Privacy Policy

DURA is an open-source learning platform operated by Durwood Studios LLC. If you have questions about this policy, contact us at privacy@dura.dev.

DURA stores learning data on your device using your browser's IndexedDB. This includes:

• Learning progress — lessons completed, quiz scores, time spent
• Flashcard review history and spaced-repetition scheduling
• Study preferences — theme, font size, study mode, daily goal
• Goals — daily, weekly, phase, and career goals you set
• Skill assessment results and recommended learning path
• Behavioral analytics events — lesson starts, quiz completions, streak activity (see “Analytics” below)
• Sandbox code you write in the code editor (auto-saved locally)

Learning records are stored locally by default. Account sync, submitted feedback, server-scored assessments, optional AI tools, and web sandbox previews have the separate network behavior described below. Hosting providers also receive ordinary web requests, including your IP address.

• No advertising cookies. Signed-in sessions use essential authentication cookies.
• No browser fingerprinting
• No third-party tracking scripts
• No advertising identifiers
• No names, email addresses, source code, or free-form answers in analytics event properties. Synced events are linked to your account ID.

We do not sell data. We do not run behavioral advertising. We do not share data with third parties for marketing purposes.

Creating an account is optional. DURA works fully without one. If you choose to create an account:

• We collect your email address for authentication. If you sign in with a social provider (GitHub, Google), we receive the email associated with that account.
• Your learning data syncs to our database (hosted on Supabase) so you can access it from any device.
• You can disconnect at any time. Disconnecting stops sync but does not delete your local data.
• Settings provides account deletion on deployments with the deletion database update enabled. It requires a sign-in within five minutes and removes uploaded files first, then your account and cascading learning records. It also erases this device’s account copy while preserving guest records. Other devices, downloaded exports, and previously shared copies must be cleared separately. A failed step is shown explicitly; contact the site operator if deletion is unavailable.

Analytics are off until you opt in. Opted-in events help understand which learning sequences are useful. Event properties exclude direct identifiers, but synced events are linked to your account and must be treated as personal data. Examples: “a lesson was started,” “a quiz was passed,” “a flashcard was reviewed.”

Events are stored locally in IndexedDB and batch-synced in the background when you're online (if you have an account). They never block the interface. If analytics fail, the app keeps working normally.

You can export all your analytics data from Settings. You can delete all your data from Settings.

Regardless of where you live, you have the right to:

• Access your data — Settings → Save progress to file downloads a portable learner-record archive for the current local learner, including JSON records.
• Delete your data — Settings → Clear local data removes DURA’s device records, including guest and account copies. Account deletion separately removes your account and its linked live database records. Anonymous feedback is not linked to an account and cannot be identified from your account ID; include a submission ID when asking the operator about a specific message.
• Portability — Your exported data is standard JSON. Take it wherever you want.
• Withdraw consent — Sign out to stop syncing. Clear data to remove local storage. Delete your account to remove server storage.

If a breach affects your information, we will provide notices required by applicable law. Hosting providers may retain security logs and backups under their retention policies; account deletion does not recall copies already downloaded by recipients.

DURA does not knowingly collect personal information from anyone under the age of 13. Account creation requires an age attestation, not identity verification. If you are under 13, use local lessons without an account and do not submit personal information in feedback or external tools. Network requests still reach the hosting provider.

If we learn that we have collected personal information from a user under 13, we will delete that data promptly. If you believe a user under 13 has created an account, please contact us at privacy@dura.dev.

DURA uses the following third-party services:

• Vercel — hosting and deployment. Privacy policy
• Supabase — authentication and database for account sync, public certificate lookup, and submitted feedback (including guest feedback). Privacy policy
• Stripe — voluntary tip processing only. DURA does not store payment information. Privacy policy

Optional AI Tutor and Code Review send the text and code you submit directly to Anthropic using your own API key, after consent. Web sandbox previews load a CodeSandbox-origin runtime that receives your sandbox source and may load third-party packages. Runtime downloads can also contact package CDNs. Do not include credentials or private data in sandbox code. Configured authentication protection may send a hashed request identifier to the deployment’s rate-limit service. External links and payment pages have their own policies.

DURA is open source under the AGPLv3 license. You can read every line of code that handles your data at github.com/Durwood-Studios/Dura. This is the strongest privacy guarantee we can offer — you don't have to trust our words, you can verify our code.

If we make material changes to this policy, we will notify users via an in-app banner before the changes take effect. The “Last updated” date at the top of this page reflects the most recent revision.