Privacy Policy

1. Introduction

zkSchool (“we”, “us”, or “our”) operates the zkSchool platform at zkschool.xyz (the “Service”). This Privacy Policy explains what information we collect, how we use it, and your rights in relation to it. By using the Service, you agree to the practices described here.

2. Information We Collect

We collect information in the following ways:

• Account data via X (Twitter) login: When you authenticate through X OAuth, we receive your X user ID, display name, username, and profile avatar. We do not receive your X password or private messages.
• Optional profile data: You may voluntarily provide an email address and education level through your profile settings. These are not required to use the Service.
• Learning progress: We record which lessons you have completed, quiz attempts, XP earned, streaks, and module completion status.
• Activity events: We log actions such as lesson completions and quiz results for leaderboard and streak calculations.
• Referral data: If you were invited via a referral code, we record who invited you.
• Usage and acquisition data (consent only): If — and only if — you accept analytics cookies, we record one anonymous entry per browsing session containing: the page you landed on, the website that referred you, any campaign parameters in the link you followed (utm_source, utm_medium, utm_campaign, utm_term, utm_content), your device type, and an approximate location (country, region, city and timezone). Location is derived at our hosting edge from your connection; we do not store your IP address at any point. Sessions are identified by a random first-party identifier, never by a fingerprint. If you create an account, the first campaign that referred you is stored alongside it so we can understand which channels bring people to the Service.

3. How We Use Your Information

• To authenticate you and maintain your session.
• To track and display your learning progress, XP, ranks, and achievements.
• To power leaderboards, streaks, and gamification features.
• To enforce the invite-only access model and referral system.
• To send you notifications about your account if you have provided an email address.
• To understand how people discover the Service and which pages and campaigns bring them here, using aggregated analytics — only where you have consented.

4. Legal Bases for Processing

If you are in the European Economic Area, the United Kingdom, or Switzerland, we process your personal data on the following legal bases under the GDPR:

• Performance of a contract (Art. 6(1)(b)): account creation, authentication, invite-code access, and recording your learning progress — the things the Service cannot deliver without.
• Consent (Art. 6(1)(a)): all analytics and acquisition measurement, including the cookies listed in the analytics category below. You may withdraw consent at any time, and doing so is as easy as giving it — see Privacy Settings in the footer or in your account settings. Withdrawal does not affect the lawfulness of processing carried out before you withdrew.
• Legitimate interests (Art. 6(1)(f)): keeping the Service secure, preventing abuse of the invite system, and maintaining the integrity of leaderboards.
• Legal obligation (Art. 6(1)(c)): where we must retain or disclose data to comply with applicable law.

5. Leaderboard and Public Data

Leaderboard entries display your display name, avatar, and point totals. Your email address is never displayed publicly. You can control your display name through your profile settings.

6. Cookies and Similar Technologies

We use two categories of cookies. Nothing in the analytics category is set, read, or transmitted until you accept it — if you have not answered the consent banner, or you declined, only the strictly necessary cookies below exist. We never use advertising cookies, never sell personal data, and do not track you across other websites.

We also use browser localStorage to cache your learning progress locally for a faster experience; this stays on your device. Vercel Web Analytics, which collects aggregate page-view data without cookies, is also loaded only after you accept the analytics category.

7. Data Sharing and Third Parties

We do not sell your personal information. We share data only as follows:

• X (Twitter): OAuth authentication is processed by X. Their privacy policy applies to that interaction.
• Vercel and Neon: The Service is hosted on Vercel and uses Neon Postgres for data storage. Both are infrastructure providers operating under their own privacy and security commitments.
• Legal requirements: We may disclose data if required by applicable law or legal process.

8. International Transfers

Our infrastructure providers (Vercel and Neon) may process and store data on servers located outside your country, including in the United States. Where data is transferred out of the EEA, the United Kingdom, or Switzerland, that transfer is covered by the safeguards those providers maintain for international transfers, such as the European Commission’s Standard Contractual Clauses.

9. Data Retention

We retain your account data for as long as your account is active. You may request deletion of your account and associated data by contacting us at the address below. Some data may be retained for a limited period for fraud prevention or legal compliance.

Analytics records are kept for a maximum of 12 months and are then deleted automatically by a scheduled job. Acquisition data attached to an account is deleted together with that account.

10. Security

We implement reasonable technical measures to protect your data, including HTTPS, HTTP-only cookies, and access controls. No online service is completely secure; you use the Service at your own risk.

11. Children

The Service is not directed at children under 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.

12. Your Rights

Depending on your jurisdiction — and in all cases if you are in the EEA, the UK, or Switzerland — you have the right to:

• Access the personal data we hold about you, and receive a copy of it.
• Have inaccurate data corrected, and incomplete data completed.
• Have your data erased (“right to be forgotten”).
• Restrict or object to processing carried out on the basis of legitimate interests.
• Receive your data in a portable, machine-readable format.
• Withdraw consent for analytics at any time, without giving a reason and without affecting your access to the Service — use Privacy Settings in the footer or in your account settings.
• Lodge a complaint with your local data protection supervisory authority if you believe we have handled your data unlawfully.

We do not use your data for automated decision-making or profiling that produces legal or similarly significant effects. To exercise any of these rights, contact us at:

draco@zkschool.xyz

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will post the updated policy on this page with a revised “Last updated” date. Continued use of the Service after changes constitutes acceptance of the revised policy.