Privacy policy

This policy explains what Cloze collects, why, and what you can do about it. Cloze is a personal project run from the United Kingdom. If anything below isn't clear, email support@clozenotes.co.uk.

Who's responsible

Cloze (clozenotes.co.uk) is a personal project run from the United Kingdom. For the purposes of UK GDPR, the operator of Cloze is the data controller. Contact: support@clozenotes.co.uk.

What we collect

• Account: your email address, display name, username, and which provider you signed in with (Google or email + password).
• Content you make: topics, paragraphs, folders, mistakes, review state, and any images you upload as diagrams.
• Activity: when you practise (used to compute streaks), which paragraphs you got right or wrong, and basic counters per topic.
• Technical: your IP address and browser type, kept temporarily in server logs by our hosting and database providers for security and abuse prevention.
• Voice (premium only): if you enable Whisper voice mode, short audio clips are streamed to OpenAI for transcription. We don't store the audio on our servers.
• Payments (when live): if you subscribe, your card details go directly to Stripe. We only keep a Stripe customer ID, your current tier, and your next renewal date.

Why we collect it

To run the service: keep you signed in, save your topics, show your streak, take payment if you upgrade. We do not profile you, sell your data, or use it for advertising.

Lawful basis under UK GDPR: performance of a contract for the account and content you create; legitimate interests for technical logs used to keep the service secure.

Who else sees it (sub-processors)

We use the following companies to help run Cloze. They only see what's needed for their job, and we don't share your data with anyone else.

• Supabase — database, authentication and file storage. Hosted in the EU (Ireland).
• Cloudflare — hosting, CDN and DDoS protection for the website.
• Google — only if you choose "Sign in with Google", in which case Google shares your name and email with us.
• Resend — sends transactional emails (sign-up confirmation, password resets).
• OpenAI — only when you use a premium AI feature (Whisper voice, auto-cloze, AI diagrams). Your prompt or audio is sent for processing and is not used to train their models, per their API policy.
• Stripe — processes payments once subscriptions are live. Stripe sees your card details; we don't.

International transfers

OpenAI, Stripe and Cloudflare are based in the United States. When your data leaves the UK to reach them, it's covered by the UK International Data Transfer Agreement and the equivalent standard contractual clauses.

Cookies and local storage

Cloze sets only strictly-necessary cookies needed to keep you signed in. We do not use analytics, advertising, marketing or tracking cookies.

• sb-access-token, sb-refresh-token — set by Supabase to keep your session active. Cleared when you sign out.
• cloze.theme, cloze.celebrated.* — small values stored in your browser's local storage to remember your theme and which streak milestones you've dismissed. These never leave your device.

You can clear all of these any time from your browser's settings.

How long we keep it

Your account and content are kept as long as you have an account. When you delete your account, your data is removed from our live database immediately. Backups taken before deletion are overwritten on a rolling 30-day cycle.

Your rights

Under UK GDPR you can:

• Ask for a copy of your data — there's a Download my data button in Settings.
• Correct anything wrong about you — update it in Settings, or email us.
• Delete your account and all data — there's a Delete account button in Settings.
• Object to how we use your data, or restrict it.
• Complain to the ICO (ico.org.uk) if you think we've handled your data badly.

Children

Cloze is for students aged 13 and over. If you're under 13, please don't create an account. If you're 13–17, talk to a parent or guardian before signing up if you want to. We've designed Cloze to follow the UK's Age Appropriate Design Code: profiles are private by default, no public leaderboards, no advertising or profiling, and we don't share your data with anyone outside the sub-processors listed above.

Changes to this policy

If we make material changes (for example adding a new sub-processor), we'll update the "Last updated" date at the top of this page and, if it affects you significantly, email you about it.

Contact

Questions, requests or complaints: support@clozenotes.co.uk.