Privacy policy

Last updated: 2026-10-26

Who is responsible

Stepora is run by Pavel Volkau, Bialystok | Zaulek Podlaski 61. Email: stepora.kontakt@gmail.com.

What we keep and why

• Your account: the username and a hash of your password. The password itself is never stored.
• Recovery code: only a hash of it is stored, so nobody (including us) can read it. It lets you reset a forgotten password.
• Sign-in with Google or Apple (optional): the provider only tells us an identifier of your account there. We do not receive or store your e-mail address or name, and the account then has no password. Signing in is also governed by that provider's own privacy policy.
• Your plans and organisations: the plans you build, with the filters you chose (for example the learner's age, budget and hours a week), the marks and ratings you give courses, and the organisations you belong to. They are kept so that you see them on any device.
• One sign-in cookie (fm_s). It is strictly necessary to keep you signed in and lasts 30 days. There are no advertising or tracking cookies, so the site has no cookie banner.
• In your browser (local storage): the site language and changes that have not reached your account yet.

Anonymous records that improve the recommendations

To learn which courses really help and to build our own course database, we keep records that contain no username: the topics searched, the course links that were opened, marks such as “finished”, ratings and “helped / did not help”, the reason a course was replaced, and copies of finished plans (topic, languages, filters, an age group instead of the exact age, and the list of courses). They may be used to improve or train our recommendation model. Please do not type personal details into the search field.

AI services

To build a plan, the text of your request, your filters and the text of a file you upload are sent to an AI service: Google Gemini (Google), and as a backup Groq, Mistral AI or Cloudflare Workers AI. These services may process data outside the EU, for example in the USA, under the EU standard contractual clauses or the EU–US Data Privacy Framework.

Hosting

The site runs on Cloudflare (Cloudflare, Inc.). To deliver the pages and protect them from attacks, Cloudflare processes technical data such as your IP address. We do not store IP addresses: they are held briefly in memory only, to limit repeated sign-in attempts and clicks. From your IP address Cloudflare also tells the site your approximate country and city. We use them only to preselect the country and suggest a city in the search, and do not store them. A city you type yourself is sent to the AI service together with the other filters.

How long we keep data

• An account and its plans are deleted automatically after 3 months without signing in, or straight away when you press “Delete account”.
• An organisation is deleted when none of its members has signed in for 3 months, or when its owner deletes it or their account.
• A sign-in lasts 30 days. Saved AI answers (cache) are kept for 30 days.
• Anonymous records are kept for up to 2 years.

Legal basis

We keep your account, plans and organisations to provide the service you asked for (GDPR art. 6(1)(b)). Anonymous records and protection against abuse rest on our legitimate interest in a secure service that keeps getting better (art. 6(1)(f)).

Age

The site is for people aged 16 or older. Younger people may sign up only with the consent of a parent or guardian, which is confirmed with a tick when signing up.

Your rights

• You can ask to see, correct, delete or receive your data, to restrict its use, or object to it. Write to stepora.kontakt@gmail.com.
• You can delete your account yourself at any time: account menu → “Delete account”.
• You can complain to a data protection authority. In Poland this is the President of the Personal Data Protection Office (UODO): https://uodo.gov.pl.

Changes

If this policy changes, the new version is published on this page with a new date.