Privacy policy

Account: your email address and display name. You sign in with a single-use link sent to your email — there is no password, so there is nothing to store and nothing to lose.

Profile: your main goal, biggest challenge, how often you interact with people, how much time you want to spend, your language, and the date of your interview if you enter it.

Usage: XP, level, streak, completed lessons, challenges, badges, AI quota consumed.

What you write: journal entries, transcripts of your practice simulations, saved items, quiz answers.

Billing: your Stripe customer id, subscription state, and for a pass you bought the amount and Stripe payment reference. No card data.

Technical: one strictly necessary session cookie, plus the request metadata your host and CDN see.

Performance of the contract: creating and keeping your account, giving you the service, managing your subscription.

Legitimate interest: keeping the service secure, limiting abuse, measuring usage in aggregate.

Consent: non-transactional email — streak reminders and the weekly digest — which you can switch off in Settings at any time.

Legal obligation: retaining accounting records for payments.

We do not sell your data. We do buy advertising on Google: if you accept advertising measurement, Google learns that one of its ads led to a signup — not what you do in the app afterwards. You can refuse, and refusing changes nothing about the product. These processors are involved:

—Railway Corporation — hosting and the PostgreSQL database (California, USA (US-West)). Sees everything stored by the service.

—Google (Gemini API) — receives the text of a coaching message, a practice turn, a journal entry, a message you paste for analysis, or a CV and job posting you paste for review, at the moment you ask for AI help, in order to generate the reply. Processed in the United States. A pasted CV is not stored by SHAZA: only the scores of the review are kept.

—Google (Ads conversion measurement) — only with your consent. Google is told that an ad click led to a signup or a subscription, and the value of it. It receives no journal entry, no practice transcript and no coach message.

—Google (Sign in with Google) — only if you choose that method. Google tells us your email address, whether it is verified, and your first name; Google learns that you signed in to SHAZA. No password reaches this service either way.

—Resend, and Amazon SES in Ireland (eu-west-1) — your email address and the content of transactional messages: sign-in links, streak reminders, weekly digest.

—Stripe — your email address, subscription state and one-off purchases. Card details go straight to Stripe and never reach this service.

—Cloudflare — proxies traffic to shaza.app, so it sees request metadata such as your IP address.

Transfers outside the EU: hosting and the database (California, USA (US-West)) process everything stored in the United States, and the Gemini API processes the text concerned there when you trigger an AI feature. These transfers are covered by the European Commission's Standard Contractual Clauses and by a data-processing agreement (DPA) with each processor. Transactional email stays processed in the EU (Ireland).

Account and content: for as long as your account exists.

Deletion: Settings → Delete account. It is immediate and irreversible — profile, progress, journal, transcripts and history go with it, and the Stripe subscription is cancelled.

Session tokens and sign-in links: a link expires in 15 minutes and works once; a session lasts 30 sliding days and records the browser used, so you can recognise your devices in Settings (not your IP address). Both are deleted automatically a week after they expire, and immediately when an account is deleted.

Accounting records: for as long as the law requires.

Email log: for each email we send we keep its recipient, subject, type and what the sending provider reported about it (delivered, bounced). Not its content. This log is deleted automatically after 90 days.

Messages you write to us: replies to our emails and messages sent to the contact address are kept (sender, subject, text) while we answer you, then deleted at the latest a year after they were handled. Those sent from your account's address are deleted as soon as the account is.

Access, rectification, erasure, restriction, objection and portability. Write to contact@shaza.app.

You may also complain to the supervisory authority where you live.

Strictly necessary cookie: your session. `httpOnly`, `SameSite=Lax`, never used for tracking. A preference cookie also remembers your theme and language.

Audience and advertising measurement: SHAZA uses Google Analytics 4 and Google Ads. These are two separate purposes and the banner asks for them separately — you can accept one, the other, or refuse both. Refusing is exactly as easy as accepting, and you can change your mind: clear `shaza:analytics-consent` from your browser's local storage and the banner returns.

Before you choose, Google Consent Mode v2 is initialised with **everything denied** (`analytics_storage`, `ad_storage`, `ad_user_data`, `ad_personalization`), plus `ads_data_redaction`. In practice: no Google cookie is set and no identifier is kept on your device until you accept. Google's script is, however, loaded on arrival and sends one cookieless request containing the page URL and your IP address. If you refuse, it sends nothing further and nothing is stored.

If you accept, Google sets its cookies (`_ga`, and for advertising `_gcl*`) to count visits and attribute signups and purchases to ads. Recipient: Google Ireland Limited, with possible transfer to the United States under the EU-US Data Privacy Framework.

We also keep where your first visit came from (`utm_*` parameters, or "Google, ad" for a visit that came from an ad) in a SHAZA cookie, `shaza_attribution`, valid for 90 days, and then on your record when you sign up. That is how we know which ads bring real users. The cookie holds no identifier: it is set as soon as you arrive, before the banner, and stays on your device and in our database. Google's ad click id (`gclid`) is added to it, and passed to Google, only if you accept advertising measurement.

Passwordless sign-in through short-lived single-use links, 256-bit opaque session tokens hashed at rest, HSTS, a per-request Content-Security-Policy, and a database with no public endpoint.