Privacy Policy — The Runtime Theory

1. Who we are

TheRuntimeTheory (“we”, “us”) operates this website and is the controller of the personal data described here. Contact us at theruntimetheory@gmail.com or Kolkata.

2. What we collect

Account: your email address and, if provided, your name. You sign in with a one-time code or link — we never store passwords.
Sessions and security: for each sign-in session we store the IP address and browser user agent, so you can be protected against account misuse. IP addresses are also used briefly to rate-limit requests and to verify you are human (Cloudflare Turnstile).
Learning activity: bookmarks, reading progress, item status, and topic and track enrollments you create.
Newsletter: your email address, subscription status and the dates you confirmed or unsubscribed.
Bug reports: the page address, what you wrote, an optional email address for a reply, your browser user agent and whether you were signed in. We use it only to investigate and reply; a member's reports are deleted with their account.
Payments: if you buy a membership, Stripe processes your payment. We receive and store your Stripe customer ID, plan, subscription status, billing dates and purchase amounts. We never receive or store your card number.
Technical data: server logs and error reports (which page failed and how), used to keep the service running. Error reports exclude cookies, request bodies and sign-in tokens.

If analytics are enabled, we use Plausible, which counts page views without cookies and without collecting personal data.

3. Why we use it (legal bases)

To provide the service you asked for (contract): your account, progress, bookmarks and membership.
To keep the service secure and working (legitimate interests): rate limiting, bot protection, fraud prevention, error monitoring.
To send the newsletter (consent): only after you confirm, and you can withdraw at any time with the unsubscribe link or from your account page.
Your agreement to these terms (consent): ticking the box at sign-in and on the welcome step records which policy versions you accepted and when, shown in your account export.
To meet legal obligations: tax and accounting records for payments.

4. Emails we send

Transactional emails — sign-in codes and links, a one-time welcome email, account deletion confirmations and payment receipts — are part of the service. The newsletter is sent only if you subscribe and confirm, and every issue includes an unsubscribe link.

5. Who processes data for us

We use these service providers, each bound by a data processing agreement:

Vercel — website hosting and request logs
Neon — managed PostgreSQL database
Stripe — payments, invoices and receipts
Resend — sending transactional email
Our newsletter delivery provider — sending the newsletter to confirmed subscribers
Cloudflare Turnstile — bot protection on forms
Upstash — short-lived rate-limit counters
Sentry — error monitoring
Plausible — cookieless, aggregate analytics (when enabled)

Videos are embedded from YouTube (privacy-enhanced mode, loaded only when you press play) and Cloudinary. Several providers are based in the United States; transfers rely on the EU Standard Contractual Clauses or equivalent safeguards. We do not sell personal data or share it for advertising.

6. How long we keep it

Account and learning activity: until you delete your account.
Sessions, sign-in codes and links: until they expire or you sign out, then deleted within a day.
Newsletter: until you unsubscribe (deleting your account removes it entirely). A sign-up you never confirm is deleted after 30 days.
Payment records: Stripe keeps invoices and transaction records for as long as tax and accounting law requires, even after you delete your account. Our own log of Stripe notifications (event IDs, no card details) is deleted after 90 days.
Logs and error reports: typically up to 90 days.

7. Your rights and choices

You can access, correct, export or delete your data. Most of this is self-service on your account page: “Download my data” exports everything we hold about you as JSON, and “Delete account” removes your account and cancels any active subscription.

Depending on where you live (for example under the GDPR, UK GDPR or California law) you may also object to or restrict processing and complain to your data protection authority. Email theruntimetheory@gmail.com and we will respond within 30 days.

8. Cookies

We only use cookies that are strictly necessary (keeping you signed in) and store a few preferences in your browser. See the Cookie Policy.

9. Children

The service is not directed to children under 16, and we do not knowingly collect their data.

10. Changes

If we change this policy materially, we will update the date above and, for significant changes, notify account holders by email before they take effect.