Privacy, in plain English.

Last updated: 19 May 2026. Effective immediately.

Short version

• If you don't sign up, we collect basically nothing about you personally.
• If you sign up, we store your email + a profile to track your course progress.
• R2 Co-pilot conversations are logged for 30 days to improve the Atlas, then deleted.
• We use one analytics tool (Plausible) that doesn't use cookies or track you across sites.
• We never sell, rent, or share your data with third parties for marketing.
• You can delete everything we have about you by emailing ravi6703@gmail.com.

What we collect

If you just visit the site (no signup)

• Anonymous analytics (page views, country-level location, browser type) via Plausible. No cookies. No personal ID.
• Your IP address is processed by Vercel for serving the site, but not stored by us beyond the 30-day Vercel default.
• If you use R2 Co-pilot without signing up: the text of your conversation is sent to Anthropic to generate a response, then logged on our server with no user ID, then deleted after 30 days.

If you sign up

• Your email address (required, used for login and account recovery)
• Your display name and avatar (optional, you provide)
• Your diagnostic-test result and which courses you've started or completed
• Your R2 Co-pilot conversations, linked to your account, for a rolling 90 days (so you can revisit past explanations)

How we use what we collect

• To run the site. Show you the right course progress, remember your placement, log you in.
• To improve content. When R2 Co-pilot can't answer a question well, we use the anonymised question to write a new Atlas entry.
• To send you the newsletter — only if you explicitly subscribe. One Pulse per week. Unsubscribe in one click.
• We do NOT use your data to train Claude or any other foundation model. Your conversations with R2 Co-pilot are sent to Anthropic's API under Anthropic's no-training policy for API customers.

Who we share data with

• Anthropic — for R2 Co-pilot responses. They process the conversation, do not train on it, and delete it per their API terms.
• Vercel — for hosting. They see request logs.
• Supabase — for database and authentication. They store the data you give us.
• Resend — for sending newsletter and account emails. They see your email address.
• Plausible — for privacy-first analytics. They see anonymous page-view events.

We do not share your data with anyone else. We do not sell it. We do not rent it.

Your rights under the DPDP Act 2023 (India) and GDPR (EU)

You have the right to:

• Access — see what data we have about you.
• Rectify — correct anything inaccurate.
• Erase — delete your account and all associated data. Permanent.
• Withdraw consent — at any time, for anything you previously consented to.
• Port your data — get a copy of your data in a machine-readable format.
• Lodge a complaint — with the Data Protection Board of India (under DPDP) or your local Data Protection Authority (under GDPR).

To exercise any of these rights, email ravi6703@gmail.com with "DPDP request" in the subject line. We respond within 30 days.

Children

R2BOT is intended for everyone, including children, but if you're under 18 and want to create an account, please have a parent or guardian set it up with you. We do not knowingly collect data from children under 13.

Security

All data in transit is encrypted (HTTPS). Database is encrypted at rest. Authentication uses industry-standard tokens. We don't store passwords in plain text. If we ever suffer a breach affecting your data, we'll notify you within 72 hours.

Changes to this policy

We'll update this page when our practices change. Material changes will be announced in the next newsletter and to logged-in users. The "last updated" date at the top will always reflect the most recent revision.

Questions? Email ravi6703@gmail.com.