Privacy Policy

Last updated 23 June 2026

This policy explains what personal data Witsy collects, why, and your rights over it. Witsy is operated by Futuedu Oy ("we", "us"), the data controller for the data described here. Questions: support@witsy.io.

Data we collect

Account — your email address; your password, stored only as a salted hash and never in plaintext; and a record of the Terms version and date you accepted.
Learning data — your placement-test answers and results, lessons completed, and the per-skill strength and review history we use to recommend what to learn next.
Pre-account placement data — if you take the placement test before signing up, we store your answers against a pseudonymous random identifier (held in the witsy_placement_anon cookie) so your results transfer to your account when you create one. This identifier is not anonymous: once you create an account, the data is linked to you.
Purchase data — for paid plans we store a Stripe customer and payment reference, your purchase date and entitlement status (which tier, whether it is active), and a record of any withdrawal or refund you request. Payment card details are handled entirely by Stripe; we never receive or store them.
Technical & security data — your IP address and basic request metadata in short-lived server logs, used for security, abuse prevention, and debugging.

What we do not collect

We do not use advertising or cross-site tracking cookies, we do not use analytics that profile you for advertising or follow you across other websites, and we do not sell or share your personal data with advertisers or data brokers.

Why we use it (legal bases)

To provide Witsy and your account — performance of our contract with you.
To process payments — performance of our contract, and compliance with legal obligations (tax and accounting records).
To keep the service secure and improve it — our legitimate interests in preventing abuse and making Witsy work well.
To send account and transactional email (verification, password reset, receipts) — performance of our contract. We do not send marketing email without your consent.

Cookies

We use the minimum cookies required to run the service. All are first-party and strictly necessary, so we do not show a consent banner:

__Host-witsy_session — keeps you logged in. Essential. Expires after about 30 days.
witsy_placement_anon — remembers a placement test you started before signing up so the results carry over to your new account. Functional. Expires after about 30 days.

We set no advertising, marketing, or third-party analytics cookies. If this ever changes, we will update this policy and ask for your consent first where the law requires it.

Analytics

To understand how Witsy is used in aggregate — how many people visit, which pages they reach, and where they came from — we use Cloudflare Web Analytics, a privacy-first analytics tool. It uses no cookies, no local storage, and no fingerprinting, and it does not track you across sessions or other websites. It processes your IP address momentarily to count a visit, but does not store it or use it to identify you. Our legal basis is our legitimate interest in measuring and improving the service.

Service providers

We share data only with the providers we rely on to run Witsy:

Cloudflare — hosting, our database and file storage, the Turnstile challenge that protects sign-up and login from bots, and the privacy-first website analytics described above. Turnstile and Web Analytics are both privacy-preserving and do not use tracking cookies.
Stripe — payment processing. When you pay, you are redirected to Stripe's secure checkout; your card details go to Stripe, not to us.
Resend — delivery of transactional email from witsy.io.

These providers may process data outside your country, including in the United States. Where they do, those transfers are protected by appropriate safeguards: for providers certified under the EU–US Data Privacy Framework, that framework; otherwise the European Commission's Standard Contractual Clauses.

How long we keep it

Account and learning data — for as long as your account exists. Delete your account or email us and we will remove it, except where we must keep records by law.
Payment records — retained for at least 6 years to meet Finnish tax and accounting obligations, then deleted.
Server logs — kept only as long as needed for security and debugging, then deleted.

Your rights

If you are in the EU/UK (and in many other regions) you can ask us to access, correct, export, or delete your personal data, to restrict or object to certain processing, and to withdraw consent where processing relies on it. To exercise any of these, email support@witsy.io. You also have the right to lodge a complaint with your local data protection authority.

Children

Witsy is not directed at children under 16, and we do not knowingly collect their personal data. If you believe a child has given us data, contact us and we will delete it.

Changes to this policy

We may update this policy from time to time. We will post the new version here and update the date above; for material changes we will give you notice.

Contact

Futuedu Oy (Business ID 3308119-3), Hämeentie 81-83 B 49, 00550 Helsinki, Finland. Email support@witsy.io.