Privacy Policy

1. Who EngX is

EngX ("EngX," "we," "us") operates an online platform for practicing engineering problems. EngX is the product and trade name used for this service, which is operated from Ontario, Canada. Privacy questions can be sent to privacy@engx.app.

2. Scope of this policy

This policy covers information collected through the EngX website and application, including anonymous visitors, registered accounts, and paying subscribers. It does not cover third-party sites we link to.

3. Information we collect

We collect information in the following categories, and no others:

• Account/profile information: your email address (managed by our authentication provider), display name, timezone, and in-app appearance/notification preferences.
• Learning/progress information: which problems and steps you've attempted or completed, your answers and their correctness, attempt counts, daily completion history, and streak data.
• Subscription/billing information: your subscription tier and status, and identifiers issued by our payment processor, Stripe (Stripe Customer ID, Subscription ID, Price ID). We do not receive or store your raw payment card details — Stripe handles that directly.
• Consent history/preferences: a record of the choices you make about optional analytics and optional communications (see §7 and §9).
• Anonymous aggregate public-preview counters: EngX keeps daily totals for public practice-library views, public problem views, first answer attempts, answer submissions, correct submissions, and completed public problems. These counters contain no user ID, anonymous/session ID, IP address, referrer, advertising ID, browser metadata, or submitted answer value, and cannot be used by EngX to follow a visitor between requests.
• Analytics/telemetry information (only after you opt in): page views, feature interactions, and performance metrics — see §9 and our Tracking & Analytics Notice for the full detail.

We do not directly log or store your IP address or browser user-agent string in our own database. Our hosting and analytics infrastructure providers may process this information as part of delivering the service or optional analytics — see §10 and §20.

4. Account/profile information

Your account is created and authenticated through our authentication provider, Supabase. Your email address is managed there. In our own application database, we store a profile record linked to your account: display name, timezone, role, UI preferences, profile visibility settings, and notification preferences.

5. Learning/progress information

To provide the core product — practicing and being graded on engineering problems — we store your step-by-step answers and their correctness, which problems and steps you've completed, your daily completion counts, and your streak history. This data determines what EngX shows you (progress, streaks, resume position) and is not used for any purpose beyond delivering and improving that functionality.

6. Subscription/billing information

If you subscribe to a paid tier, we store your subscription tier, status, billing period, and identifiers issued by Stripe. Stripe processes your payment method and card details directly — EngX's systems never receive or store raw card data. See §20 (Stripe) for the processor relationship.

7. Consent history/preferences

Every decision you make about optional analytics or optional communications (grant or withdraw) is recorded in an append-only history tied to your account, along with when the decision was made and what triggered it. This history is never edited or deleted — a withdrawal is recorded as a new entry, not by erasing the earlier grant. See §26–28.

8. AI usage information

EngX uses OpenAI's API in one admin-only context: generating illustrative diagrams. This feature is restricted to EngX administrators and is not available to, or triggered by, regular user activity. In the normal course of using EngX as a learner, your account data is not sent to OpenAI. See §20 (AI processor) for detail, and our Tracking & Analytics Notice is not applicable here — this is a separate, non-analytics data flow.

9. Analytics/telemetry information

Separate from optional analytics, the anonymous public problem experience increments the aggregate operational counters described in §3. Those counters are used to understand whether the public practice feature itself is functioning and being used; they are not sent to PostHog, Google Ads, Reddit, or another advertising platform, and they do not contain a visitor/session identifier.

EngX uses PostHog (behavioral analytics), Vercel Web Analytics, Vercel Speed Insights (performance analytics), Google Ads conversion measurement, Reddit advertising conversion measurement, and Google Tag Manager as a consent-gated tag-delivery layer. None of these optional analytics or advertising-measurement tools run until you explicitly grant analytics consent — via the consent banner on your first visit, or later in Settings → Privacy. If you decline or never respond, these optional tools are not initialized. Google Ads is used to measure whether an ad led to a verified subscription purchase; the purchase event includes the transaction value, currency, and a Stripe Checkout Session identifier used for de-duplication, but not raw card details. Full detail is in our Tracking & Analytics Notice.

10. Technical/security logs

Our hosting provider, Vercel, necessarily processes standard web request metadata (such as IP address and request logs) to deliver the application and for its own infrastructure security — this happens for every request regardless of analytics consent, the same as with any web host. EngX's own application code does not separately collect or store this information. Hosting providers may retain security and request logs under their own retention policies.

11. How we use information

We use the information described above only for the following purposes:

• Service delivery (§12): operating your account, authenticating you, running the core product, and maintaining non-identifying aggregate operational counts for the public practice feature.
• Account management (§13): letting you view, correct, export, and delete your data.
• Learning/progress functionality (§14): grading your work, tracking your progress and streaks, and showing you where you left off.
• Billing (§15): processing subscription payments and determining your feature entitlements.
• Security/fraud prevention (§16): preventing abuse of the grading system (e.g., replayed submissions) and unauthorized account access.
• Analytics (§17): only with your explicit consent, understanding feature usage and performance to improve EngX.
• Optional communications (§18): only with your explicit consent, per category.
• Legal/compliance obligations (§19): where necessary to comply with applicable law.

We do not sell your personal information.

12. Service delivery

Your account and profile information is used to authenticate you and operate the platform.

