Privacy Policy

Service: Shadowee (shadowee.org)
Effective Date: July 7, 2026
Last Updated: July 7, 2026

1. Introduction and Scope

This Privacy Policy describes how the operator of Shadowee ("we," "us," "our") collects, uses, stores, and discloses information about you ("User," "you") when you access or use shadowee.org and any related services (collectively, the "Service").

By creating an account or using the Service, you acknowledge that you have read, understood, and agree to the practices described in this Privacy Policy. If you do not agree, you must discontinue use of the Service.

This Privacy Policy is incorporated by reference into our Terms and Conditions. Capitalized terms not defined here have the meanings given in the Terms and Conditions.

2. Information We Collect

We collect the following categories of information:

2.1 Information You Provide Directly

• Account registration data: Your email address, password (stored in hashed form), first name, last name, and date of birth when you create an account. Date of birth is used to verify you meet the minimum age requirement and is not collected from anyone under 13 (such sign-ups are rejected before any data is stored).
• Profile information: Any optional display name or preferences you choose to provide.
• Communications: Messages or inquiries you send us via support channels.

2.2 Information Collected Automatically

When you use the Service, we automatically collect:

• Usage data: Lessons accessed, exercises completed, shadowing session duration, progress and streak data, and feature interactions.
• Device and technical data: Browser type and version, operating system, device type, screen resolution, and IP address.
• Log data: Server logs including timestamps, pages visited, errors encountered, and referring URLs.
• Cookies and similar technologies: See Section 6 below.

2.3 Information We Do Not Collect

We do not intentionally collect:

• Payment card or financial information (handled by third-party payment processors, if applicable).
• Audio recordings of your voice unless you explicitly submit them through a feature designed for that purpose.
• Sensitive personal information such as government ID numbers, health data, or biometric identifiers.

3. How We Use Your Information

We use the information we collect to:

• Operate the Service: Create and manage your account, sync your progress across devices, and deliver lesson content.
• Personalize your experience: Track completed lessons, maintain your learning streak, and surface appropriate content based on your level.
• Communicate with you: Send account-related notifications (e.g., password resets, account changes) and, with your consent, product updates or newsletters.
• Improve the Service: Analyze aggregate usage patterns to understand how users interact with features, fix bugs, and develop new content.
• Ensure security and prevent fraud: Monitor for unauthorized access, abuse, and violations of our Terms and Conditions.
• Comply with legal obligations: Respond to lawful requests from government authorities or as otherwise required by law.

We will not use your information for purposes materially different from those described above without providing you with prior notice and, where required by law, obtaining your consent.

4. Legal Bases for Processing (GDPR / EEA Users)

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, we process your personal data under the following legal bases:

• Performance of a contract: Processing necessary to provide you with the Service pursuant to our Terms and Conditions (e.g., account management, syncing progress).
• Legitimate interests: Processing for our legitimate business interests, such as improving the Service, ensuring security, and preventing fraud, where those interests are not overridden by your rights.
• Consent: Where we send optional marketing communications or use non-essential cookies, we rely on your prior consent, which you may withdraw at any time.
• Legal obligation: Processing required to comply with applicable laws.

5. How We Share Your Information

We do not sell, rent, or trade your personal information to third parties for their own marketing purposes.

We may share your information in the following limited circumstances:

5.1 Service Providers

We may share data with trusted third-party vendors who assist us in operating the Service, subject to confidentiality obligations. These may include:

• Cloud hosting providers (e.g., server infrastructure)
• Analytics providers (e.g., aggregate usage analytics)
• Email delivery services (e.g., transactional email)
• Payment processors (if applicable — they receive payment data directly and we do not store card details)

These providers are authorized to use your data only as necessary to provide services to us and are contractually required to protect it.

5.2 Legal Requirements

We may disclose your information if required to do so by law or in good-faith belief that such disclosure is necessary to: comply with a legal obligation; protect and defend the rights or property of the Operator; prevent fraud or illegal activity; or protect the personal safety of users or the public.

