Privacy Policy

Effective date: 2026-05-12

This Privacy Policy explains how Ostrol ("we", "us") collects, uses, and protects your personal data when you use our service at ostrol.com.

1. What we collect

Account data. When you sign up, we collect your email address and (optionally) your name. Passwords are stored hashed with Argon2id — we never see the plaintext.

Solve content. The math problems you submit and the solutions we return are stored so you can revisit them. You own this content.

Payment data. Stripe handles payment information directly; we receive only a token and the last 4 digits of your card.

Telemetry. We collect aggregate, anonymized usage metrics (page views, solve latency, error rates) to improve the product. No personal data leaves your browser without your consent.

2. Why we use it

• To deliver the service you signed up for
• To bill you for paid plans (Stripe)
• To verify your identity (Auth0)
• To detect abuse and protect the platform
• To respond to legal obligations

3. Retention

• Account data: kept until you delete your account
• Solve content: kept until you delete your account, then hard-deleted after a 30-day grace period
• OCR image uploads: 90 days, then auto-deleted
• Audit logs: 7 years for B2B-edu compliance (FERPA), 1 year for B2C accounts
• Payment records: as required by tax law in your jurisdiction (typically 7 years)

4. Who we share data with

We share data only with our infrastructure providers, under data processing agreements:

• Payment processing provider
• Problem-solving compute provider (we send your problem text; no account info)
• Image OCR provider (image content only; auto-deleted after processing)
• Authentication provider
• Transactional email provider
• Error monitoring provider (PII scrubbed)
• Hosting providers

We do not sell your data. We do not share it with advertisers.

5. Your rights (GDPR / equivalent)

You have the right to:

• Access the data we hold about you (/account/settings)
• Correct inaccurate data (/account/settings)
• Delete your account and associated data (/account/settings → Delete account)
• Export your data (request via privacy@ostrol.com)
• Object to processing
• Restrict processing
• Lodge a complaint with your local data protection authority (in France: CNIL; in Morocco: CNDP)

We respond to all requests within 30 days.

6. Cookies

We use only essential cookies (session, theme, locale). No advertising or tracking cookies. You can clear cookies at any time.

7. Children

Ostrol is intended for users aged 13 and over. If you are under 18, you should have a parent or guardian's permission. We do not knowingly collect data from children under 13.

8. Changes to this policy

We will email you at least 30 days before any material change.

9. Contact

• Privacy questions: privacy@ostrol.com
• Data Protection Officer: dpo@ostrol.com