This is a template filled in with the details you gave us - operating as an individual, based in Guatemala. It is still a starting point, not legal advice, and it has not been reviewed by a lawyer. Before you treat it as final, have it reviewed by a qualified attorney - especially because this platform is used by children, which brings in extra rules (see "Children's Privacy" below) that a template like this can't fully resolve on its own.
Who we are
Penbloom ("Penbloom," "we," "us," or "our") is operated by Ziad Jweiles, an individual based in Guatemala City, Guatemala. This Privacy Policy explains what information we collect through the Penbloom website and platform (the "Service"), why we collect it, and what rights you have over it.
What information we collect
Account information. If you create an account, we collect the email address and password you sign up with (handled by our authentication provider, Supabase, which stores passwords securely and never as plain text) and a username. Usernames are meant to be pseudonyms - please don't use your real name or other identifying details as your username.
Content you create. Depending on how you use Penbloom, we store: your progress through lessons and courses (completions, XP, streaks, levels, badges); answers you save in a lesson's writing space or submit to a lesson quiz or course test; and, if you take part in the Daily Writing Challenge, the story you submit and whether it's approved for the public gallery.
Information you give us directly. If you contact us, use the privacy request form, or report a piece of content, we collect whatever you include in that message.
Information collected automatically. Like most websites, our hosting provider (Vercel) automatically logs technical information about each visit - such as IP address, general location inferred from it, browser and device type, the pages requested, and timestamps - for security, abuse prevention, and reliability purposes. We do not use this for advertising, and we only add analytics on top of it (to understand which lessons are used and where visitors get stuck) if you've given consent to that in our cookie banner.
Cookies. We use a small number of cookies, described in full in our Cookie Policy. A necessary cookie keeps you signed in and remembers your chosen language; nothing else is set until you say yes to it.
How we use your information
- To create and maintain your account, and to save your progress across sessions and devices.
- To operate features you choose to use, like the writing space, quizzes, course tests, and the daily story gallery.
- To keep the Service secure, prevent abuse, and moderate publicly shared content (see our Terms of Service).
- To respond to messages you send us, including privacy requests.
- To understand and improve the Service, where you've consented to analytics cookies.
- To comply with legal obligations.
We do not sell your personal information, and we do not use your writing to train any AI model.
Our legal bases for processing (for visitors in the UK/EU)
Where the UK GDPR or EU GDPR applies, we rely on: performance of a contract (running the account and features you sign up for); legitimate interests (keeping the Service secure and reliable, and improving it); consent (analytics and marketing cookies, and, where applicable, a parent or guardian's consent for a child's account); and legal obligation (where the law requires it of us).
Who we share information with
We don't sell your information. We share it only with the service providers that run Penbloom for us, each acting as a data processor under our instructions:
- Vercel (vercel.com) - hosts the website and application, and processes the technical request logs described above.
- Supabase (supabase.com) - hosts our database and handles account sign-up/sign-in, and therefore stores your account, progress, and content data.
- Sanity.io (sanity.io) - hosts the course and lesson content you read; it does not receive your personal account data.
- YouTube / Google - some lessons embed YouTube videos. Loading one of those videos is subject to Google's own privacy policy.
We don't currently use any analytics or advertising tools. If we add one in the future (for example Google Analytics or a Meta/Facebook Pixel), it will only ever run in your browser if you've accepted the matching category in our cookie banner, and we'll name it here and in our Cookie Policy when we do.
We may also disclose information if required by law, to protect the rights and safety of Penbloom or our users (for example, investigating a report about the public story gallery), or in connection with a merger, acquisition, or sale of assets, in which case we'd tell you first.
How long we keep information
We keep account and progress data for as long as your account is active, and for a reasonable period after that in case you return, unless you ask us to delete it sooner (see "Your privacy rights" below). Technical request logs held by our hosting provider are kept for a limited window for security purposes and then automatically discarded. A story removed from the public gallery for a policy violation may be retained privately for a period for moderation and safety record-keeping.
Your privacy rights
Depending on where you live, you may have the right to:
- Access the personal data we hold about you.
- Correct inaccurate or incomplete data.
- Delete your data ("the right to be forgotten").
- Export your data in a portable format.
- Object to or restrict certain processing, including withdrawing cookie consent at any time.
- If you are a California resident, the additional rights described by the CCPA/CPRA, including the right to know what categories of data we collect and to opt out of any "sale" or "sharing" of personal information (we do not sell or share personal information for cross-context behavioral advertising).
To exercise any of these rights, use our privacy request form or email szjweiles@gmail.com. We'll respond within the time required by applicable law (for example, 30 days under GDPR, or 45 days under the CCPA).
Children's privacy
Penbloom is designed to be useful to writers of any age, including children, and some of our courses (the "Early Readers" band) are written for a caregiver to work through together with a child roughly 5-7 years old, using the caregiver's own account rather than a separate account for the child. We do not knowingly collect personal information directly from a child under 13 (or the relevant minimum age in your country, which may be older) through their own account.
Concretely: creating your own Penbloom account requires you to be at least 13 years old. Penbloom does not offer account sign-up to anyone younger than that. A child younger than 13 can still use Penbloom, but only alongside a parent or caregiver, using that adult's own account - this is exactly how our "Early Readers" courses are designed to be used, and it means we never directly collect a young child's email, password, or other personal information of their own. If you are a parent or guardian and believe your child has provided us with personal information without your consent, contact us at szjweiles@gmail.com and we will delete it.
International data transfers
Our service providers may process information in countries other than your own, including the United States. Where required, we rely on appropriate safeguards (such as Standard Contractual Clauses) for these transfers, as implemented by those providers.
Security
We rely on our providers' security practices (encryption in transit, access controls, and database-level row security rules that limit what any given account can read or write) and take reasonable steps to protect your information. No method of transmission or storage is 100% secure, and we can't guarantee absolute security.
Changes to this policy
We may update this Privacy Policy from time to time. If we make material changes, we'll update the "Last updated" date above and, where appropriate, let you know directly.
Contact us
Questions about this policy or your data can be sent to szjweiles@gmail.com, or by mail to Guatemala City, Guatemala.