Privacy Policy

1. Who we are

This privacy policy describes how Digital Alchemy Lab (“Digital Alchemy Lab”, “we”, “us”, “our”) processes personal information for the Prodigy web application served at https://www.prodigyapp.org (the “Web App”).

2. What the Web App does

The Web App is a companion to the Prodigy! browser extension. It lets signed‑in users:

• manage their account and subscription;
• use a longer‑form reading workspace (“Canvas”) to translate, read aloud, and study text and uploaded documents;
• access reading and OCR features that share components with the extension.

3. Data we collect

We collect only the categories of data described below. Each row identifies what is collected, where it is processed, and why.

Data category	Where it is processed	Why we need it
Account identifiers: e‑mail address, a unique account identifier (UID), display name and profile photo URL provided by your identity provider, e‑mail verification status.	Google LLC, as our cloud authentication and database provider.	To create and authenticate your account and to honour data‑subject requests.
Subscription / entitlement state: plan tier (free, Pro, Ultra), billing period, current period end, plan flags.	Google LLC (our cloud database provider) and Stripe Inc. (our payment processor).	To determine which Web App features you can use.
Payment information (only if you subscribe).	Collected and stored by Stripe Inc. as our payment processor. We do not see, receive or store your full card number, CVC, or bank credentials. We retain only the Stripe customer / subscription identifiers needed to recognise your subscription.	To process subscription payments and refunds.
Content you put into the Web App: text you type, paste or upload into the Canvas / reading workspace; images and document content that you load for reading or OCR.	Processed in your browser. Sent to the translation or TTS provider you have selected when you trigger a translation, dictionary, or speech action (see 7.2). Image OCR runs locally in your browser using the bundled Tesseract.js library; the image is not uploaded.	To return translations, transliterations, audio output, and reading aids for the content you supply.
Web App usage analytics: page views, basic UI events, the enabled feature surface, approximate region, device type, browser/version, language. Linked to a random analytics identifier; if you are signed in, also linked to your UID.	Google Analytics (Google LLC).	To understand which Web App features are used and to fix bugs and performance issues.
Application event logs: structured events about feature usage and operational outcomes that signed‑in users generate while using the Web App. May be linked to your UID.	Our cloud database (Google LLC).	To diagnose feature issues and to compute aggregate metrics that we use to prioritise improvements.
Server & security logs: IP address, user‑agent, request timestamps, request paths.	Google LLC, as our cloud infrastructure provider.	To operate the Service securely (rate‑limit abuse, investigate incidents) and to comply with our legal obligations.

4. Data we do not collect

The Prodigy Web App does not collect, transmit or store:

• your browsing history outside the Web App (we only see your activity inside www.prodigyapp.org);
• health or medical information;
• full payment card data (Stripe handles it; we keep only identifiers);
• communications content (chats, emails), contacts or address book data;
• precise geolocation;
• biometric data;
• data about children under 13 (or under 16 in the EEA) — see section 12.

5. How we use data

We use the data described in section 3 only to:

• provide the features you ask for (translate, read aloud, OCR, reading workspace);
• authenticate you and determine your subscription tier;
• operate, secure and maintain the Web App, including preventing abuse and fraud;
• diagnose bugs and improve performance and reliability;
• send transactional e‑mails (sign‑in, account, billing — sent via our authentication provider and our payment processor);
• fulfil our legal obligations and respond to valid legal process.

We do not:

• sell your personal information or share it with data brokers;
• use your data, including Google user data, for advertising or to build advertising profiles;
• use your data to determine credit‑worthiness or for lending purposes;
• use your data for any purpose unrelated to the features described in section 2.

6. Storage & retention

Data	Storage location	Retention
Account record, UID, e‑mail, entitlement, application event logs	Google LLC (our cloud authentication and database provider)	For as long as your account exists. Deleted on request or on account deletion (see section 13).
Subscription / billing records	Stripe Inc.	Retained by Stripe for the period required by applicable financial and tax law (typically several years). Stripe's privacy notice applies to that processing.
Translation / TTS request payloads (the text you sent)	Sent to the provider you selected (see section 7). We do not store these payloads on our servers.	Not retained by us beyond what is needed to return the result. The chosen provider may log the request in line with its own policy.
Web App analytics events	Google Analytics	According to Google's default Analytics retention (currently up to 14 months for user‑level data); aggregate metrics may be kept longer.
Server & security logs	Google LLC (our cloud infrastructure provider)	According to Google's standard log retention; typically a small number of months.

7. Third parties

We do not sell or rent personal information. We share data only with the categories of recipients listed below, and only the data needed for the listed purpose.

7.1 Service providers we use to operate the Web App

Provider	Role / data shared
Google LLC — our cloud authentication, database, hosting, serverless backend, and analytics provider (the latter via Google Analytics).	Authentication credentials and tokens, your UID, e‑mail, display name, photo URL, entitlement record, application event logs, request metadata (IP, user‑agent), and Web App analytics events.
Stripe Inc.	E‑mail, name and payment instrument details for subscribers. Used to take payments and manage subscriptions. Card data is handled by Stripe; we never see it.

