Security
Your data, under control
We build OpenLearn so you always know what happens to your messages and files. No hidden terms, no selling data.
Principles
What we do to protect you
Encryption
All traffic runs over TLS. Passwords are stored only as hashes (bcrypt/argon2) — we never see them in plain text.
No training on your data
We send every provider the data_collection: deny flag — your prompts aren't used to train models.
We don't sell data
We never sell or hand your conversations to third parties for advertising or other commercial purposes.
Minimization
"Extract & Forget": text is extracted from a file, then the file itself is deleted. R2 uploads live no longer than 2 days.
Sub-processors
Who receives data, and why
To run the platform, some data passes through trusted partners. The full, current list is in the Privacy Policy.
| Processor | What's shared and why | Data location |
|---|---|---|
| OpenRouterAI | Routing requests to all models | US / EU |
| OpenAIAI | Generating responses from GPT models | US |
| AnthropicAI | Generating responses from Claude models | US |
| GoogleAI | Generating responses from Gemini models | US / EU |
| DeepSeekAI | Generating responses from DeepSeek models | via OpenRouter |
| StripePayments | Processing international payments | US / EU |
| YooKassaPayments | Processing payments in rubles | Russia |
| ResendEmail | Transactional email (verification, password reset) | US |
| CloudflareInfra | DNS, attack protection, upload storage (R2) | Global |
Compliance
Regulators and user rights
European Union
The right to access, rectify, delete and export your personal data on request.
Russian Federation
Personal-data processing in line with Russian legal requirements.
California, USA
Transparency about data collection and the right to opt out of its sale — which we don't do anyway.
Data lifecycle
What's stored and how to delete it
- Chat historyKept in your account until you delete it. You can erase any chat manually.
- Uploaded filesText is extracted, the file is deleted. R2 uploads have a 2-day lifetime.
- AvatarsStored permanently until you replace them or delete your account.
- Account deletionSoft-delete: data is marked for deletion and wiped. Export and the right to be forgotten are available.
Privacy questions?
Read the full policy or write to us — we'll answer to the point.