Privacy Policy

⚠️ DRAFT — PENDING COUNSEL REVIEW. This document is a working draft prepared from the project brief and is not legal advice. Before any version is published or relied upon for compliance with GDPR, CCPA, CPRA, COPPA, PIPEDA, or any other regulation, a qualified attorney (preferably one with experience in international privacy law) must review and finalize it for the jurisdictions where Human Wants to Learn operates. Placeholders (in [brackets]) require completion. Sections flagged with [COUNSEL] involve legal choices, not engineering decisions.

Effective date: 2026-05-11 Last updated: 2026-05-11 Data Controller: Human Wants to Learn (operated by James Jackson Leach, sole proprietor, Austin, TX, pending entity formation) ("HWTL," "we," "us," "our") Privacy contact: [email protected] EU Representative (if required): to be appointed by counsel before EEA/UK launch UK Representative (if required): to be appointed by counsel before EEA/UK launch

1. Our approach to privacy

HWTL is designed around a privacy-first principle: the less data we have, the less data we can lose, mishandle, or be compelled to disclose. We have deliberately engineered the product to minimize what we collect.

This Privacy Policy describes what we collect, why we collect it, what we do not collect, and what rights you have. Read it. If anything is unclear, ask us at [email protected].

The most important commitments in this policy are:

• Local-first adapters. The OpenClaw plugin, Claude Code hook, and browser extension run on your device and the local core service binds to loopback (127.0.0.1) by default. They do not send your conversation history to our servers. (See Section 4.)
• Public lesson links by default. A learn-icon opens a public concept page, optionally at a reviewed video timestamp. The default link contains no surrounding conversation paragraph, source code, repository name, or learner identity. Optional context sharing is separate from opening a lesson. (See Section 5.)
• No behavioral tracking. We do not track you across the web. We do not use behavioral advertising, retargeting, or fingerprinting. Ads on our hosted page are contextual — selected based on the topic of the page you are viewing, not based on you.
• Opt-in telemetry. Engagement telemetry on the hosted learn page is anonymous, aggregated, and off by default. You can disable it any time. Shared editorial requests for missing public resources are described separately below; they do not record an individual learning history.
• Context audit. If you explicitly submit context through a separately enabled feature, authenticated submissions are recorded in your account context log at human-wants-to-learn.dev/me/context-log. Ordinary concept-page visits and shared editorial requests do not create context-log entries.

2. Who this policy applies to

This policy applies to:

• Visitors to human-wants-to-learn.dev and any of its subdomains;
• Users of any HWTL adapter (OpenClaw plugin, Claude Code hook, browser extension) to the extent the adapter communicates with our hosted services;
• HWTL account holders (free and paid);
• Subscribers to our paid Subscription tier (v2);
• Booking Users and Tutors using the live tutoring marketplace;
• Newsletter subscribers;
• Contributors to the open-source registry via web form (PRs via GitHub are governed by GitHub's privacy policy in addition to this one).

It does not apply to data processing performed entirely on your own device by the open-source adapters when they do not communicate with our servers.

3. Information we collect

3.1 Information you provide

• Account information. Email address, display name, password (hashed by our auth provider Supabase), preferred audience level (non-engineer / junior-engineer / any), language preference, and any other preferences you set in your account settings.
• Payment information. When you make a paid purchase (tutoring session or subscription), payment details are handled directly by Stripe, Inc. We receive only the metadata necessary to associate the payment with your account (e.g., a Stripe customer ID, transaction status, last four digits of card for receipt purposes). We do not store your full payment card details.
• Tutor application information. If you apply to be a Tutor, we collect your name, GitHub or professional handle, areas of expertise, a sample explainer video URL, rate preference, and any other information you submit through the application form.
• Tutoring session content. Session video, audio, and chat are mediated by our video provider (Daily.co). Recordings (with consent of both parties) are stored for ninety (90) days; see Section 9.
• Registry contributions. If you submit a concept entry via the web form or via a GitHub PR, your submission and your GitHub username (if linked) become part of the open-source registry.
• Comments and discussions. Comments on concept pages are handled by GitHub Discussions via Giscus; your GitHub identity and comment content are governed by GitHub's terms in addition to ours.
• Newsletter subscription. If you opt in, your email address (and a subscription preferences object) is shared with our newsletter provider Beehiiv.
• Feedback and support requests. Any information you provide when contacting us.

