Privacy Policy

Last updated: August 5, 2026

CSA Compass ("we," "us") is a free study tool for AP Computer Science A. This policy explains what information we collect, how we use it, and the choices you have. We keep it short on purpose — there isn't much to tell, because we collect very little.

Information we collect

Account information

• Email & password accounts: your name, email address, and a hashed version of your password (we never store the password itself). These are stored in our database.
• Google sign-in: your name, email address, and profile picture, as shared by Google when you sign in. We never see your Google password.

Usage data

• Course progress — completed lessons, practice answers, exam scores, and per-topic stats — is stored in your browser's local storage, on your device only. We do not upload it to our servers, and it does not follow you across devices.
• Preferences such as your theme and sidebar state are also stored locally in your browser.
• Site analytics — most pages of this site load Google Analytics, which tells us how many people visit, which pages they open, roughly where in the world they are (derived from your IP address, which Google Analytics does not store in full), and what kind of device and browser they use. We use it to see which parts of the site get used and which get ignored. We do not send your name, email, or account ID to Google Analytics, so what we see there isn't tied to who you are, and we do not run ads.

AI tutor conversations

When you use the AI tutor, the messages you type (plus the lesson or question you're working on) are sent to an AI provider to generate a response. Please don't include personal information in tutor chats — it isn't needed, and the conversation is processed by the providers listed below.

Third-party services

CSA Compass relies on a small number of outside services:

• Google OAuth — optional sign-in with your Google account.
• Google Analytics — measures site traffic so we know which pages are actually used. Not linked to your account.
• Supabase — hosts our account database (names, emails, hashed passwords).
• Google Gemini API — powers AI tutor responses.
• OpenRouter — backup AI provider used when Gemini is unavailable.
• Google Fonts — loads the fonts on this site.
• YouTube — lesson videos are embedded using YouTube's privacy-enhanced (youtube-nocookie) player.

Each of these services has its own privacy policy governing how it handles data. We never sell your information to anyone.

About our AI

• The AI tutor is powered by Google Gemini, with OpenRouter as a backup provider if Gemini is unavailable.
• Every response is generated by an AI model — not a human tutor. It can be incomplete or simply wrong, the way any AI assistant can be.
• Verify anything that matters against your class materials, textbook, or teacher before relying on it — especially for anything graded.
• The tutor is used solely for educational purposes: guiding you through AP CSA lessons and practice questions. It isn't intended for, and shouldn't be used for, anything else.

Cookies

We use two cookies of our own, both strictly for signing you in:

• csa_session — keeps you signed in for up to 30 days. It is signed so it can't be tampered with, and it is not readable by page scripts.
• oauth_state — a short-lived (10 minute) security cookie used only during Google sign-in to prevent forged login attempts.

Google Analytics sets its own cookies (_ga and _ga_<id>, which last up to two years) to tell repeat visits apart from new ones. These are measurement cookies — none of our cookies are used for advertising.

As described above, we also use your browser's local storage to save progress and preferences on your device.

Your rights & choices

• Delete your account: email us at csacompass@gmail.com from the address on your account and we will delete your account and the information we hold about you.
• See your data: you can request a copy of the account information we store — it's just your name, email, and sign-in method.
• Clear local data: your progress lives in your browser. You can wipe it anytime via Settings → Reset progress inside the app, or by clearing this site's data in your browser.
• Log out: logging out removes your session cookie.
• Opt out of analytics: install Google's opt-out browser add-on, or block analytics cookies in your browser settings. The site works exactly the same either way.

Children's privacy (COPPA)

CSA Compass is intended for students 13 years of age or older. We do not knowingly collect personal information from children under 13. Creating an account requires confirming you are 13 or older. If you believe a child under 13 has created an account, contact us at csacompass@gmail.com and we will delete it promptly.

Security

Passwords are hashed with bcrypt before storage, sessions are cryptographically signed, and sign-in traffic to third-party providers travels over HTTPS. No system is perfectly secure, but we follow standard, well-tested practices rather than inventing our own.

Changes to this policy

If we change this policy, we'll update the date at the top of this page. Meaningful changes (like collecting new kinds of data) will be called out on the site.

• August 5, 2026 — disclosed Google Analytics, which has run on the site since July 19, 2026. An earlier version of this policy said we used no third-party analytics; that line was written before analytics was added and was not updated at the time. It is corrected above, and the cookies section now lists the cookies Google Analytics sets.

Contact

Questions about privacy? Email csacompass@gmail.com.