13. Account management

See §22–25: you can access, correct, export, and delete your account data through self-service tools in Settings.

14. Learning/progress functionality

Your step attempts, progress, completions, and streaks are used exclusively to grade your work and display your own progress back to you.

15. Billing

Subscription and billing identifiers are used to determine your feature entitlements and to process payments through Stripe.

16. Security/fraud prevention

Grading records are used server-side to prevent replay of already-graded submissions. Authentication state is used to prevent one account from accessing or modifying another account's data.

17. Analytics

See §9 and our Tracking & Analytics Notice. Analytics data, when you consent to it, is used only to understand feature usage and platform performance.

18. Optional communications

EngX defines three optional email categories a user may separately consent to: progress emails, product update emails, and marketing/promotional emails. As of this policy's effective date, EngX does not currently send any of these emails — no sender exists yet for any of the three categories. The consent, authorization, and unsubscribe architecture described in §28 exists so that if and when a sender is built, it cannot send to you without your current, specific consent. Transactional/service email (see §19) is separate and unaffected by these preferences.

19. Legal/compliance obligations

We may use or disclose information where required to comply with applicable law, respond to lawful requests, or protect the rights, property, or safety of EngX, our users, or others.

20. Service providers / subprocessors

The following third parties process data on EngX's behalf. Only currently-used providers are listed:

• Supabase — hosts our database, authentication, and file storage. Processes essentially all application data described in this policy.
• Vercel — hosts the application and, when you consent, provides Vercel Analytics and Speed Insights.
• Stripe — processes subscription payments. Receives your billing email and payment details directly; we never receive raw card data.
• PostHog — provides behavioral analytics, only after explicit consent.
• Google Ads — provides consent-gated advertising conversion measurement so EngX can understand whether paid ads result in verified subscriptions.
• Reddit Ads — provides consent-gated advertising conversion measurement. EngX may report events such as verified subscription purchases through Google Tag Manager, using transaction value, currency, subscription tier, and a Checkout Session identifier for de-duplication. EngX does not send Reddit raw payment card details.
• Google Tag Manager — loads and coordinates optional measurement tags only after EngX analytics consent has been granted. Tags configured inside the container must use the same consent state before firing.
• Cloudflare (R2) — stores files uploaded by administrators (such as problem diagrams and other content assets).
• OpenAI — processes admin-submitted prompts for one admin-only feature (diagram generation). Not used to process regular user account data during normal platform use.

These providers may process information under their own contractual, security, and data protection terms. EngX limits optional analytics and advertising measurement to visitors who have granted analytics consent.

21. International processing / transfers

Our service providers may process data in countries other than your own, including the United States. Where required, EngX relies on the contractual and legal safeguards made available by those providers for cross-border processing.

22. Retention

We keep account and learning data while your account is active and as needed to provide the service. When you delete your account (§23), most account-linked data is deleted. A limited set of records may be retained or de-identified for billing, tax, fraud-prevention, dispute, security, consent-evidence, and other legal obligations. We retain those records only for as long as reasonably necessary for those purposes or as required by applicable law.

23. Account deletion

You can permanently delete your account from Settings → Privacy Centre → Danger Zone. This cancels any active subscription immediately, and deletes your profile, learning progress, streaks, and AI-feature usage records. Your consent-decision history and billing identifiers are retained in a de-identified form as described in §22, rather than tied to your account.

24. Data export / access

You can download a copy of your data — profile, learning progress, step attempts, streaks, subscription, and consent history — at any time from Settings → Privacy Centre.

25. Correction

You can edit your display name and timezone directly in your profile settings at any time. For corrections to information outside self-service tools (such as your account email), contact us at privacy@engx.app.

26. Consent withdrawal

You can withdraw analytics or communications consent at any time from Settings → Privacy Centre. Withdrawal takes effect on your next relevant action — for analytics, no further events are captured from the moment you withdraw; for optional email, no future matching email may be sent (§28).

27. Analytics withdrawal

See §9 and the Tracking & Analytics Notice for exactly how analytics withdrawal works, including what is cleared from your browser.

28. Email unsubscribe

Every optional email category carries its own unsubscribe link, which works without requiring you to be logged in and takes effect immediately in EngX's systems. Unsubscribing from one optional category (e.g. marketing) never affects transactional/service email, such as password resets or billing receipts. EngX processes unsubscribe requests immediately in the product and, in any event, within the timeframe required by applicable law.

29. Security safeguards

Access to your data is restricted through database-level access controls scoped to your own account, and privileged operations (such as account deletion) are handled server-side using credentials never exposed to the browser. No security measure is perfect, and we cannot guarantee absolute security of information transmitted over the internet.

30. Children / minors

EngX is intended for users aged 16 and older. We do not knowingly market the service to children under 16. If we learn that personal information was collected from a child in a manner that requires parental or guardian consent and that consent was not obtained, we will take appropriate steps to delete or otherwise address the information.

31. Changes to this policy

We may update this policy as EngX's practices change. The version number and effective date at the top of this page will be updated when the policy changes. If a change materially affects how we handle personal information, we will provide additional notice when required by applicable law or when reasonably practicable.

32. Contact / privacy requests

For privacy questions or requests not covered by the self-service tools above, contact us at privacy@engx.app. We aim to respond promptly and, for formal access requests subject to Canadian private-sector privacy law, within 30 days unless a lawful extension applies.