Privacy Policy

TheGermanStefan Academy

Effective 22 August 2026

A · Who we are, and what this policy covers

TheGermanStefan Academy (“the Academy”) is operated by LongLyvn LLC, a company based in the United Arab Emirates. LongLyvn LLC is responsible for the personal data described in this policy.

This policy covers the Academy website and the account-related services offered through it — creating an account, signing in, recovering a password, and storing and restoring your learning progress.

You can reach us about anything in this policy, including a privacy or deletion request, at support@thegermanstefan.com. This is the only address we use for privacy, support and deletion requests.

B · Using the Academy without an account

You do not need an account to use the Academy. The available learning content works anonymously, and your progress is kept in your own browser rather than on our servers.

Anonymous use does not mean that no technical data is handled at all. Like any website, the Academy is delivered over the internet, and our hosting and security providers process ordinary request data — such as the address your request comes from, the page requested, the time, and basic browser information — in order to deliver the site and to protect it from attack and abuse. We do not use that data to build a profile of you, and we do not combine it with an account unless you sign in.

C · What we hold when you have an account

If you choose to create an account, the Academy holds only what it needs to run that account and carry your learning between your devices:

your email address, which is how you sign in and how we send you confirmation and password-recovery messages;
authentication identifiers and session data — the records our authentication provider keeps so that a signed-in session works, including the token your browser holds to stay signed in;
an account-link record, which is what connects your sign-in identity to your Academy learner record;
your lesson progress and scores;
your completion dates;
your preferences and resume position, where those are used;
security and operational records needed to protect the service and to troubleshoot a fault;
any correspondence you choose to send us for support.

What we do not collect. The Academy does not ask for, and does not hold, your name, your postal address, your telephone number, your payment-card details, or your precise location. We do not build a marketing profile about you.

D · Why we use it

to create your account and to authenticate you when you sign in;
to verify your email address;
to let you recover your password;
to link and preserve your learning progress;
to restore the account-dependent parts of the Academy on a new device;
to keep the service secure and to prevent abuse of it;
to answer your support, privacy and deletion requests;
to meet legal obligations that apply to us.

We do not sell your personal data. We do not sell it, rent it, or trade it. The Academy carries no advertising, does no advertising profiling, and asks for no marketing consent, because it sends no marketing.

E · The providers we rely on

The Academy is a small service and uses established providers to run parts of it. Each one handles data only for the role described here:

Supabase — authentication and the infrastructure that stores your Academy account and learning data.
Cloudflare Pages — delivery of the website, and the access and security layer in front of it.
Cloudflare Turnstile — abuse prevention on account actions (section F).
Resend — the transactional email provider we intend to use for confirmation and password-recovery messages. This is our stated intention; that integration is not yet configured, and until it is, no message is sent through it.

These providers operate internationally, so data handled for the purposes above may be processed in locations outside the country you are in. Each provider handles that data under its own applicable terms and safeguards. You can find each provider's own privacy information on its website.

F · Cloudflare Turnstile, and where it applies

Turnstile is used on one part of the Academy only: the account-security actions on the account page — creating an account, signing in, requesting a password reset, and resending a confirmation message where that is required.

It exists to tell an ordinary person apart from an abusive automated request, so that account creation, sign-in and password-reset cannot be attacked at scale.
When you complete a challenge, a short-lived challenge token is produced and sent with that one account request so it can be checked.
The Academy does not intentionally store that challenge token as learning data. It is held in memory for the request being made and is not written to your device's durable storage or to your learner record.
If Turnstile is unavailable, those protected account actions fail closed — they refuse rather than proceed unprotected. No account request is sent in that state.
Anonymous learning is unaffected by any of this. If Turnstile cannot load, the Academy's available anonymous content continues to work exactly as before.

G · How long we keep it

Account and learning data is kept while it is needed to provide your account and the Academy features that depend on it.
Security, support and legally required records may be kept for as long as is reasonably necessary for those purposes.
Deletion requests are handled through the verified process in section H.
A limited amount of information may be kept where that is necessary for legal, security or fraud-prevention reasons, or because of the integrity of our backups.

We keep backups so that the service can be recovered after a failure. Those backups are protected and are cycled on their normal schedule, so we cannot promise that deleted data disappears from every backup immediately. What we can say is that a deleted account is not restored back into service from a backup.

H · Your choices and how to make a request

You may ask us to:

give you access to the personal data we hold about you;
correct information that is wrong;
delete your account and the learning data attached to it;
explain anything in this policy, or help you with a privacy question.

Send any of these to support@thegermanstefan.com.

Because these requests concern one specific account, we must confirm that the request comes from the person who owns it before we act on it. We do this by writing back to the registered email address. We will never ask you to send us your password, a sign-in token or a session cookie, and you should never send those to anyone.

I · Age

You must be at least 16 years old to register an account on your own. A user under 16 may use an account only where it has been created and is managed by a parent or legal guardian.

The Academy's anonymous learning content remains available without an account.

J · Security, and changes to this policy

We take reasonable and proportionate measures to protect your data: your password is handled by our authentication provider and is never stored by the Academy in readable form; the account page is the only place in the Academy that speaks to our servers; account actions are protected against automated abuse; and access to production data is restricted and controlled. No service can promise perfect security, and we do not make that promise.

If we make a material change to this policy, we will update the policy and its effective date above. The date at the top always tells you which version you are reading.