Privacy Policy

Version 1.4 · Effective 17 October 2026

This policy explains what personal data Ownwise keeps, why, for how long, who else receives it and what you can do about it. We keep as little as we can.

In short

Without an account, your progress stays in your browser. We only count a few events, without a name or id.
With an account, we keep your name, e-mail, progress, notes and business numbers to show them back to you.
No ads, no third-party analytics or tracking pixels, no selling of data, no newsletters.
We send you only e-mails about your account and your purchases, without tracking.
The site and its database are on a server in Kazakhstan (Hoster.KZ). Outside Kazakhstan, only the services below get data: e-mails (Resend, USA), payments and AI feedback. You agree to this with the tick box when you create an account.
Payments go through Dodo Payments, our reseller: you give your card and billing details on its page, and we never see your card.
Only when you ask for AI feedback, your explanation is sent to Anthropic (USA) to write the feedback, without your name or e-mail.
You can download all your data and delete your account in your profile.

1. Who is responsible

Nikita, a private individual based in Kazakhstan who uses the name "Ownwise Creator" for the site, runs Ownwise and decides how your data is used (the "controller"). Contact for privacy questions: ownwisecreator@gmail.com. For the data you give on its checkout page, Dodo Payments is a separate controller (section 5).

2. What we keep, why and for how long

Data, purpose and how long it is kept
What	Why	How long
Account: your name, e-mail, password, role, the date you joined, and when you confirmed your e-mail	To let you sign in and show your profile. The password is never stored as such: we keep only a salted hash (PBKDF2).	Until you delete the account.
Your agreement: the versions of the Terms and this policy you accepted, the age confirmation, your consent to send data outside Kazakhstan (section 6) and the time	To show what you agreed to and when.	Until you delete the account.
Sign-in session: a random code in a cookie; the server keeps only its hash and the end date	To keep you signed in. See Cookies.	30 days, extended while you use the site. Deleted when you sign out (on this device or on all devices) or set a new password; expired ones are deleted automatically.
Failed sign-ins: the e-mail address and the IP address used, and how many times	Security: after 5 wrong passwords for one e-mail (or 20 from one address) in 15 minutes, sign-in is paused for 15minutes.	The count for your e-mail is deleted after a successful sign-in; all counts are deleted automatically after one day.
Links in our e-mails: a random one-time code (we keep only its hash), the account, the address it was sent to and when it expires	To confirm your e-mail, to set a new password, or to confirm a new e-mail before it replaces the old one.	Until the link is used or a newer one replaces it, at most 24 hours (1 hourfor a new password); then deleted automatically.
Limits on sign-ups and e-mails: an IP address or an e-mail address, and how many requests in the last hour or day	Security: to stop mass sign-ups and the use of the site to fill someone's inbox. For example, at most 10 new accounts from one address and 3 e-mails to one address in an hour.	Until the hour or the day ends; then deleted automatically.
Learning progress: your answers, choices and written explanations, results, AI feedback you received, where you stopped	To save your progress, show it on any device and repeat your mistakes in warm-ups.	Until you start over, or delete the account. When you start a block over, the earlier attempt is kept in your history (the last 20 per block).
Notes and "Your business" numbers	To keep them for you. Authors and admins of Ownwise cannot see them.	Until you delete them or the account.
AI feedback log: time, block, question, result, AI model, size of the request. Not the text.	To keep the daily limits (3 per question and 20 per person a day) and to watch the cost.	12 months, then deleted automatically. When you delete the account earlier, the entries stay until then without any link to you.
Events: a block started or completed, a session completed, a retry, coming back, "Start free", a purchase (test or real) — with the time and the block. On "Start free" and the first block started in a visit, also where the visit came from: the utm_source, utm_campaign and utm_content of the link you followed, if it had them (for example "instagram")	To see how the course is used and improve it, and which links bring people who start learning. With an account, the events are linked to it. Without an account, they carry no name, id or IP address.	24 months, then deleted automatically. When you delete the account earlier, your events stay until then without any link to you.
Purchases: product, price paid, currency, status, test or real, the payment provider's checkout and payment numbers, the link to its receipt, dates; when you ticked the box about access right away (and the version of its wording) and when we e-mailed the confirmation; your access to the paid blocks. Not your card, billing address or country: those stay with Dodo Payments	To give you access, to show your purchases and receipt, to keep a record of sales and of your choice about the right to withdraw.	Access: until you delete the account. Order records stay after that, without a link to your account, because sales records must be kept.
Server logs: for each request to the site, the IP address, the time, the page address (one-time codes of e-mail links are hidden), the answer and the browser name; the site's error log: the time, the page (without its query) and the error, without an IP address	Security (to see and stop attacks) and fixing errors.	14 days, then deleted automatically.
Backups of the database: a copy of everything above that is kept in the database	To restore the site after a failure or a mistake.	14 days, then deleted automatically. Data you deleted disappears from the backups within this time.
Messages you send us	To answer you.	As long as needed to deal with your question.

