This Privacy Policy explains how Affectly, a product of Origae ("Affectly," "we," "our," or "us"), collects, uses, discloses, and safeguards your information when you use our emotion aware learning platform (the "Service"). Please read it together with our Terms of Service.

Our approach to your privacy

Privacy should mean staying in control, not hiding. We collect only what we need to help you learn, we are clear about what that is, and we never sell your personal information. You choose what to share (including whether to share how you feel), you can see and delete your data at any time, and we deliberately keep your learning preferences separate from any idea of a medical diagnosis. The full detail is below.

1. Who We Are (Data Controller)

The data controller responsible for your personal information is Origae (trading as Affectly), 329/98-100 Elizabeth Street, Melbourne, VIC 3000, Australia. You can contact us about privacy at origae.dev@gmail.com.

UK/EU representative (GDPR Article 27). We are established in Australia and have no establishment in the EU or UK. We have not appointed an Article 27 representative, because we consider our processing of EU and UK personal data to fall within the Article 27(2)(a) derogation: it is occasional, does not involve special category data on a large scale, and is unlikely to result in a risk to your rights and freedoms. We have recorded that assessment in writing, we keep it under review, and we will appoint a representative if our EU or UK user numbers grow or if we begin marketing into those regions. Until then, please direct all data protection matters (including anything you would otherwise raise with a representative) to origae.dev@gmail.com, and we will respond within the timeframes required by the GDPR and UK GDPR.

2. Who the Service Is For (General Audience)

Affectly is a general audience learning service. It is not directed to children. An account of your own is for someone aged 16 or over. You must be at least 18 (or have a parent or guardian's consent) to make a purchase. A child aged 10 to 15 can use Affectly only through a family account that a parent or carer sets up and manages, and a 16 or 17 year old can use either a family account or an account of their own. When a parent or carer adds a child, they confirm: I am this child's parent or carer, my child is 10 or older, and I agree to the Terms and Privacy Policy on their behalf.

Affectly is not for children under 10, whether through their own account, as a guest or through a family profile. If we learn a profile belongs to a child under 10, we will remove it.

We want to be precise about how that is applied, rather than imply more than we do. When you create an account we enforce it: we ask for your date of birth and refuse registration below the minimum age for your country. A sample lesson can be opened without an account, and there we have no way to check anyone's age, so we rely on you to respect the requirement above.

Two things we do regardless: we do not infer or record the emotional state of visitors who are not signed in, and we do not knowingly collect personal information from anyone under 16 except where a parent or carer has created a family profile for a child aged 10 to 17. If you believe someone under 16 has an account of their own, contact us at origae.dev@gmail.com and we will delete it promptly.

For a family profile we collect the child's nickname and age band, which the parent or carer gives us, and the child's activity in Affectly: their lessons and messages to Ari (the messages are sent to our AI provider, and the text Ari speaks is sent to our speech provider, as described in Section 11), and any mood check in the child chooses to share. We do not estimate a child's mood or learning pace from how they reply. We use a mood check in, and show it to the parent in reports, only while the parent or carer agrees. They can agree when they add the child, or later from the family page. Where we also ask the young person, that agreement is needed as well. How I learn settings are kept only on that same kind of agreement, and we remove those settings from the child's profile if the agreement ends. We also keep the parent's email address, the country the parent gives us for the family, the country of the connection when the family was created, a record of each consent, and a salted hash of the parent PIN, which we keep until the parent deletes their own account. Only the parent or carer can see a child's progress report, and only they can switch into the child's profile to read that child's lessons and chats. Both need the parent PIN, and both work only while they have Premium. A parent or carer can switch a consent off, or delete the child's profile, from the family page at any time, including after Premium ends, once they have entered their PIN. Switching a consent on also needs Premium. They can email origae.dev@gmail.com to ask for access, correction or deletion. Deleting a profile removes the child's login and their records in our database in that step, including the consent records. We keep a short record that the deletion happened: the date, the parent's email, the reason, the deleted profile's internal ID, and how many records were deleted. That record does not include the child's nickname, lessons or messages, and we keep it as an audit log as described in Section 9. Section 9 is how long learning sessions are kept while a profile is still in use. This deletion does not wait for the period in Section 9. When a parent adds a child, we record for analytics only that a child was added and the child's age band. Product analytics in the browser are switched off whenever a family child is signed in, and no analytics profile is created for a child. The analytics event for a child's sign-up uses a random ID that is not linked to the child's account or to the parent.