3.2 Information collected automatically

• Service logs. Standard server logs (timestamp, IP address, user agent, requested URL, response status) are retained for 30 days for security and debugging. IP addresses are not used for behavioral profiling.
• Engagement telemetry (opt-in, anonymous, aggregated). With your explicit opt-in, we may record which concept pages are viewed, watch-through rates of embedded clips, and which related concepts are clicked. This data is aggregated and not linked to individual user identity. You may opt out at any time.
• Shared catalog demand. When a requested learning depth has no current reviewed resource, the website can retain an aggregate editorial request for that public concept, depth, explanation level, language, version, and task category. Repeated requests share one record containing a count, first/last request dates, and work status. The record contains no user/account ID, IP address, cookie, device ID, raw code, conversation text, repository name, or per-person history. It helps us fill gaps and reuse reviewed resources. It is separate from optional engagement telemetry and does not trigger a live provider search while the lesson loads. If storage is unavailable, the current lesson remains usable and the website does not claim the request was saved.
• Cookies and local storage. See Section 7.

3.3 Information from third parties

• OAuth providers. If you sign in via Google or GitHub, we receive your name, email, and provider user ID, subject to the scopes you approve at sign-in.
• Payment provider. Stripe sends us payment status updates and minimal metadata (Section 3.1).
• Tutor referrals. If you were referred by an existing Tutor, we may receive the referrer's identifier.

4. The adapters and what they do (and don't) send

The OpenClaw plugin, Claude Code hook, and browser extension run on your device and communicate primarily with a local core service on your machine. By default, that local core service:

• Does not send your conversation content to our servers. Concept matching happens entirely on your device against a local copy of the registry.
• Does not phone home. No periodic check-ins, no anonymous usage pings, no "did this user use the product today" beacons.
• Links to public lessons. Opening a learn-icon causes your browser to request the public concept page and any ordinary page resources. Default links use the concept identifier and optional public video timestamps; the local core does not upload the surrounding conversation or source code. Shared catalog demand is generated by the hosted learning-library request, not by a local-core tracking upload.

If you self-host the core service or modify the open-source adapters, those modifications are governed by the MIT License and are outside this policy's scope.

5. Public lesson requests and optional context sharing

Opening a learn-icon requests a public concept page. The current lesson explanation is shared public content. Opening it does not automatically send a paragraph from the coding conversation, upload project files, enable LLM personalization, or grant consent to share private context.

The learning library accepts only registered public concept and category choices. Missing or stale resources can create the aggregate editorial request described in Section 3.2. It contains neither the original coding task nor a user's identity. Provider discovery runs separately using approved public search categories; it does not receive raw code from these requests. A current reviewed catalog hit is reused without creating a new discovery request.

Separate context submissions and audit access.

Optional context sharing requires its own clear feature explanation and user choice. It is separate from robot preferences, account sign-in, and public lesson lookup. If you deliberately submit context through a separately enabled feature, authenticated submissions are stored in your account's context log. At human-wants-to-learn.dev/me/context-log you can inspect the stored timestamp, concept identifier, submitted content, and recorded provider field, and clear those entries. The configured context-log retention period is 90 days; deployment of its cleanup operations must be verified before relying on that period. These submissions are not automatically discarded at the end of the request.

Paid or bring-your-own-key LLM personalization remains proposed functionality in this draft, rather than a description of the current static lesson. Its consent, payload limits, provider handling, and deletion behavior require separate verification before activation. Do not submit secrets, credentials, or private project material to a public lesson URL or shared catalog request.

6. What we do not collect

We do not collect, and we do not knowingly receive from any source:

• Your conversation history with AI agents through the default local-core or public lesson lookup path. Separately submitted context is described in Section 5.
• The contents of your code repositories, files, or environment.
• Behavioral data across third-party websites (no cross-site tracking).
• Device fingerprints.
• Precise geolocation.
• Sensitive personal data (race, ethnicity, religion, sexual orientation, biometric data, health information, etc.) unless you voluntarily submit it (for example, in a support request or as a Tutor's biography), in which case we treat it with elevated care.
• Information about minors under 13 (or under 16 in jurisdictions where that is the minimum). See Section 11.

