Privacy Policy

AlefOrigins (the website at aleforigins.com and the AlefOrigins iOS app, together the “Service”) is operated by Bugu Labs LLC (“we”, “us”). This policy explains what information we collect, why, who we share it with, and the choices you have. We collect only what we need to teach you the Hebrew aleph-bet and run your account. We don't sell your data and we don't show ads.

Who is responsible

Bugu Labs LLC, 6815 Biscayne Blvd Ste 103132, Miami, FL 33138, United States, is the controller of your personal data. Contact us at support@bugulabs.com for any privacy question or request.

What we collect

Account information

• Your email address and a password (stored only as a secure hash by our authentication provider), or the identifier Apple provides if you use Sign in with Apple. If you choose Apple's “Hide My Email”, we only receive a relay address.
• An optional display name.
• If you sign up with a partner promotion code: your full name and the community you belong to, so the partner's eligibility can be confirmed.
• Your answer to “How did you hear about us?”.

Learning activity

• Your settings (language, Kids or Adults mode, which alphabets you study, sound).
• Your progress: letters explored and traced, tracing accuracy, lessons completed, game scores and durations, words read, streaks, points and achievements, with timestamps.

We use this to save your place, unlock lessons, show your progress and issue your certificate. Your drawings when tracing are scored on your device and are not uploaded.

Subscription information

• If you subscribe on the web, payment is handled by Stripe. We receive a customer identifier, your subscription status and renewal date — never your full card number.
• If you subscribe in the iOS app, payment is handled by Apple. We receive, through our subscription provider RevenueCat, whether your subscription is active, which product it is and when it expires.

Organizations

If a school, synagogue or teacher invites you, we store your membership. Administrators of that organization can see your learning progress (not your password or payment details).

Technical information

Our hosting and infrastructure providers process standard technical data such as IP address, device and browser type, and request logs, to deliver and secure the Service. We don't use advertising or analytics trackers. The website uses strictly necessary cookies to keep you signed in, and stores your progress in your browser so it works offline.

Children

AlefOrigins has a Kids mode designed for children learning with a parent, guardian or teacher. Accounts must be created by an adult — a parent, guardian, or an organization such as a school — who is responsible for the child's use of the Service. We collect only the learning data described above and never show ads or contact children for marketing. If you believe a child has given us personal information without appropriate consent, contact us and we will delete it.

How we use your information

• To create and secure your account and sync your progress across the web and your devices.
• To provide the lessons, games and certificate, and to decide what you have access to.
• To manage subscriptions, organization memberships and partner promotions.
• To send you service emails (such as sign-in links, invitations or access decisions). We don't send marketing emails without your consent.
• To understand, in aggregate, how people discover AlefOrigins.

If you are in the European Economic Area or the UK, our legal bases are: performing our contract with you (providing the Service), our legitimate interests (security, improving the Service, understanding how people find us), and legal obligations (such as tax records).

Who we share it with

We share data only with service providers that help us run AlefOrigins, under contracts that limit their use of it:

• Supabase — database and authentication.
• Vercel — website and API hosting.
• Stripe — web payments.
• Apple and RevenueCat — in-app purchases on iOS.
• Resend — transactional email delivery.
• Google Fonts — web fonts, which receive your IP address when the website loads.

We also share learning progress with the administrators of an organization you join, and promotion-code details with our team to review eligibility. We may disclose information if required by law. Some providers are in the United States; where required, transfers rely on appropriate safeguards such as the EU Standard Contractual Clauses.

How long we keep it

We keep your information while your account exists. When you delete your account, we delete your profile and learning data; records we must keep for tax or legal reasons (such as payment records held by Stripe or Apple) are retained as the law requires.

Your choices and rights

• Delete your account at any time from Settings in the iOS app, or by emailing us. Deleting your account doesn't cancel an App Store subscription — manage that in your iPhone's Settings.
• Access, correct or export your data by emailing us.
• Depending on where you live (for example the EU, UK or California), you may also have the right to restrict or object to processing, and to complain to your local data protection authority.

We respond to requests within 30 days.

Security

Data is encrypted in transit, access is protected by row-level security so each account only sees its own data, and payment details are never stored on our servers.

Changes

If we change this policy materially, we'll update the date above and, where appropriate, let you know in the Service or by email.