Privacy Policy
Last updated: October 27, 2026
This policy explains what personal data struGGle.live keeps, why and on what legal basis, who receives it and what your rights are under the GDPR. We don't sell your data and we don't show ads.
Who is responsible
The controller of your personal data is Burak Büyükyüksel, Kraków, Poland. For anything about your data, write to [email protected].
What we collect
Account: name, username, email, password (stored only as a hash), profile picture, and basic profile details from Google if you sign in with Google.
What you do here: topics, struggles, lesson progress, XP and streaks, likes, follows, comments, collections, groups, chat messages, feedback and content reports.
Billing: your plan, subscription status, currency and a Stripe customer ID. Card details go directly to Stripe; we never see your full card number.
Technical: session cookies, and IP address and browser details in server logs. For AI requests we record the task type, model and token counts. While you're signed in, usage statistics (see below).
If you contact us or report content without signing in: your name, email and message.
Why we use it, and on what legal basis
To run your account and the service you asked for, including generating lessons, social features, groups and paid plans: performing our contract with you (art. 6(1)(b) GDPR).
To keep billing records as tax and accounting law requires: a legal obligation (art. 6(1)(c)).
To keep the service safe (rate limits, abuse prevention), to handle content reports and moderation, and to improve the service from usage figures: our legitimate interest in a safe, working service (art. 6(1)(f)), and for reports also our obligations under the EU Digital Services Act.
To answer your messages: our legitimate interest in replying to you, or steps you asked for before a contract.
To load Google reCAPTCHA on the contact form: your consent (art. 6(1)(a)), given when you click "Load reCAPTCHA".
We don't make decisions about you based only on automated processing that have legal or similarly significant effects.
AI providers
To write your plan, lessons and scenes, and to grade answers, the text needed for that task (your topic, plan, lesson content, answers and settings) is sent to an AI provider: Google (Gemini), OpenAI, Anthropic, DeepSeek, or a model we run ourselves. Which one depends on the task and your plan. We don't send your name or email with these requests.
Don't put sensitive personal information in topics or answers. If you use your own API key, those requests go to the provider you chose, under your key and its terms.
Who else receives your data
Service providers that process data for us: Stripe (payments), Google (sign-in and reCAPTCHA), Resend (sign-up and password emails) and the AI providers above. The service itself runs on our own server.
Other users see what you make public: your profile, public struggles and comments. Members of a group see its chat.
Authorities, only when the law requires it.
Transfers outside the EU
Some of these providers are based in the United States (Stripe, Google, OpenAI, Anthropic, Resend). These transfers rely on the EU–US Data Privacy Framework where the provider is certified, or on the EU's standard contractual clauses.
DeepSeek is based in China, which the EU has not found to offer an adequate level of protection. We send it only learning content needed for the task, never your account details. If you'd rather your requests didn't go there, use your own key with another provider.
Cookies and local storage
We use one essential cookie to keep you signed in. Your browser's local storage keeps preferences (theme, language), cached struggles and unsent drafts; you can clear them in Settings → Data & Cache. These are needed for the service to work, so they don't need your consent.
We don't use analytics, tracking or advertising cookies. Google reCAPTCHA loads only after you click "Load reCAPTCHA" on the contact form, and may then set its own cookies. Stripe's checkout and card form, used only when you pay or change your card, set cookies to prevent fraud.
Usage statistics
While you're signed in we record which pages you open, which features you use (for example creating a struggle, forking, sharing or opening feedback), whether the request worked and how long it took. We don't record what you type, and we don't track signed-out visitors.
We use this to find and fix problems with your account and to see which parts of the service people use and which they don't. The legal basis is our legitimate interest in a working, improving service (art. 6(1)(f) GDPR).
It stays with us: no third-party analytics, no cookies. Usage records are deleted after 90 days. You can object at any time by turning off "Usage statistics" in Settings → Data & Cache; that also deletes the records collected so far. A record of payment events (paid, failed, refunded, cancelled) is kept with your billing records.
How long we keep it
Your account data is kept while your account exists. When you delete your account, your profile, struggles, progress and other personal data are removed. Groups you own pass to another member, so they don't disappear for everyone else.
Billing records are kept for 5 years from the end of the year they relate to, as Polish tax law requires; after your account is deleted they are no longer linked to it. Content reports and messages are kept while we need them to handle the matter and any follow-up. Server logs are kept only for a short time.
Security
Passwords are hashed, API keys are encrypted at rest and connections use HTTPS. No system is perfectly secure, but we work to protect your data.
Your rights
You can see and correct your data in your profile and settings. In Settings → Data & Cache you can download a copy of your data ("Download my data") or delete your account ("Delete my account") yourself.
You also have the right to access, rectify, erase, restrict and port your data, to object to processing based on our legitimate interests, and to withdraw consent at any time without affecting earlier processing. Write to [email protected]; we answer within one month.
You can complain to the Polish data protection authority (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl) or to the authority in the EU country where you live.
Children
struGGle.live is for people aged 16 and over. If you believe a younger child has an account, tell us and we'll delete it.
Changes
When we change this policy, we update the date above. We tell you about significant changes in the app or by email before they apply.