Automatic deletion runs at each sign-in and every few hours while the site is in use. If an author or admin changes the role of your account, the change is written to the site's action log with your name and e-mail. The log is kept while the site runs, as a record of who changed what; when you delete your account, your name and e-mail in it are replaced with "Deleted account". The site's own code does not log your IP address or the pages you open, except for failed sign-ins and the limits (above); the server logs are described above.

3. E-mails we send

We send only e-mails about your account and your purchases, to the address of your account (or to the new address you give):

a link to confirm your e-mail, after you create an account or when you ask for it again;
a link to set a new password, when you ask for one;
a link to confirm a new e-mail, sent to the new address, and a notice to the old address once it has changed;
a notice when your password has changed;
a notice to an address that already has an account, if someone tries to use it for another account;
a confirmation after a purchase: the order, the price and your choice about the right to withdraw;
a notice when a purchase is refunded or taken back by your bank and the paid blocks close.

Dodo Payments sends its own receipt for a purchase, under its privacy policy.

No newsletters and no marketing. Our e-mails have no tracking pixels, and their links go straight to Ownwise. You need a confirmed e-mail for AI feedback and purchases; everything else works without it.

4. On what basis

To provide the service you asked for (a contract): the account, progress, notes, numbers, AI feedback on request, purchases.
Our legitimate interests: security (failed sign-ins), events to improve the course, the action log.
Legal duties: keeping records of real sales and of the confirmation about the right to withdraw.
Your consent, where the law of your country requires it for an account (for example, in Kazakhstan), and to send data outside Kazakhstan (section 6): you give it with the tick box when you create the account and can withdraw it by deleting the account.

5. Who else receives data

Anthropic, PBC (USA) writes the AI feedback. Only when you press the button, we send your written explanation together with the case, the checklist and the author's review. We do not send your name, e-mail or account id. Anthropic deletes this data within 30 days, except where it must keep it longer under its usage policy or the law.
Dodo Payments sells the practice pack as our reseller (merchant of record). When you start a purchase, we send it your name and e-mail (so the receipt reaches you), the product and our order number; on its checkout page you give it your billing address and card details directly. It tells us whether the payment succeeded, the amount, its payment number and the link to its receipt. It handles this data as a separate controller under its privacy policy; it may process it in other countries, with its own payment processors, and uses standard contractual clauses for transfers from the EU and the UK. Its documents do not name its company or country; its Buyer Terms use the law of Delaware, USA.
Hosting provider: Hoster.KZ (Kompaniya Hoster.KZ LLP, Kazakhstan) runs the server on which the site, its database, the backups and the server logs are kept, on our behalf.
E-mail service: Resend (Plus Five Five, Inc., USA) delivers our e-mails on our behalf: it receives your address and the e-mail itself, which may hold a one-time link, and keeps them for 30 days under its privacy policy. Its open and click tracking is off.
Authorities, only if the law requires us to share data.

Inside Ownwise, authors and admins can see the list of accounts (name, e-mail, role, dates), each learner's progress in the blocks and the event counts — not notes or business numbers. We do not sell or rent personal data and do not share it for advertising.

6. Where the data is

We are in Kazakhstan. The site, its database, the backups and the server logs are on servers in Kazakhstan (Hoster.KZ). Data leaves Kazakhstan only for these services (section 5): e-mails — Resend (USA); AI feedback, only when you ask for it — Anthropic (USA); payments — Dodo Payments. These countries may protect personal data differently from yours. When you create an account, you agree to these transfers with the tick box: without them we could not send you e-mails, take a payment or give AI feedback. You can withdraw this consent by deleting the account.

7. Your rights

See and take your data: "Download my data" in your profile gives, as a file, your account, agreements, sign-in sessions, progress and its history, AI feedback log, purchases, access and events. Short-lived security counters and the codes of e-mail links are left out: they are deleted within a day.
Delete: "Delete my account" in your profile deletes it at once; the table above lists what stays without a link to you.
Correct: change your name and e-mail in your profile, under "Account settings", or write to us.
Object or limit the use of your data, for example the events: write to us.
Complain to the data protection authority of your country (in the UK, the ICO). We would be glad to hear from you first.

We answer requests within one month. Without an account, your progress is only in your browser: you can delete it there.

8. Cookies and tracking

We use one cookie, to keep you signed in, and keep your progress and settings in your browser. Details: Cookies and browser storage. We do not track you across other sites, so a "Do Not Track" signal changes nothing here.

9. Security

The site works only over HTTPS. Passwords are stored only as salted hashes, the sign-in cookie cannot be read by page scripts and is sent only over HTTPS, the server checks access on every request, and sign-in pauses after repeated wrong passwords. Links in our e-mails work once and expire, and we keep only their hashes. You can sign out on all devices in your profile. No system is perfectly safe. If a breach affects personal data, we tell the authority inKazakhstan within one working day, the authorities of the EU or the UK within 72 hours where their law applies, and you without delay when the breach is likely to put you at risk, with what happened and what you can do.

10. Age

Ownwise is for people aged 18 or older. If we learn that an account belongs to someone younger, we delete it.

11. Changes

When this policy changes, we publish the new version with a new number and date. If you have an account, we show you what changed and ask you to accept the new version the next time you sign in or open Ownwise.

12. Contact

Privacy questions and requests: ownwisecreator@gmail.com.