contact.
• Usage and attempt data — when you submit an exercise, we store the code/answer you submitted, whether it passed, and timestamps, so we can show you your progress, streaks, XP, and spaced-repetition scheduling (when to show you a problem again). This data is tied to your account and is how the app's practice/review features work at all.
• Learning activity log — the app keeps a first-party record of how you move through it: which pages you open, exercise attempts (including which answer option you picked, not just right/wrong), practice runs that you never submit, when a hint is shown or dismissed, and how long you spend on an exercise. It also records your device's form factor (screen size, whether you're on a touch device, and your browser's user-agent string) and a short technical report when something in your browser fails. We use this to find bugs, confusing screens, and exercises that don't teach well — during the alpha period it is read by the developer (and analyzed with the help of AI tools) to improve the app. It is not sold, shared, or used for advertising.

What we do not collect

We do not run any third-party analytics or tracking scripts (no Google Analytics, no Plausible, no ad pixels, nothing similar) — the activity log described above is the app's own database, not an outside service. The app's own code does not log your IP address anywhere — the one exception is Sentry (see "Third parties we use" below), which automatically includes it on a crash report. We do not record keystrokes, mouse movements, or screen replays. There is no cookie-based tracking beyond the single signed session cookie Phoenix uses to keep you logged in.

Third parties we use

• Resend — sends the transactional emails described above (login links, confirmation links, waitlist auto-replies and invite codes, and the operator notice when someone joins the waitlist). Your email address is shared with Resend only for the purpose of delivering that email.
• OpenRouter — powers optional AI features (hints, grading feedback, the AI tutor). When you use these features, the exercise code and prompt text involved in that exercise is sent to this provider so it can generate a response. We do not send your email address, name, or any other personal account information to OpenRouter — only exercise-related content.
• Sentry — automatically receives a report when the app crashes, so the bug can be diagnosed and fixed. A crash report can include the page URL, your IP address, your browser's user-agent string, and whatever request data was active at that moment (e.g. a form field you'd just submitted) — fields literally named "password" or "secret" are redacted, but other field values are not filtered by name. Your session cookie is never included, and no code in this app attaches your account email or user ID to a report.

Data retention and deletion

Your account data (email, submissions, progress, activity log) is kept for as long as your account exists. If you'd like your account and associated data deleted, contact us (see below) and we'll remove it. Activity-log entries keep no direct pointer to a deleted account — they're anonymized, not kept under your identity.

Questions or concerns

Email oreoorbitz@gmail.com with any privacy questions, data deletion requests, or if you spot something in this policy that doesn't match what the app actually does.

Terms of Service