Privacy Policy
Lacuna is an educational analytics tool for students. It looks at your Anki review outcomes and, optionally, answered questions from question banks, and surfaces the concepts you keep getting wrong. This page explains exactly what we collect, what we do with it, and what we do not touch.
1. Who runs Lacuna
Lacuna is a project by Nicholas Samuelson (Calgary, Alberta, Canada). It is not yet incorporated. Contact: nicholas.samuelson@ucalgary.ca.
2. What we collect from you
- Account information. Your email address and a hashed password, handled by Supabase Auth. Optionally, a display name.
- Reviews from Anki (only if you install our add-on). Card identifiers, deck names, the outcome of each review (again, hard, good, easy), and timestamps.
- Answered cases from question banks (only if you install the browser extension). The outcome of each attempt.
- Self-reported exam outcomes. If you enter them.
- Consent records. Whether you have enabled AI analysis, and when.
3. What we do NOT collect
Lacuna does not receive, store, or transmit any of the following, from any source:
- Card fronts, backs, or note fields from Anki.
- Question text, answer choices, or your written reasoning from any question bank.
- Screenshots, OCR output, image bytes, audio, video, or any media.
- Names or identifiers of specific curricula, schools, or exam vendors, unless you choose to enter them as your own metadata.
These exclusions are enforced in the client code: the Anki add-on and browser extension strip content before anything leaves your device. If you inspect the network traffic from either connector, you will only see structured event data.
4. How we analyse your data
By default, all analysis runs locally, in the client running on your device or in our own backend, using deterministic rules. No third party sees your data.
You may optionally enable AI analysis, which sends a short concept name and learning objective (never your original material) to OpenAI to help classify what you are studying. This is off by default. When you enable it:
- You choose whether it is on, per device.
- OpenAI requests use strict structured output and are marked
store: false, so OpenAI does not retain the prompts. - You can disable it at any time, and the deterministic pipeline continues to work.
5. Third parties we rely on
- Supabase — account authentication, database, storage. Data is stored in Supabase's hosted region.
- Vercel — hosts the web application.
- Railway — hosts the API and background workers.
- OpenAI — only when you enable AI analysis. Used with
store: false.
We do not use analytics scripts, advertising networks, tracking pixels, or session replay tools. There are no third-party scripts loaded on our marketing or dashboard pages.
6. Cookies
Lacuna uses only strictly-necessary cookies for authentication (the Supabase session cookie). We do not use advertising or tracking cookies. Because these are strictly necessary to operate the service, a cookie consent banner is not required under EU or UK ePrivacy rules; we still describe them here so you know they exist.
7. Where your data lives, and how long
Data is stored in the hosted regions of Supabase, Vercel, and Railway. We retain your data for as long as your account is active. If you delete your account, we delete your account and associated event data within 30 days, except where we are legally required to retain a record (for example, billing records once paid plans launch).
8. Your rights
Under Canadian privacy law (PIPEDA and, if you reside in Alberta, PIPA) you have the right to:
- Access the information we hold about you.
- Ask us to correct information that is inaccurate.
- Ask us to delete your account and associated data.
- Withdraw consent to optional processing (such as AI analysis).
- Make a complaint to the Office of the Privacy Commissioner of Canada or your provincial regulator.
If you are in the UK, EU, or another region with equivalent rights, we honour the equivalents of the above. To exercise any of these rights, email nicholas.samuelson@ucalgary.ca.
9. Security
Passwords are hashed by Supabase Auth. Data at rest is encrypted by our storage providers. Access to production data is limited to Nicholas Samuelson. We aim to notify affected users within 72 hours of confirming any incident that materially affects their data.
10. Children
Lacuna is intended for adult learners in tertiary education. We do not knowingly collect data from children under 16. If you believe we hold data on a child, please contact us and we will delete it.
11. Changes to this policy
We will notify you by email of any material change to this policy at least 14 days before it takes effect. Non-material corrections (such as clarifying wording) may be made without notice; the “Last updated” date at the top will always reflect the current version.
12. Not medical advice
Lacuna is a study tool. It is not medical advice, not a diagnostic instrument, and not a validated measure of competence or clinical readiness. Do not rely on it to make decisions about patient care.