Privacy Policy

Last Updated: December 12, 2025

At CherrySTEM, we respect your privacy and are committed to protecting your personal data. This Privacy Policy explains how we collect, use, store, and protect your information when you use our educational software services.

1. Information We Collect

1.1 Information You Provide

Data Type	Purpose
Email address	Account creation, authentication, communication
Password (hashed)	Account security and authentication
License key	Premium feature access verification
User-created content	Storing your novels, quizzes, lessons, etc.

1.2 Automatically Collected Information

Usage Data: Feature usage, AI generation counts, login times
Technical Data: Browser type, IP address, device information
Cookies: Session cookies for authentication (required for service)

1.3 Information We Do NOT Collect

We do NOT collect:

Payment card information (handled by Gumroad)
Location data beyond IP-based country detection
Biometric data
Social media profile information

2. How We Use Your Information

2.1 Service Provision

Creating and managing your account
Authenticating your login
Storing and syncing your content across devices
Providing AI-powered features (text generation, image creation)
Verifying license keys for premium features

2.2 Service Improvement

Analyzing usage patterns to improve features
Monitoring service performance and uptime
Debugging technical issues

2.3 Communication

Sending account-related notifications (password reset, etc.)
Announcing major updates or changes to Terms
Responding to support inquiries

Marketing Communications: We do NOT send marketing emails unless you explicitly opt-in. You can unsubscribe at any time.

3. AI Services and Third-Party Processors

3.1 OpenRouter API

We use OpenRouter (https://openrouter.ai) to provide AI text and image generation features. When you use AI features:

Your prompts are sent to OpenRouter's servers
OpenRouter processes the request using AI models (OpenAI, Anthropic, etc.)
Generated content is returned to our servers and stored in your account

Important: Your content is NOT used to train AI models. OpenRouter's data processing agreement prohibits model training on user data.

3.2 Gumroad (Payment Processing)

License purchases are processed by Gumroad. They collect payment information per their privacy policy: https://gumroad.com/privacy

3.3 Digital Ocean (Hosting)

Our services are hosted on Digital Ocean servers in the United States. Data is encrypted in transit (HTTPS) and at rest.

4. Data Storage and Security

4.1 Where We Store Data

Database: PostgreSQL on Digital Ocean (San Francisco, USA)
Encryption: TLS 1.3 in transit, AES-256 at rest
Backups: Daily encrypted backups retained for 30 days

4.2 Security Measures

Passwords are hashed using bcrypt (10 rounds)
JWT authentication with 30-minute access tokens
API keys stored server-side (never exposed to client)
Regular security updates and monitoring

4.3 Data Retention

Active accounts: Data retained indefinitely while account is active
Deleted accounts: All personal data and content deleted within 30 days
Backups: Deleted account data removed from backups within 60 days

5. Your Rights (GDPR & CCPA Compliance)

You have the following rights regarding your personal data:

5.1 Right to Access

You can view all your data within the application. For a complete data export, contact support@cherrystem.net.

5.2 Right to Rectification

You can update your email and other account information directly in the app settings.

5.3 Right to Erasure ("Right to be Forgotten")

Delete Your Account: You can permanently delete your account and all associated data through the Settings → Admin Panel → Delete Account option.

5.4 Right to Data Portability

You can export your content at any time using the built-in export features (PDF, DOCX, TXT, JSON).

5.5 Right to Object

You can object to data processing for marketing purposes (we don't market unless you opt-in).

5.6 Right to Restrict Processing

6. Cookies and Tracking

6.1 Essential Cookies

We use essential cookies for:

Authentication: Storing your login session (JWT tokens)
Preferences: Remembering your theme and settings

These cookies are required for the service to function and cannot be disabled.

6.2 Analytics

We do NOT currently use Google Analytics or similar tracking tools. We may add privacy-respecting analytics in the future with notice.

7. Children's Privacy

Our services are designed for users 13 years and older. We do not knowingly collect data from children under 13. If you believe a child has provided us with personal information, please contact us immediately so we can delete it.

For educational use in schools, we recommend teacher/parent supervision for younger users.

8. International Data Transfers

Our servers are located in the United States. If you are accessing our services from the European Union, United Kingdom, or other regions with data protection laws, please note that your data will be transferred to and processed in the United States.

We ensure adequate protection through:

Standard contractual clauses with hosting providers
Encryption in transit and at rest
Compliance with GDPR and privacy shield principles

9. Data Sharing and Disclosure

9.1 We Do NOT Sell Your Data

We never sell, rent, or trade your personal information to third parties for marketing purposes.

9.2 When We Share Data

We only share data in these limited circumstances:

Service Providers: OpenRouter (AI), Digital Ocean (hosting), Gumroad (payments) - only as necessary for service provision
Legal Obligations: If required by law, court order, or government request
Business Transfer: If CherrySTEM is acquired, your data may transfer to the new owner (you will be notified)

10. Your Content Ownership

100% Ownership: You retain complete ownership of all content you create using CherrySTEM applications. We claim no rights to your novels, quizzes, lessons, or other creative work.

We store your content solely to provide the service to you. You can export or delete your content at any time.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will notify you of significant changes via:

Email notification
In-app announcement
Notice on our website

Your continued use of the service after changes constitutes acceptance of the updated policy.

12. Contact Us

Data Protection Contact

For privacy-related inquiries, data access requests, or to exercise your rights:

Email: support@cherrystem.net

Subject Line: "Privacy Request"

We will respond to your request within 30 days.

13. Additional Information for EU Users

Legal Basis for Processing

We process your data under the following legal bases:

Contract Performance: Processing necessary to provide the service you signed up for
Legitimate Interests: Improving our services, security, fraud prevention
Consent: For optional features like marketing emails (if applicable)
Legal Obligation: Compliance with tax, financial, and legal requirements

Data Protection Officer

For GDPR inquiries, contact: support@cherrystem.net

Supervisory Authority

EU users have the right to lodge a complaint with their local data protection authority if they believe we are not complying with GDPR.