7. Cookies and local storage

We use a minimal set of cookies and browser storage mechanisms:

• Strictly necessary — session cookies for authentication, CSRF protection, and to remember whether you have accepted this policy.
• Functional — local storage for your preferences (audience level, theme, layout) and, for BYO-key users in v2, your encrypted LLM API key.
• Engagement (opt-in only) — a single first-party cookie that records whether you opted into anonymous, aggregated engagement telemetry. Defaults to off.

We do not use third-party tracking cookies, advertising cookies, or analytics cookies that share data with third-party advertising networks.

Our ad partner (Carbon Ads) serves contextual ads that do not require behavioral tracking cookies. [COUNSEL] confirm any disclosure required by the partner's actual practice.

8. Advertising

We display contextual ads on free-tier hosted concept pages (v1). Ads are selected based on the topic of the concept page being viewed (for example, an AWS-related ad on a CloudFormation concept page).

We work with Carbon Ads, which (per its own privacy practices) does not use behavioral targeting or cross-site tracking. Carbon Ads may record aggregate ad delivery metrics (impressions, clicks) but does not build a profile of you.

Subscribed users (v2) see no ads.

Direct ad sales, if introduced in the future, will be added to this policy with at least thirty (30) days' notice.

9. Tutoring session recordings

Live tutoring Sessions are recorded by default with explicit consent solicited from both you and the Tutor at the start of the Session. If either party declines, the Session may be cancelled or proceed without recording.

Recordings are:

• Stored encrypted at rest with our video provider Daily.co;
• Retained for ninety (90) days from the date of the Session;
• Used only for dispute resolution and safety review;
• Shared with the Booking User upon request for their own reference;
• Deleted automatically at the end of the retention period.

You may request deletion of your Session recording before the retention period ends.

10. How we use the information we collect

We use the information described above to:

• Provide and operate the Services;
• Process payments and pay Tutors;
• Send transactional emails (account confirmations, receipts, dispute notices);
• Send our newsletter, if you have opted in;
• Calibrate registry curation based on aggregated engagement (which clips are working, which are being skipped) — never based on individual user identity;
• Respond to support requests;
• Investigate and prevent abuse, fraud, security incidents, and Terms of Service violations;
• Meet legal obligations.

We do not use your data for behavioral advertising. We do not sell your data. We do not share your data with advertisers, except in aggregate, non-identifying form.

11. Children's privacy

The Services are not directed to or intended for children under 13 (or under 16 in the European Economic Area, the United Kingdom, and other jurisdictions with a higher applicable minimum). We do not knowingly collect information from children under those ages. If we learn that we have inadvertently collected such information, we will delete it promptly. If you believe we have information about a child, please contact [email protected].

[COUNSEL] confirm COPPA compliance posture and any required parental-consent flows.

12. Your rights

We respect your rights regardless of where you live. Some jurisdictions grant specific rights summarized below; users in other jurisdictions may have similar rights under local law.

12.1 Universal rights

• Access. You can view and download most of your personal data from your account settings.
• Correction. You can update your profile information at any time.
• Deletion. You can delete your account from settings; deletion completes within thirty (30) days. Some data may be retained for limited legal or security purposes (see Section 14).
• Opt-out of newsletter. Every newsletter email includes a one-click unsubscribe.
• Opt-out of engagement telemetry. Toggle in account settings.

12.2 GDPR rights (European Economic Area, United Kingdom, and Switzerland)

In addition to the universal rights:

• Right of access. Request a copy of the personal data we hold about you.
• Right to rectification. Request correction of inaccurate data.
• Right to erasure ("right to be forgotten"). Request deletion of your data.
• Right to restriction. Request that we limit how we process your data.
• Right to data portability. Request a machine-readable copy of your data.
• Right to object. Object to processing based on legitimate interests.
• Right to withdraw consent. Where processing is based on consent, you can withdraw it at any time.
• Right to lodge a complaint with your local data protection authority.

To exercise these rights, contact [email protected]. We will respond within thirty (30) days. If we require identity verification, we will let you know.

Legal bases for processing (GDPR Art. 6):

• Performance of a contract (Account management, paid Services).
• Legitimate interests (security, abuse prevention, service improvement).
• Consent (newsletter, optional telemetry, marketing communications, BYO-key storage).
• Legal obligations (tax records, compliance with valid legal process).