3. Information We Collect

3.1 Personal Information

We may collect personal information that you voluntarily provide, including:

Name and email address when creating an account
Profile information and preferences
Payment information for premium services (processed by secure third party providers; we do not store full card details)
Communications you send to us

3.2 Learning Preferences and Emotional Indicators

To personalize how the Service teaches you, we process:

Emotional state indicators that you voluntarily share (for example, selecting how you feel before a lesson), and, only if you agree, Affectly's estimate of how you are doing from how you reply
Learning progress, session data, and performance metrics
Interaction patterns with the Service
Flashcard reviews and study habits
"How I learn" preferences that describe how you like content presented

Important: we do not collect medical or diagnostic data. Affectly does not ask for, require, or store medical diagnoses. Our "How I learn" feature captures learning style preferences (such as a preference for shorter chunks, more structure, or read along audio), not health conditions or disability status. Any preset you choose to prefill those preferences is used transiently to configure your settings and is not stored as a label or as a record of any diagnosis. We designed the Service this way specifically to keep your preferences about how you learn separate from any information about a diagnosis.

Emotional indicators are used only to adapt the tone, pace, and structure of your lessons. You can use the Service without providing them, and you can delete this data at any time (see Section 9).

3.3 Automatically Collected Information

We automatically collect certain information, including:

Device information (type, operating system, browser)
IP address and general (city or country level) location data
Usage data. Most of this we analyse ourselves in our own database. We also use PostHog, a product analytics service, to count page views, page leaves, and a small number of product events (for example, that a lesson was started). It is configured to store nothing on your device, to record no page content, and to send only the page path, never the query string (see Section 10). Account events, also described in Section 10, are recorded on our servers when an account is created, when a parent adds a child, or when a purchase is confirmed. They do not include an email address, a name, or a date of birth.
Strictly necessary cookies (see Section 10)

4. How We Use Your Information and Our Legal Bases

Where the GDPR or UK GDPR applies, we rely on the following legal bases:

Contract: to create and manage your account, deliver the Service, and process transactions.
Consent: to process emotional state indicators you choose to share and to send optional marketing. You may withdraw consent at any time without affecting prior processing.
Legitimate interests: to secure the Service, prevent fraud and abuse, and improve and analyze our features, balanced against your rights.
Legal obligation: to comply with applicable law, tax, and record keeping requirements.

We do not use your personal information to make decisions producing legal or similarly significant effects about you by solely automated means. Ari's responses adapt content but do not make such decisions.

5. Emotional and Learning Support Information

Some information you give us could be considered sensitive information under the Privacy Act 1988 (Cth), or special category data under the UK and EU GDPR. We treat it that way.

What we collect. How you tell us you are feeling, when you choose to tell us, and, if you agree, Affectly's estimate of how you are doing, worked out from signals such as how quickly you reply and the words you use. Where you turn them on, the learning support settings that shape how Ari explains things, for example smaller chunks, plainer language, or reading aloud. For a child's profile we never make that estimate (Section 2).

What we do not collect. We never ask for and never store a diagnosis, a condition, or a label. Where a preset is named after a way of learning, we keep only the resulting settings and discard the name at the moment you choose it. It is not written to our servers and we cannot recover it.

Our lawful basis is your explicit consent, and we ask first. The first time you pick a mood we ask, "Use my mood to shape my lessons?" Your mood is not used, estimated, or saved unless you say yes, and we record when you answered. You can change your answer at any time in Settings; saying no stops new moods being used or saved. For learning support settings, you give consent by switching a support on. You do not have to do either, and the Service works without both.

How we use it. Only to adapt how Ari teaches you, and to show you your own history. We do not use it for advertising, we do not sell or share it, and we do not disclose it to anyone except the AI provider needed to generate your reply, as described in Section 6.

