sned.
Last updated August 10, 2026

Privacy policy

The short version

We store what we need to generate and deliver your lessons, and nothing more. No analytics, no ad tech, no tracking pixels, no selling data, no training AI on your data. Your OpenRouter API key is encrypted at rest and only ever decrypted in memory at the moment a lesson is generated. Delete your account and everything goes with it.

What we store

Everything below lives in our database (Google Firestore) under your account:

  • Your email address — it's your login (magic-link sign-in, no password) and where lessons are delivered.
  • Course inputs — your topic, the optional context you write about yourself (age, situation, goals — whatever you choose to share), and your expertise level.
  • Generated content — the research digest, course outline, and every lesson, including their AI model, token counts, and per-lesson cost as reported by OpenRouter (so you can see what you're spending).
  • Your feedback — style and depth preferences, your standing lesson instructions, and per-lesson tweak notes. These are fed into future lesson prompts; that's their whole purpose.
  • Delivery settings — timezone, send hour, weekday-only preference, and schedule state such as the next send time.
  • Email delivery status — bounce and complaint records from our email provider, and a suppression flag so we stop sending to addresses that reject mail.
  • Operational counters — rate-limit counters (e.g. sign-in link requests) and aggregate daily service stats. Nothing in the aggregates identifies you.

Your OpenRouter API key

This one gets its own section. Your key is encrypted at rest with AES-256-GCM, bound to your account so ciphertext can't be replayed across users. It is decrypted in memory only at the moment sned makes an AI call for you, is never displayed back to you (you only ever see the last four characters), is never written to logs, and has no backup copies anywhere. It is deleted the instant you remove it in settings or delete your account.

What we deliberately don't do

  • No open or click tracking in emails — no pixels, no wrapped links.
  • No third-party analytics or advertising technology on the site.
  • No selling, renting, or sharing of your data with anyone.
  • No training of AI models on your data — by us or on our behalf.

Cookies

Exactly two, both functional: a session cookie after you sign in (httpOnly, secure, expires in 14 days) and a short-lived draft cookie that holds your wizard answers for up to 24 hours while you create a course. No tracking cookies, no third-party cookies, and therefore no consent banner.

Services we rely on

  • Firebase (Google) — authentication and database storage for everything listed above.
  • OpenRouter — generates your lessons using your own API key. Your topic, context, expertise, feedback, and lesson history are sent to the AI model you chose, via OpenRouter. Because the key is yours, you have your own direct relationship with OpenRouter, governed by their terms and privacy policy — including whatever data handling the model provider you pick applies.
  • Amazon SES — delivers the emails and reports bounces and complaints back to us. If you delete your account, your address is added to our SES suppression list so nothing is ever sent to it again.
  • Vercel — hosts the site. Standard server logs (IP address, request path, timestamp) apply, kept per Vercel's default retention and used only for operations and debugging.
  • Stripe — processes donations, entirely on Stripe's site. sned never sees your payment details.

Where processing happens

All processing happens in the United States. If you use sned from elsewhere (including the EU or UK), your data is transferred to and processed in the US.

Legal bases

Where GDPR-style laws apply: we process your data to perform the service you asked for (generating and delivering your course), and on our legitimate interest in keeping the service secure and operational (rate limits, bounce handling, server logs). We don't process your data for any purpose beyond running sned.

Retention and deletion

Your courses and lessons are kept until you delete them or your account — there's no automatic expiry, because your finished courses are yours to revisit. Deleting your account from settings immediately removes your entire data tree: profile, courses, lessons, feedback, and your encrypted key. Shared-outline links are revoked, your sign-in is invalidated, and your address goes on the email suppression list so no further mail can reach it. Server logs at Vercel age out on Vercel's default schedule.

Your rights

  • Access — export any course as markdown from its course page, anytime.
  • Correction — your settings, preferences, and notes are all self-serve.
  • Deletion — one button in settings, no email required, effective immediately.
  • Do not sell — we don't sell or share personal information as defined by the CCPA, so there's nothing to opt out of.

For anything these self-serve tools don't cover, write to hello@sned.email and we'll handle it directly.

Children

sned is not directed at children under 13 (or under 16 where that's the applicable threshold), and we don't knowingly collect their data. If you believe a child has created an account, email us and we'll delete it.

Changes to this policy

If this policy changes materially, we'll update this page and its "last updated" date, and note significant changes in a lesson email footer or on the dashboard.