Privacy Policy
Last updated: 29 July 2026 · Version 1.3
This Privacy Policy explains how Sikker Software ("we", "us"), the business operating Tech Professor, collects, uses, stores and protects personal data when you use the Tech Professor web app, API and MCP server (together, the "Service"). We are the data controller for that personal data.
1. Who we are & how to contact us
Controller: Sikker Software, based in Denmark. For any privacy question or to exercise your rights, email privacy@tech-professor.com.
2. The data we collect
| Category | Examples | Source |
|---|---|---|
| Account & identity | Email address, display name, hashed password or OAuth identity, profile settings | You, at sign-up (via Supabase Auth) |
| Repository metadata | Display name, optional remote URL, and GitHub link fields (for example full name, default branch, private/public flag, installation id) — not a copy of your source tree. See §3. | You, when you create or link a repository |
| Learning content | Generated quizzes, walkthroughs, flashcards and related packages; answers, progress and notes; source snippets or diffs that appear inside those artifacts when you generate or import them; docs and sites you paste or ingest | You / generated on your instruction |
| Integration credentials | GitHub OAuth and personal-access tokens (encrypted); AI provider API keys (Claude, OpenAI, Cursor); personal API tokens for the MCP server and CLI | You, when connecting an integration |
| Team & organization data | Team/organization membership, roles, invitations, shared spaces | You and your team admins |
| Billing | Plan, subscription status, transaction identifiers | Our payment processor (Paddle) |
| Technical & usage | IP address, request metadata and rate-limit counters used to operate and secure the Service | Collected automatically |
We do not sell your data, and we do not run advertising or cross-site tracking.
3. Repository data — what we keep and what we don't
In practice that means:
- Stored: the repository record (name, owner, team, remote URL when set, and GitHub identity fields listed above).
- Stored when you generate or ingest learning material: artifact content (quizzes, tours, flashcards, packages) and any code snippets, diffs or excerpts those artifacts intentionally include — so you can revisit and share that material without us keeping a full copy of the repository.
- Not stored: a full clone, blob store or continuous mirror of your repository tree. Disconnecting GitHub stops new live reads; you can delete the repository record and its artifacts from the app, or delete your account to remove your data.
4. How we store & protect your data
Your data is stored in our Supabase (PostgreSQL) database. Row-Level Security (RLS) policies scope every row to its owner or team, so one account cannot read another's data. All traffic to and from the Service is encrypted in transit with TLS.
Encryption of secrets
Secrets receive additional protection at rest, beyond database-level encryption:
- AI provider API keys (Claude, OpenAI, Cursor) and GitHub connection tokens (OAuth and personal-access tokens) are encrypted with AES-256-GCM. Each user's secrets are sealed with a distinct data-encryption key derived via HKDF-SHA-256 from a master key and your account id, so a key leaked from one account can never decrypt another's. The master key is held in server environment configuration, never in the database. We never store these credentials in plain text.
- Personal API tokens (for the MCP server / CLI) are never stored in plain text — we keep only a SHA-256 hash plus a short non-secret display prefix. A leaked database row cannot be turned back into a usable token. The full token is shown to you exactly once, at creation.
- Passwords are handled and salted-and-hashed by Supabase Auth; we never see or store your plaintext password.
- Webhook signatures (e.g. Paddle) are verified with HMAC-SHA-256 so we only act on authentic events.
5. How we use your data (and our legal bases)
- To provide the Service — authenticate you, store your repository metadata and learning content, generate material, and fetch live code from GitHub when you ask. Legal basis: performance of a contract.
- To process payments — manage subscriptions and plan entitlements. Legal basis: contract.
- To secure and operate the Service — rate limiting, abuse prevention, debugging, backups. Legal basis: legitimate interests.
- Optional analytics — only if you opt in via the cookie banner. Legal basis: consent.
When you generate content, the relevant source text and prompts are sent to the AI provider you (or your workspace) selected, using either your own key or a platform key. Providers process this to return a result; see their policies for how they handle it. We do not use your private content to train models.
6. Sharing & sub-processors
We share data only with service providers that help us run the Service:
| Sub-processor | Purpose |
|---|---|
| Supabase | Database, authentication and file/storage hosting |
| Paddle | Payments and subscription billing (merchant of record) |
| GitHub | On-demand repository access (files, PRs, branches) when you connect a GitHub account |
| Anthropic / OpenAI / Cursor | AI generation, when you use those providers |
| PostHog (EU cloud) | Feature-flag evaluation; optional product analytics only if you opt in via the cookie banner |
We may also disclose data where required by law, or to protect our rights, safety and the integrity of the Service.
7. International transfers
Our providers may process data outside your country, including the United States. Where required, transfers rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses.
8. Retention
We keep your data for as long as your account is active. When you delete your account (Settings → Sign-in & password → Delete account), we delete or irreversibly anonymize your personal data, except where we must retain limited records to meet legal, tax or accounting obligations. Backups are purged on a rolling schedule.
9. Your rights
Depending on where you live (e.g. under GDPR/UK GDPR or CCPA), you may have the right to access, correct, delete, export (portability), restrict or object to our processing of your data, and to withdraw consent at any time. You can:
- Access and edit most data directly in the app;
- Delete your account and its data from Settings → Sign-in & password;
- Change cookie choices via "Cookie preferences" in the footer;
- Contact privacy@tech-professor.com for any other request. You also have the right to complain to your local data protection authority.
10. Children
The Service is not directed to children under 16, and we do not knowingly collect their personal data. If you believe a child has provided us data, contact us and we will remove it.
11. Changes
We may update this policy; we will revise the "last updated" date and, for material changes, notify you in-app or by email. Continued use after an update means you accept the revised policy.
Questions? Email privacy@tech-professor.com.