Preparing this page
The requested public page is being prepared.
Provisional private beta
This provisional draft records the privacy scope for the free, invite-only, adult beta. The initial copy was reviewed on 4 August 2026; the owner reviewed and approved the factual display-preference disclosure on 9 August 2026. This remains product-governance approval, not counsel review or legal clearance.
LearningBored handles account identifiers, source documents and selected passages, generated Board specifications, recall items, depictive figure bytes, Chalk ledger events, review history, authentication-email delivery data, and correction reports needed to operate the private study workflow.
It is not designed for public publishing or cross-user collaboration.
Source and study artifacts are owner-scoped. There are no public Board URLs, shared decks, or community library. Private figure bytes follow the same ownership boundary as the passage that produced them.
The approved beta topology uses owner-operated servers for the public site, Reader, authentication, databases, API, background worker, and job queue. It uses Cloudflare for DNS, protected access to the application, and private EU R2 objects; OpenAI for text, embeddings, depictive figure generation, landmark placement, and glyph checks; Resend for authentication email delivery; and server-side Sentry for restricted error reporting. Before invitations, the deployed provider list and settings must be verified against this notice.
To make a Board and recall items, OpenAI receives selected source text and the structured fields needed for text and embedding stages. If a Board includes a depictive figure, OpenAI receives validated semantic fields to generate it; the resulting candidate bytes are then sent for landmark placement and glyph checks. Resend receives the account email address and authentication-email delivery data. Other providers receive only the account, content, storage, or operational data needed for their named function.
LearningBored does not use learner material to train models or for unrelated product improvement. OpenAI states that API inputs and outputs are not used for training by default unless the customer opts in, while default abuse-monitoring logs may contain inputs and outputs ordinarily for up to 30 days, subject to OpenAI’s stated legal and safety exceptions. The intended Responses requests disable application-state storage, but the actual account controls, processing locations, contracts, subprocessors, transfers, and retention behavior still require verification. See the OpenAI data-controls documentation.
Server-side Sentry error reporting is the approved beta monitoring destination. Its payload is restricted to allowlisted operational metadata and excludes passage text, Board content, recall content, figure bytes, and raw error messages.
PostHog, advertising, marketing analytics, and optional public-site measurement remain off for the private beta.
The public site can retain your Light or Dark display choice in this browser’s local storage under learningbored.theme.v1. That preference stays in the browser and is not sent to the LearningBored API or monitoring providers. Choosing System removes it.
The product includes owner-authorized deletion paths for source documents and their derived artifacts, including private figure objects. Privacy and support requests can be sent to [email protected]. Exact retention periods or criteria and the formal controller details required by the final notice remain pending under the owner-approved provisional private-beta process. That process does not create an exemption from applicable law.
Account deletion blocks new access while cleanup continues. Previously issued Reader download links can remain valid for up to 30 minutes. If a storage write cannot be confirmed, cleanup may remain pending indefinitely. We retain the ownership identity and cleanup records needed to finish that work and do not report deletion as complete while unresolved writes remain.
Operational security records may require a separately disclosed retention period.
You can ask about access, correction, deletion, restriction, objection, or portability by contacting [email protected]. We may need to verify that the request comes from the account owner. Applicable law determines which rights and response periods apply. If the GDPR applies, you may also lodge a complaint with a supervisory authority. The controller identity, processing legal bases, responsible authority, retention criteria, and transfer safeguards remain pending and must be supplied in the effective notice. This draft does not limit rights that applicable law gives you.