12.3 CCPA / CPRA rights (California)

If you are a California resident:

• Right to know what personal information we collect, use, disclose, and (if applicable) sell.
• Right to delete your personal information, subject to legal exceptions.
• Right to correct inaccurate personal information.
• Right to opt out of sale or sharing. We do not sell or share personal information for cross-context behavioral advertising; this right is honored by default.
• Right to non-discrimination for exercising your rights.
• Right to limit use of sensitive personal information to the purposes for which it was collected.

To exercise these rights, contact [email protected] or use the in-account self-serve flows. Authorized agents may submit requests on your behalf with written authorization.

We do not engage in financial-incentive programs that involve personal-information collection.

12.4 Other jurisdictions

If you reside in a jurisdiction with privacy laws not specifically named above (Canada, Brazil, Japan, Australia, etc.), [COUNSEL] confirm any specific disclosures required.

13. Data security

We protect your information with industry-standard security practices, including:

• TLS encryption in transit;
• Encryption at rest for sensitive data (passwords, session recordings, payment metadata);
• Role-based access controls;
• Minimum-privilege principles for employee and contractor access;
• Regular security review and dependency monitoring;
• Incident response procedures.

No system is perfectly secure. If we become aware of a security incident affecting your data, we will notify you and the relevant authorities within the timeframes required by applicable law.

14. Data retention

[COUNSEL] confirm these periods against the legal minimums and maximums in target jurisdictions.

15. International data transfers

Our service infrastructure is hosted with Cloudflare and Supabase. Data may be processed in the United States, the European Union, and other jurisdictions where our service providers operate.

For transfers of personal data from the European Economic Area, United Kingdom, or Switzerland to other countries, we rely on Standard Contractual Clauses approved by the European Commission and the supplementary measures described in Schrems II guidance.

[COUNSEL] confirm the specific transfer mechanism applicable and add any required Data Processing Addendum (DPA) language.

16. Third-party services

The Services integrate with the third parties listed below. Your data may be processed by these third parties according to their own privacy practices.

• Supabase (authentication, database) — https://supabase.com/privacy
• Cloudflare (hosting, CDN, DNS) — https://www.cloudflare.com/privacypolicy/
• Stripe (payments) — https://stripe.com/privacy
• Daily.co (video for tutoring) — https://www.daily.co/legal/privacy
• Cal.com (booking) — https://cal.com/privacy
• Carbon Ads (advertising, primary) — https://www.carbonads.net/privacy
• EthicalAds (advertising, fallback) — https://www.ethicalads.io/privacy-policy/
• YouTube (embedded video content) — https://policies.google.com/privacy
• GitHub / Giscus (comments, registry hosting) — https://docs.github.com/site-policy/privacy-policies/github-general-privacy-statement
• Beehiiv (newsletter) — https://www.beehiiv.com/privacy
• Anthropic (LLM for v2 personalization and ETI pipeline) — https://www.anthropic.com/legal/privacy
• Google Fonts (typography) — note: served via CSS only, no font tracking

We update this list when we add or change providers.

17. Do Not Track signals

We honor the "Global Privacy Control" (GPC) signal as an opt-out of any sale or sharing of personal information for cross-context behavioral advertising — which we already do not engage in by default. We do not respond to browser "Do Not Track" headers separately, as their interpretation is not standardized.

18. Changes to this policy

We may update this Privacy Policy from time to time. For material changes, we will provide at least thirty (30) days' notice by email (to account holders) and by a prominent notice on the Site. The "Last updated" date at the top reflects when this policy was last changed.

We will preserve and link to previous versions of this policy at human-wants-to-learn.dev/privacy/history so you can review what has changed over time.

19. Contact us

For privacy questions, requests, or complaints:

• Email: [email protected]
• Postal mail: James Jackson Leach, c/o HWTL Legal, Austin, Texas, USA — exact postal address available on request via the privacy contact
• EU Representative (if you are an EEA resident): to be appointed by counsel before EEA/UK launch
• UK Representative (if you are a UK resident): to be appointed by counsel before EEA/UK launch

For general support, see [email protected].

For legal notices and process: [email protected].

End of Privacy Policy draft. Status: pending counsel review. Do not publish in current form.