Withdrawing consent. Turn the supports off, or delete your account, at any time. Deleting your account deletes this information. Withdrawing consent does not affect what we lawfully did beforehand.

6. AI Processing

Our AI tutor ("Ari") is powered by two named third party providers:

Groq generates Ari's written replies. We send the text of your conversation with Ari, the topic or lesson you are studying, and (if you chose to share it) the emotional indicator and "How I learn" presentation preferences for that session.
ElevenLabs generates Ari's spoken voice. We send only the text of the reply that Ari is about to speak. Requests are made from our servers, not from your browser or device.

What we do not send. We do not send your name, your email address, your account identifier, or your payment details to either provider. Neither provider is given a way to link a conversation back to your account.

Training. Your messages are not used to train these providers' models and are not retained by them for that purpose. We also do not use your conversations to train any model of our own. This matches the position stated in our Terms of Service: neither document grants us or anyone else a licence to train on your content.

Human review. Ari's responses are generated automatically and are not reviewed by a person before you see them.

Automated decisions. Ari adapts the tone, pace, and structure of your lessons, but we do not make decisions producing legal or similarly significant effects about you by solely automated means (GDPR Article 22).

Please do not share sensitive personal information, credentials, or other people's personal data in your messages. AI generated content is for general educational purposes only, may be inaccurate, and is not professional, medical, legal, or financial advice.

7. Data Sharing and Disclosure

We do not sell your personal information. We may share it with:

Service providers: third parties who process data on our behalf under contract (hosting, database and authentication, AI text generation, text to speech, rate limiting, and payment processing). Each one is named in Section 13.
Legal requirements: where required by law, court order, or a governmental authority, or to protect our rights, users, or the public.
Business transfers: in connection with a merger, acquisition, financing, or sale of assets, subject to this Policy.
With your consent: for any other purpose you explicitly agree to.

8. Data Security

We implement industry standard safeguards, including encryption in transit, access controls, and secure infrastructure. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If we become aware of a personal data breach that is likely to result in a risk to your rights, we will notify affected users and the relevant supervisory authority as required by applicable law (including the GDPR/UK GDPR 72 hour rule and the Australian Notifiable Data Breaches scheme).

8.1 Reporting a Security Vulnerability

If you believe you have found a security vulnerability in Affectly, please report it to origae.dev@gmail.com with enough detail for us to reproduce it. We aim to acknowledge reports within 5 business days.

Safe harbour. If you research and report a vulnerability in good faith (meaning you act only against your own account, make a genuine effort to avoid accessing, modifying, or destroying anyone else's data, avoid degrading the Service for others, and give us a reasonable opportunity to fix the issue before disclosing it publicly), we will not pursue or support legal action against you for that research, and we will treat it as authorised conduct under applicable computer misuse law.

9. Data Retention and Deletion

We retain your information for as long as your account is active or as needed to provide the Service. Specific retention periods include:

Account data: retained until you delete your account
Learning sessions, free accounts: deleted after 24 hours
Learning sessions, Premium: deleted 3 years after each session started
Flashcard data: retained until you delete it or your account, including after Premium ends
Course progress and XP: reset 30 days after Premium ends
Uploaded documents: deleted 1 year after upload, or sooner if you delete them
Login records: IP address, device and city removed after 90 days; the date and country stay with your account until it is deleted
Audit logs: retained for up to 7 years for security and legal compliance

You may request deletion at any time. Upon account deletion we will delete or anonymize your personal data within 30 days, except where retention is required by law.

10. Cookies and Tracking

Affectly sets only strictly necessary cookies. We do not set advertising cookies, analytics cookies, or tracking cookies, and we do not embed advertising pixels or social media widgets. Because we set no nonessential cookies, there is no cookie consent banner to accept or reject: there is nothing to consent to.

