Privacy Policy

Last updated: 1 September 2026

UpPetto (https://uppeto.com) generates short courses from a topic you describe. This page says what we store, why, who else sees it, and how to make us delete it. It is written to be read, not to be survived.

What we collect

• Your email address. It is your account. You give it to us by signing up, by asking for a one-time sign-in link, or by signing in with Google, which tells us the address and your display name and nothing else.
• A password hash, only if you chose a password. We never store the password itself and cannot read it. Accounts that only ever used Google or a sign-in link have no password at all.
• Your Google account identifier (the stable sub value) and the address Google reported, so that the next sign-in recognises you. We do not receive, ask for, or store your Google password, contacts, Drive, or mail.
• What you type into the product: the topic you want a course on, your answers during onboarding, quiz and exam answers, and which lessons you have opened. This is what the courses and the progress dashboard are made of.
• Images you upload to a course, and a record of each upload: which account uploaded it, when, through which connected app, the file's size, type and fingerprint (a SHA-256 hash of the original), and the source, author and license you declared. We do not verify that declaration. We keep the image converted to AVIF, without its EXIF data (camera, GPS); the original file itself is not kept. An uploaded image is served at an address that cannot be guessed, and anyone who has that address can see the image, even when the course is private. Revoking the image stops the address working at once.
• Payment records, if you buy course slots: the identifier of the transaction, what it was worth, and its state. Card numbers never reach us — they are handled by Stripe or Google Play, who bill you directly.
• Ordinary server logs, including IP addresses, kept to stop abuse and to make rate limiting work.

Why, and on what basis

To run the service you asked for (performing our contract with you), to keep it standing up under abuse and to keep accounts secure (our legitimate interest), and to meet accounting obligations on payments (legal obligation). We do not run advertising, we do not profile you for advertisers, and we do not sell anything about you to anyone.

Who else processes it

• Language-model providers — currently OpenRouter (Anthropic, DeepSeek, Google, OpenAI, Thinking Machines, Xiaomi, Z.ai, xAI) · Perplexity. The topic you enter and the material being generated are sent to them so a course can be written. Do not paste anything into UpPetto that you would not send to a third party.
• Brevo, which delivers our email (confirmations, sign-in links, notices).
• Google, if you choose to sign in with Google.
• Stripe and Google Play, if you pay.
• OVH, where the server runs.

These are processors doing a job for us, not audiences we hand your data to.

One address, one account

If you sign in with Google using an address that already has an UpPetto account, we attach that Google identity to the account you already have instead of creating a second one, and we email you to say so. That email is deliberate: connecting a new way to sign in changes your account's security, and you are entitled to hear about it even if it was you.

How long we keep it

Account data and your courses stay until you delete the account. The record of an image upload or revoke outlives the image, the course and the account: it exists so that the origin of a file can still be established after the file is gone. One-time sign-in links are stored as hashes, expire in minutes and are single-use. Payment records outlive the account, because money that changed hands has to remain provable.

Your rights

Ask us and we will show you what we hold, correct it, or delete your account and everything personal in it. Where the GDPR applies you also have the right to a copy in a portable form, to object to processing based on legitimate interest, and to complain to your national data-protection authority.

Children

UpPetto is not for people under 16, and we do not knowingly create accounts for them.

Changes

If this page changes in a way that matters, we will say so on the site and, for changes to how we use your data, by email.

Contact

Write to talgat.v1994@gmail.com.

Privacy · Terms · How it works