Privacy Policy

Last updated: 13 October 2026

Ludium (ludium.ai) is a free educational website, an independent project based in South Australia ("Ludium", "we", "us"). This policy explains what we collect, why we collect it, and what choices you have. Questions or requests: hello@ludium.ai.

The short version

• You can use Ludium without an account. Your progress then stays in your own browser.
• If you create an account, we store your email address and your learning progress so it can sync across your devices.
• Your AI API key stays in your browser. We never save it to our database or our logs.
• If you use the free AI feedback that comes with an account, your submission is sent to Anthropic under our account, and we count how many free requests you've used.
• We don't sell your data, we don't show ads, and we don't use your work to train AI models.

What we collect

If you use Ludium without an account

• Your progress, answers, AI feedback and settings (for example night mode) are kept in your browser's local storage. They never reach our database. Clearing your browser data removes them.

If you create an account

• Email address and password. We don't verify the email address. It's used as your login name and, if it's a real address, to send password-reset emails. Supabase, our authentication provider, stores your password as a one-way hash, so we never see it.
• Learning progress. This covers videos and quizzes completed, problems and exercises completed or revealed, and practice statistics.
• Your submitted work. This covers the answers you type, a text transcription of any handwritten work you photograph, and the AI feedback you received. We keep these so you can see your attempt history.
• Account fields. These are your account tier and, only if paid plans are introduced later, subscription status.
• Free feedback usage. For each free AI feedback request we record when it was made, what it was for (a problem, a notes page, a coding hint or an exercise, with its course and item), the AI model used and the number of tokens it consumed. We use this to enforce the monthly allowance and to manage the cost of the service.

Photos of handwritten work. When you upload a photo for feedback, it's sent to the AI provider that produces your feedback (Anthropic for free feedback, otherwise the provider of your own key) so it can be read and graded. We keep the resulting text transcription and the feedback. We don't keep the image itself.

Technical data

• IP address. It's used briefly, in memory, to rate-limit the AI feedback endpoints against abuse. We don't store it in our database. Our host (Vercel) keeps standard server logs, including IP addresses, for a limited time.
• Analytics. We use Vercel Web Analytics, which counts page views in aggregate without cookies and doesn't track you across sites.

Free AI feedback

When you choose free feedback, your answer, any photo of your work and the problem or notes text are sent from our server to Anthropic using our API account, under Anthropic's commercial terms. Under those terms, Anthropic doesn't use this data to train its models. Anthropic may retain it for a limited period for safety and abuse monitoring. The feedback is saved to your account like any other attempt.

Your AI API key

AI feedback can also run on your own key from Anthropic, Google or OpenAI ("bring your own key").

• Your key is saved only in your browser's local storage.
• When you ask for feedback, your browser sends the key over HTTPS to our server. The server passes it, together with your answer, to the provider you chose, and then discards it. We never write it to our database or our logs.
• Your answer, any photo and the problem text go to that provider under their terms and privacy policy, and any charges are billed to you by that provider. You can remove your key at any time from the key settings on the site, or by clearing your browser's site data.

Third parties we rely on

YouTube. Course videos are embedded from youtube.com. When a video loads, YouTube may set cookies and collect viewing data under Google's Privacy Policy. Because we use the standard embed, a viewer who is signed in to YouTube stays signed in within the player.

Because of these services, your data may be processed outside Australia, including in India and the United States.

Cookies and local storage

• Sign-in cookie. An essential cookie, set by Supabase, keeps you signed in.
• Local storage. Your API key, your settings and your progress (if you have no account) are kept in your browser.
• No third-party cookies of our own. We set no advertising or tracking cookies. The only third-party cookies come from the YouTube embed described above.

How long we keep it

We keep your account data until you delete your account. When an account is deleted, all of its progress and submissions are deleted with it.

Your choices and rights

You can ask us to access, correct, export or delete your data. Email hello@ludium.ai from, or naming, the address on your account, and we'll act within 30 days. If you live in the EU, UK or another place with similar laws, you also have the right to object, to restrict processing, and to complain to your local data-protection authority. We process account data because it's necessary to provide the service you signed up for, and technical data because we have a legitimate interest in running and securing the site.

Children

Ludium is intended for people aged 13 and over (16 and over in the EU and UK). If you believe a child under that age has created an account, contact us and we'll delete it.

Security

Data travels over HTTPS. Database rows are protected by per-user access rules, so each account can read only its own data. No system is perfectly secure. Because we don't verify email addresses, choose a password you don't reuse elsewhere.

Changes

If we change this policy, we'll update the date at the top. If a change is significant, for example if paid plans or new data uses are introduced, we'll also put a notice on the site.