5.3 Business Transfers

In the event of a merger, acquisition, asset sale, or bankruptcy, your information may be transferred as part of that transaction. We will notify you via email or a prominent notice on the Service before your data becomes subject to a materially different privacy policy.

5.4 Aggregated or De-Identified Data

We may share aggregated or de-identified data that cannot reasonably be used to identify you with third parties for research, analytics, or marketing purposes.

6. Cookies and Tracking Technologies

We use cookies and similar technologies (e.g., local storage, session tokens) to operate and improve the Service.

Essential cookies cannot be disabled without breaking the Service. You may control non-essential cookies through your browser settings. Note that disabling certain cookies may affect the functionality of the Service.

We do not use cookies to serve third-party advertising or track you across unaffiliated websites.

7. Data Retention

We retain your personal data for as long as your account is active or as needed to provide the Service. Specifically:

• Account data (email, settings, progress): Retained for the duration of your account, plus up to 90 days after account deletion to allow for recovery requests.
• Log data: Typically retained for up to 12 months for security and debugging purposes.
• Anonymized/aggregated data: May be retained indefinitely as it cannot be linked back to you.

After applicable retention periods, data is securely deleted or anonymized.

8. Data Security

We implement reasonable and appropriate technical and organizational measures to protect your personal information against unauthorized access, loss, destruction, or alteration. These measures include:

• Passwords are stored in hashed form, never in plain text.
• HTTPS encryption for all data in transit.
• Access controls limiting who within our organization can access personal data.
• Regular review of our data collection, storage, and processing practices.

However, no method of transmission over the internet or method of electronic storage is 100% secure. We cannot guarantee the absolute security of your data. By using the Service, you acknowledge and accept this inherent risk.

In the event of a data breach that is likely to result in a risk to your rights and freedoms, we will notify affected users and relevant authorities as required by applicable law.

9. International Data Transfers

The Service is operated from the United States. If you access the Service from outside this country, your information may be transferred to, stored, and processed in a jurisdiction with different data protection laws than your own.

For users in the EEA/UK, where we transfer personal data to countries not deemed adequate by the European Commission, we implement appropriate safeguards such as Standard Contractual Clauses (SCCs) or rely on other lawful transfer mechanisms.

10. Children's Privacy

The Service is not directed to children under the age of 13. We do not knowingly collect personal information from children under 13 without verifiable parental consent. If we become aware that we have inadvertently collected information from a child under 13, we will take steps to delete that information promptly.

If you believe a child under 13 has provided us with personal data without parental consent, please contact us at the address in Section 14.

11. Your Rights and Choices

Depending on your location, you may have the following rights regarding your personal data:

To exercise any of these rights, contact us at the address in Section 14. We will respond within 30 days (or as required by applicable law). We may request verification of your identity before processing your request.

California residents (CCPA): You have the right to know what personal information we collect and disclose, the right to delete personal information, and the right to opt out of the sale of personal information. We do not sell personal information. To submit a CCPA request, contact us at the address below. We will not discriminate against you for exercising these rights.

EEA/UK residents (GDPR/UK GDPR): You also have the right to lodge a complaint with your local supervisory authority if you believe we have processed your personal data unlawfully.

12. Email Communications

If you provide your email address, we may send you:

• Transactional emails: Account confirmation, password resets, security alerts. These are necessary to operate the Service and cannot be opted out of while your account is active.
• Product updates and newsletters: Only with your explicit consent. You may unsubscribe at any time via the unsubscribe link in the email or by contacting us.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Last Updated" date at the top of this page. For material changes, we will provide more prominent notice — such as an in-app notification or an email to your registered address — at least 14 days before the change takes effect.

Your continued use of the Service after the effective date of an updated Privacy Policy constitutes your acceptance of the changes.

14. Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or your personal data, please contact us at:

Email: support@shadowee.org
Website: shadowee.org

We aim to respond to all inquiries within 30 days.