Our analytics deliberately sets no cookies. We use PostHog to understand which pages people reach and where they get stuck. Page counts are configured to keep nothing on your device (no cookies, no local storage), so each visit is counted separately and those page counts cannot recognise you when you come back. We have switched off its automatic capture of clicks and typing, and switched off session recording entirely, so it never sees what you write to Ari. We also send only the page path, never the query string, because those can contain a topic you typed or a mood you chose. That is true of the page you open and of the event we send when you leave it. When you leave a page we also send how long you were on it. The page that linked you here is sent as the site and the path only. If the address you opened includes utm_source, utm_medium or utm_campaign, those three labels are sent with that visit's events, including the first message sent. We do not send the rest of the address, including advertising click ids, and we do not send how far down the page you scrolled. Opening a link with internal=1 marks that visit's events internal_user so our own testing can be left out of the counts. That mark is only on the events. It does not create an analytics profile of you. None of this is stored on your device. If your browser sends a "Do Not Track" signal, the browser sends nothing at all: no page views and no product events from your device. Our servers still send the account events described below, which contain no browsing activity.

Account events. When an account is actually created, when a parent adds a child, or when Stripe confirms a purchase, our servers send one event to PostHog. For an account of your own, that event uses your account id, so we can tell that this signup or purchase belongs to that account. No analytics profile is created for anyone from these events. A child's sign-up is counted without the child's account id, nickname, email address or date of birth, and is not linked to the parent. The event can include the kind of account (your own account, a parent account, or a child's profile), whether the signup started on the home education page, the child's age band (10 to 12, 13 to 15, or 16 to 17) when a parent adds a child, the plan, the amount, the currency, and a promotion code we already publish, such as HEA2026. It does not include an email address, a name, or a date of birth, and it does not include the visitor's IP address. These events are sent from our servers, so a browser "Do Not Track" signal does not stop them. If Stripe delivers the same purchase confirmation twice, it is recorded once.

The cookies we do set are the session cookies our authentication provider (Supabase) uses to keep you signed in and to protect your session. They are essential to operating the Service: without them you could not log in and stay logged in. Under the UK and EU ePrivacy rules these fall within the "strictly necessary" exemption and do not require consent.

We also store some things in your browser's local storage rather than in cookies, for example whether you have seen our welcome screens. That information stays on your device, is never sent to an advertiser, and is cleared when you clear your browser data.

Your "How I learn" presentation preferences work differently, and we want to be precise about it. They are kept on your device so a page can render correctly the moment it loads, but if you are signed in they are also saved to your account on our servers, so that they follow you to another device. Clearing your browser data does not remove that copy. They are never sent to an advertiser, and the neurotype label you may have started from is never stored at all, only the individual presentation settings you ended up with.

Our hosting provider (Vercel) records standard server request logs for security and reliability. These are server side logs, not cookies, and are not used to build an advertising or cross site profile of you.

For the full list of cookies we set and what each one does, see our Cookie Policy. You can also block or delete cookies through your browser settings, though blocking our session cookies will prevent you from signing in. If we ever introduce a nonessential cookie, we will ask for your consent first and add a way to withdraw it.

11. International Data Transfers

Your account, learning history, and session records are both stored and processed in Sydney, Australia: our database and the application servers that read it are located there. Some features still involve providers outside Australia. In particular, the text of your conversations with Ari is sent to our AI provider in the United States to generate a reply, and the text Ari speaks is sent to our speech provider there. Page counts from the browser, and account events from our servers, are sent to PostHog in the United States. Account events are sent without the visitor's IP address. Where we transfer personal data out of the UK, EEA, or Australia, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses, the UK International Data Transfer Agreement/Addendum, adequacy decisions, or the EU-US and UK-US Data Privacy Framework, as applicable. Details are available on request.

12. Your Rights and Choices

Depending on where you live, you may have the right to:

Access, correct, or delete your personal information
Object to or restrict certain processing
Data portability
Withdraw consent at any time
Lodge a complaint with a supervisory authority

You can do two of these yourself, at any time, in Settings: Download your data gives you a copy of your account details and learning records in a standard format (JSON), and Delete Account removes it. For anything else, email origae.dev@gmail.com. We will respond within the timeframe required by applicable law.

