Discere Orare (the “Service”) is operated by Kasey Devine, an individual sole proprietor. This Privacy Notice explains what personal data we collect, why we collect it, who we share it with, and the rights you have. For the purposes of applicable data protection laws, Kasey Devine acts as the data controller for personal data processed through the Service.
1. Personal Data We Collect
- Account information — when you sign in with Google, we receive your name, email address, Google account identifier, and profile picture.
- Learning progress — lessons completed, streaks, graces, hearts, review history, and similar usage data tied to your account.
- Supporter Edition & purchase data — if you purchase Supporter Edition (or previously purchased a legacy recurring plan), our payment provider (Paddle) collects your payment details and shares limited information with us (transaction ID, amount, customer ID, chosen medallion, environment). We do not see or store your card number.
- Voice recordings — when you use the optional “Practice speaking” feature, your microphone audio is captured only in your browser’s memory so you can play it back and compare it to the reference. Recordings are never uploaded, never stored on our servers, and are discarded when you leave the step or close the page.
- Technical data — IP address, browser type, device identifiers, and basic logs generated by hosting and error reporting tools.
- Communications — any messages you send us directly.
2. Why We Use Personal Data
- To provide the Service — creating your account, syncing progress across devices, and showing your gift history (legal basis: performance of a contract).
- To process Supporter Edition purchases — linking purchases to your account through Paddle and unlocking Supporter Edition benefits (legal basis: performance of a contract).
- Security and fraud prevention — protecting accounts and the integrity of the Service (legal basis: legitimate interests).
- Product improvement and support — diagnosing errors and improving lessons (legal basis: legitimate interests).
- Legal compliance — when required by law (legal basis: legal obligation).
We do not sell your personal data. We do not use your data for advertising. We do not run third-party ad tracking.
3. Who We Share Data With
- Service providers / subprocessors — including our hosting and database provider (Lovable Cloud, which uses Supabase infrastructure) and error reporting tools, which process data on our behalf under contract.
- Merchant of Record (Paddle) — for processing Supporter Edition and legacy subscription payments, subscription management, tax compliance, and invoicing. Paddle is an independent controller for the payment data it collects directly from you.
- Authentication provider (Google) — only the minimum data needed to sign you in.
- Professional advisers — such as legal or accounting advisers, when needed.
- Authorities — where required by law or to protect rights, safety, or the integrity of the Service.
4. International Transfers
The Service is operated from the United States. If you access it from outside the U.S., your data will be transferred to and processed in the United States and in other countries where our service providers operate. Where applicable, we rely on Standard Contractual Clauses or equivalent safeguards to protect international transfers from the UK/EEA.
5. Data Retention
We keep your account data for as long as your account is active. If you delete your account or ask us to delete your data, we will delete or anonymize it within a reasonable period, except where we are required to keep it (for example, billing records that Paddle is required to retain for tax or audit purposes).
6. Your Rights
Depending on where you live, you may have the right to access, correct, delete, restrict, or export your personal data; to object to certain processing; and to withdraw consent where we rely on it. If you are in the UK or EEA, you also have the right to lodge a complaint with your local supervisory authority. We aim to respond to verified requests within one month.
To exercise any of these rights, contact Kasey Devine through the in-app support channel.
7. Security
We use appropriate technical and organizational measures to protect personal data, including encryption in transit (HTTPS), encryption at rest for our database, role-based access controls, and row-level security policies that scope user data to the signed-in account. No system is perfectly secure, but we work to reduce risk and respond to incidents promptly.
8. Cookies & Similar Technologies
The Service uses only essential storage needed to keep you signed in and to remember your progress. We do not use third-party advertising or marketing cookies. If we add analytics in the future, this notice will be updated and, where required by law, we will ask for your consent first.
9. Children
The Service is intended for users old enough to consent to data processing in their country (typically 13 or 16, depending on jurisdiction). If you believe a child has provided personal data to the Service without the appropriate consent, please contact us so we can delete it.
10. Changes to This Notice
We may update this Privacy Notice from time to time. The “Last updated” date above reflects the most recent revision. Material changes will be communicated in-app or by other reasonable means.
11. Contact
For questions about this Privacy Notice or your personal data, contact Kasey Devine through the in-app support channel. For questions about payment data handled by Paddle, see Paddle’s Privacy Notice. See also our Terms & Conditions and Refund Policy.