7.2 Translation, TTS and image‑search providers

When you ask the Web App to translate, speak, or look up an image for a piece of text, that text (and only that text, plus the languages involved) is sent to the provider you have selected for the operation. Each provider is the controller of the data it receives and its own privacy policy applies. The providers the Web App can use are:

• Google Translate (Google LLC) — default translator and image search.
• Google Translate TTS (Google LLC) — one of the available voices.
• Microsoft Bing Translator and Bing Read Aloud TTS (Microsoft Corporation) — alternative translator and voice.
• DeepL Translator (DeepL SE) — alternative translator.
• Naver Papago (Naver Corporation) — alternative translator.
• Yandex Translator (Yandex LLC) — alternative translator.
• Baidu Translate (Baidu Inc.) — alternative translator.
• OpenAI ChatGPT (OpenAI OpCo, LLC) — optional translator.
• Browser‑built‑in Web Speech API (your operating system / browser vendor) — default local TTS engine; runs on your device.

We do not include your account credentials, UID, e‑mail address or payment data in these requests.

7.3 Legal & safety

We may disclose information if we reasonably believe it is necessary to comply with a legal obligation (court order, lawful subpoena), to protect the safety, rights or property of users or the public, or to investigate fraud, abuse or security incidents.

7.4 Business transfers

If Digital Alchemy Lab is involved in a merger, acquisition or sale of assets, personal information may be transferred as part of that transaction. We will require the new entity to honour the commitments in this policy or notify you of any material change.

8. Limited Use of Google API data

The Prodigy Web App's use and transfer of information received from Google APIs to any other app will adhere to the Chrome Web Store User Data Policy, including the Limited Use requirements. In particular:

• we limit our use of Google user data to providing or improving the user‑facing features described in section 2;
• we transfer Google user data to third parties only as needed to provide or improve those user‑facing features, to comply with applicable law, or to detect and prevent fraud or abuse;
• we do not allow humans to read Google user data unless we have your explicit consent for specific data, the data is needed for security or to comply with the law, or the data has been aggregated and anonymised for internal operations;
• we do not transfer, use, or sell Google user data for personalised advertising, to data brokers, or to determine credit‑worthiness or for lending purposes.

9. Cookies and similar technologies

The Web App uses cookies and Web Storage that are strictly necessary for sign‑in and security (authentication session and ID‑token storage provided by our cloud authentication service), plus analytics storage for Google Analytics. You can manage cookies through your browser's settings; signing out clears the authentication session.

10. Security

All Web App traffic uses TLS (HTTPS). Authentication is delegated to Google's cloud authentication service. Account, entitlement and event records live in our cloud database with rules that prevent users from reading or writing other users' data. We use the principle of least privilege for our serverless backend and apply our cloud provider's standard infrastructure security. Payments are handled by Stripe under PCI DSS. No method of transmission or storage is 100% secure; we cannot guarantee absolute security.

11. International transfers

Our processors (Google LLC, Stripe Inc., and the translation/TTS providers in section 7) may process data in countries outside your country of residence, including the United States. Where required by law (e.g. EU/UK), these transfers rely on the European Commission's Standard Contractual Clauses or equivalent transfer mechanisms put in place by the relevant provider.

12. Children's privacy

The Prodigy Web App is not directed at, and is not intended for use by, children under 13 (or under 16 in the European Economic Area). We do not knowingly collect personal information from children under those ages. If you believe a child has provided personal information to us, please contact us at the address in section 15 and we will delete it.

13. Your rights

Depending on where you live, you may have rights under data‑protection laws such as the EU/UK GDPR, the California Consumer Privacy Act (CCPA/CPRA) and similar laws. These rights can include:

• access to the personal information we hold about you;
• correction or update of inaccurate personal information;
• deletion of your account and the personal information associated with it;
• a portable copy of your data in a common format;
• objection to or restriction of certain processing;
• withdrawal of consent (where we relied on consent, e.g. for non‑essential analytics);
• the right not to be subject to discrimination for exercising any of these rights;
• lodging a complaint with your local data‑protection supervisory authority.

To exercise any of these rights (including account and data deletion), contact us at the address in section 15. We respond within 30 days, or as required by applicable law.

14. Changes to this policy

We may update this privacy policy from time to time, for example to reflect changes in the Web App or in applicable law. Material changes will be announced by updating the “Effective date” and “Last updated” values at the top of this page and, where required by law, by a more prominent notice or by e‑mail to your account address. The previous version remains available on request.

15. Contact us

If you have any questions or requests regarding this privacy policy or your personal information, please contact our privacy team:

Digital Alchemy Lab — Privacy Contact
E‑mail: com.prodigy.app@gmail.com