12.1 UK & EEA (GDPR / UK GDPR)

If you are in the UK or EEA, you have rights of access, rectification, erasure, restriction, portability, and objection, and the right to withdraw consent. You may complain to your local supervisory authority: in the UK, the Information Commissioner's Office (ICO) at ico.org.uk; in Ireland, the Data Protection Commission at dataprotection.ie.

12.2 Australia (Privacy Act 1988)

If you are in Australia, you have rights under the Privacy Act 1988 (Cth) and the Australian Privacy Principles, including access, correction, complaint, anonymity where lawful and practicable, and opting out of direct marketing. Your account and learning data is stored and processed in Australia: both our database and our application servers are in Sydney. Some processing still happens overseas: your messages to Ari go to our AI provider in the United States to generate a reply, and Ari's spoken replies go to a speech provider there. Those providers are subject to contractual obligations to protect your information, as required by Australian Privacy Principle 8. If you are not satisfied with our response to a complaint, you may contact the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au or 1300 363 992.

12.3 Canada, New Zealand & South Africa

If you are in Canada (PIPEDA), New Zealand (Privacy Act 2020), or South Africa (POPIA), you have rights of access and correction and may complain to your national privacy regulator. Contact us to exercise these rights.

12.4 United States (California)

California residents have rights under the CCPA/CPRA to know, access, correct, delete, and limit the use of sensitive personal information, and to opt out of the sale or sharing of personal information. We do not sell or share personal information as those terms are defined by law. We will not discriminate against you for exercising your rights.

12.5 Global Privacy Control and "Do Not Sell"

We do not sell or share your personal information for cross-context behavioural advertising, we run no advertising cookies or trackers, and we have no advertising partners. There is therefore nothing for a "Do Not Sell or Share My Personal Information" link to switch off, and we do not display one.

For the same reason, we do not currently detect or act on the Global Privacy Control (GPC) browser signal: there is no selling, sharing, or targeted advertising for it to opt you out of. We are telling you this plainly rather than claiming to honour a signal we do not read. If we ever begin any processing that GPC applies to, we will implement GPC support and update this section before we do so.

13. Third Party Services

Our platform integrates with the following third party processors:

Supabase (Database & Authentication): stores account data, learning progress, and session history. Our database is hosted in Sydney, Australia (AWS ap-southeast-2). Privacy Policy
Groq (AI Processing): powers the AI tutor; your messages are processed to generate responses and are not stored or used for training. Privacy Policy
ElevenLabs (Text to Speech): generates Ari's spoken voice. We send only the text of the reply Ari is about to speak, from our servers; no account identifiers are included. Processes data in the United States. Privacy Policy
PostHog (Product Analytics): counts page views, page leaves, and a small number of product events. Configured to store nothing on your device and to send only the page path, never the query string, with automatic capture and session recording switched off. Processes data in the United States. Privacy Policy
Vercel (Hosting): hosts the application and records standard server request logs (including IP address) for security, reliability, and performance. Our application servers run in Vercel's Sydney, Australia region. Privacy Policy
Upstash (Rate Limiting): operates the store we use to count requests and block abuse. It holds short lived request counters keyed to an account or IP address, and no lesson, message, or emotional indicator content. Privacy Policy
Stripe (Web Payments): processes subscriptions purchased on our website, including card details, billing country, and payment history. Full payment card details go to Stripe and are never stored by us. Privacy Policy
Apple (In App Purchases): processes subscriptions bought through the iOS app. Apple bills you directly and handles cancellations and refunds under its own policies; we receive only confirmation that a valid subscription exists. Privacy Policy

Our database and application servers are both in Australia. The remaining processors above are located outside Australia, the UK, and the EEA (principally in the United States), and transfers to them are covered by the safeguards described in Section 11.

The Service may link to external websites. We are not responsible for their privacy practices and encourage you to review their policies.

14. Changes to This Policy

We may update this Policy from time to time. We will post the updated Policy on this page and update the "Last updated" date, and for material changes we will provide additional notice where required by law.

15. Contact Us

For privacy questions or to exercise your rights, contact:

Origae (Affectly)
329/98-100 Elizabeth Street
Melbourne, VIC 3000, Australia
Privacy & Terms: origae.dev@gmail.com