Privacy Policy
ft_transcendence is an AI-driven language learning platform. Teaching a language well means observing how you use it, so this service processes more about your learning behaviour than a typical website does. This policy explains exactly what that means in practice, written to be read rather than skimmed.
Last updated
1. Scope
This policy covers the ft_transcendence web application, its API, and the real-time session service that powers live practice between two learners. It applies to everyone who creates an account, and to visitors who only read public pages such as this one.
ft_transcendence is an academic project built by students. It is not a commercial product, it is not backed by a company, and it should not be treated as a system of record for anything you cannot afford to lose. We still hold ourselves to the practices described here.
2. Data we collect
Account data: the email address and display name you provide at signup, a password stored only as an Argon2 hash, and, if you enable it, two-factor authentication settings. We never store a password in a form we can read.
Learning data: the target language and proficiency level you select, answers submitted to exercises and assessments, the level our assessment engine infers from those answers, streaks, scores, and progress markers used by the gamification features.
Conversation data: the prompts you send to the AI tutor and the responses it returns. In a language learning context these transcripts are the product, because correction and levelling both depend on your previous attempts, including the mistakes.
Interaction data: friend relationships, presence status, messages sent in chat or during a live session, and results of two-player practice rounds. Anything you send to another learner is visible to that learner.
Technical data: IP address, browser user agent, timestamps, and error traces captured by server logs. These are collected to operate the service and to detect abuse, not to build a profile of you.
3. Why we process it
We process account data to authenticate you and to keep sessions attached to the right person. We process learning and conversation data to generate exercises at the right difficulty, to score assessments, and to show you your own history. Both are necessary to deliver the service you asked for.
We process technical data on the basis of legitimate interest in keeping the platform available and free of abuse, including rate limiting and blocking automated traffic. We do not use any of this data for advertising, and we do not sell it.
4. How the AI features use your data
Generating a lesson or grading an answer sends the relevant fragment of your learning history to a large language model. That fragment is the minimum needed for the task: the current exercise, your answer, your level, and recent errors on the same topic. Account identifiers are not included in the prompt.
Retrieval augmented generation searches a curated corpus of learning material, not other user accounts. Your conversations are never retrieved as context for another learner, and they are never added to the shared corpus.
Where a third-party model provider is used, prompts leave our infrastructure and are processed under that provider terms. We select providers that contractually exclude customer prompts from model training. The provider in use at any time is named in the project documentation, and switching providers is treated as a change to this policy.
Automated levelling influences which exercises you see. It has no legal or similarly significant effect, and you can request a human review of any assessment result through the contact address below.
5. How long we keep data
Account data is kept until you delete the account. Learning progress and assessment results are kept for the life of the account, because removing them would reset the levelling that makes the platform useful.
AI conversation transcripts are kept for twelve months, then deleted automatically. Chat messages sent to other learners are kept for twelve months. Server logs containing IP addresses are kept for thirty days, then rotated out.
Deleting your account removes account data, learning data, and transcripts within thirty days. Messages you sent to another learner remain visible to that learner, detached from your profile, because they are part of a conversation you do not solely own. Backups are purged on their own rolling cycle, which completes within ninety days.
8. Your rights
You can request access to the data we hold about you, correction of anything inaccurate, deletion of your account and its contents, a machine-readable export of your learning history and transcripts, restriction of processing while a dispute is open, and objection to processing based on legitimate interest.
Account settings cover the common cases directly: edit your profile, export your data, and delete your account without contacting anyone. For anything the interface does not cover, write to the contact address below. We answer within thirty days.
If you are in the European Economic Area or the United Kingdom, you also have the right to lodge a complaint with your national supervisory authority. Exercising any of these rights never costs you access to the service.
9. Security
All traffic is served over HTTPS. Passwords are hashed with Argon2. Session cookies are httpOnly, secure, and same-site. The database and cache are not published outside the internal network; only the reverse proxy accepts external connections.
No system is perfect, and this one is maintained by students. If you find a vulnerability, report it to the contact address below rather than disclosing it publicly, and we will fix it before saying anything about it.
10. Age requirement
You must be at least sixteen years old to create an account. We do not knowingly collect data from children below that age. If we learn that we have, the account and its data are deleted.
11. Changes to this policy
When this policy changes materially, for example when a new category of data is collected or a new model provider is introduced, we update the date at the top of this page and notify account holders by email before the change takes effect.
12. Contact
Privacy questions and rights requests: privacy@ft-transcendence.example. Security reports go to the same address with SECURITY in the subject line.
ft_transcendence is an academic project, so there is no separate legal entity behind it and no appointed data protection officer. Requests reach the maintaining team directly.