Privacy Policy

When you create a Bacleo account, we collect:

Your username and email address, if you register directly.

Your name, email address, and profile photo, if you choose to sign in using Google or Facebook. This information is provided to us by those providers based on the permissions you grant during sign-in, and is used solely to create and identify your Bacleo account.

If you subscribe to a paid plan, your payment is handled entirely by our payment processor, Lemon Squeezy. We do not receive or store your card number or other payment credentials; we only receive confirmation of your subscription status and billing history from Lemon Squeezy.

To keep the Service running reliably and to understand how it performs, certain technical and usage information is collected automatically through the infrastructure providers we rely on:

Authentication and app data are handled through Firebase (a Google service), which also enables us to view aggregated usage data through Google BigQuery, such as which features are used and how often, in order to improve the Service.

Performance data, such as page load times and similar technical metrics, is collected through Vercel Speed Insights to help us identify and fix slow or broken parts of the Service.

Network and security data, such as IP address and basic device/browser information, is processed automatically by Cloudflare, our content delivery and security provider, as a standard part of serving web traffic and protecting the Service from abuse. Cloudflare R2 is used to store and deliver the study content library itself.

We do not use this automatically collected information to build advertising profiles, and we do not sell it to third parties.

Bacleo does not set its own tracking or advertising cookies. Some of the third-party services described above, particularly the Google and Facebook sign-in options and Firebase, may set their own cookies or similar identifiers as part of how authentication and analytics function on their end. Those are governed by Google's and Meta's respective privacy policies, not ours.

We use the information described above to create and maintain your account, provide access to the Service and its features, process subscription payments, communicate with you about your account or billing (including through our email provider, Loops.so), maintain the security and reliability of the Service, and understand aggregate usage patterns so we can improve Bacleo over time.

We do not use your information to show you third-party ads, and we do not sell your personal information to anyone.

When you submit the contact form, the following information is collected:

Information you provide directly: Your full name, email address, subject, and message.

Information collected automatically: Your browser language, screen resolution, timezone, user agent (browser and operating system information), the page you came from (referrer), the Bacleo page the form was submitted from, a browser fingerprint derived from the above signals combined, and the submission timestamp.

The automatically collected information is used solely for spam prevention and rate limiting. It is never used to build a profile, target you with ads, or share with third parties.

Submissions are automatically evaluated internally for spam detection purposes. This process is entirely automated and does not affect your Bacleo account in any way.

Contact form data is stored in a separate secure database, completely independent from your Bacleo account data. Only Nabil Ben Mouina has access to submitted messages.

Data is retained until the inquiry is resolved or no longer relevant, and may be deleted at our discretion.

Bacleo is built for students roughly between the ages of 10 and 19, and is not directed at children under 10. We do not knowingly collect information from children under 10. If you are a parent or guardian and believe a child under 10 has created an account, contact us using the details in Section 11 and we will remove the account and associated information.

For users under 18, we recommend that a parent or guardian be aware of and involved in the account setup, consistent with the parental consent requirement described in our Terms of Service.

We share information only with the service providers necessary to operate Bacleo, each acting under their own privacy and security obligations:

Firebase and Google BigQuery (Google) for authentication, data storage, and usage analytics.

Vercel, including Vercel Speed Insights, for hosting and performance monitoring.

Cloudflare and Cloudflare R2 for content delivery, security, and content storage.

Lemon Squeezy for payment processing.

Loops.so for transactional and account-related email.

Google and Facebook, when you choose to sign in using either provider.

We do not share your personal information with any party outside of this list, except where required by law, such as in response to a valid legal request from a competent authority.

We retain your account information for as long as your account remains active. If you delete your account, we will delete or anonymize your personal information within a reasonable period, except where retaining certain billing records is required by law or by our payment processor's own obligations.

We rely on reputable infrastructure providers (Firebase, Cloudflare, Vercel, Lemon Squeezy) that maintain their own industry-standard security practices, and we limit the personal information we collect specifically to reduce risk. No system can be guaranteed completely secure, but we take reasonable steps appropriate to the limited data we hold.

Depending on where you are located, you may have rights to access, correct, or request deletion of your personal information. Under Moroccan Law 09-08 on the protection of personal data, and under comparable data protection laws elsewhere, you can exercise these rights by contacting us at the email below. We will respond within a reasonable time.

If you are located outside Morocco, your information may be processed on servers located in other countries through the infrastructure providers listed above, as is standard for cloud-based services.

We may update this Privacy Policy from time to time as Bacleo evolves. If we make material changes, we will provide reasonable notice, such as an in-app notice or an update to this page, before the changes take effect.

If you have questions about this Privacy Policy or want to exercise your data rights, contact us at: