Privacy Policy

The platform stores three kinds of data, and nothing else:

• Account data — your name, your email address, and your password. The password is never stored as text; only a bcrypt hash of it is kept.
• Learning activity — every exercise attempt you make: the answer you gave, whether it was correct, and when it happened.
• Mastery estimates — the per-concept probability of mastery that the knowledge-tracing model derives from your attempts, used to decide when a concept unlocks.

We do not collect phone numbers, location, payment details, or device identifiers. The only cookie used is the session cookie that keeps you signed in; there are no analytics, advertising, or third-party tracking cookies.

Each item has a single purpose. Account data exists so that your progress survives across sessions, which is the core idea of the platform. Attempt history exists so the tutor can grade deterministically, explain the concept behind a wrong answer, and update your mastery estimate. Mastery estimates exist so the system can decide, transparently, whether to advance you or assign more practice. No data is collected for marketing, profiling beyond learning, or resale.

All data is stored in a PostgreSQL database on a single self-hosted virtual machine in Rwanda (hosted on cloud.strettch.com). Grading and knowledge-tracing inference run locally on that machine. Your data is never sent to an external AI provider, identity provider, analytics service, or any other third party. Traffic between your browser and the server is encrypted with TLS.

Brainiacs AI is also a research system. Interaction logs may be analysed to evaluate and improve the tutor, under ethics clearance granted by the ALU Senate's Research Ethics Committee (approval code M26-BSE-062). Before any analysis, learner data is pseudonymised: names and emails are replaced with anonymous identifiers. Results are reported only in aggregate, so no published finding can be traced back to an individual learner. Use of the platform is voluntary and you may stop at any time without consequence.

In line with Rwanda's Law No. 058/2021 relating to the protection of personal data and privacy, you can ask at any time to see the data held about you, to correct it, or to have your account and all associated data permanently deleted. Send the request to the contact address below from the email registered on your account, and it will be honoured within 30 days.

Account and activity data are kept while your account exists, because the mastery model depends on your history. If you delete your account, identifiable data is removed; already-pseudonymised research records, which cannot be linked back to you, may be retained.

If the platform's data practices ever change — for example, if a future version added an external service — this policy will be updated first, the effective date above will change, and the change will be announced on sign-in before it takes effect.