Privacy Policy

1. Who We Are

Symmetria (“we,” “us,” “our”) operates the website at symmetriachem.com. We provide interactive 3D chemistry education tools. This Privacy Policy explains how we collect, use, disclose, and protect your personal information when you use our service.

2. Information We Collect

Information you provide

• Email address - when you sign up via magic link authentication (processed by Supabase)
• Payment information - when you purchase the Practice Bundle, your payment card details are collected and processed directly by Stripe. We never receive, store, or have access to your full card number.

Information collected automatically

• Usage and analytics data - page views, feature usage, and performance metrics collected by Vercel Analytics (privacy-focused, no cookies, no cross-site tracking)
• Device information - browser type, operating system, and screen resolution (via standard HTTP headers)
• IP address - collected by our hosting provider (Vercel) for security and abuse prevention
• Practice progress - quiz scores, accuracy stats, and activity data stored in your account

3. How We Use Your Information

• Service delivery - authenticate your account, deliver practice modules, and track your progress
• Payment processing - complete your purchase via Stripe and verify payment status
• Transactional communication - send magic link emails and purchase confirmations (via Supabase Auth and Resend)
• Security and fraud prevention - detect and prevent unauthorized access or abuse
• Product improvement - understand how features are used to improve the learning experience
• Legal compliance - meet tax, accounting, and regulatory obligations

4. Third-Party Service Providers

We share personal information only with service providers who need it to operate our service:

• Stripe - payment processing. Stripe receives your payment card details directly and is PCI DSS Level 1 certified. We receive only a confirmation of payment, your Stripe customer ID, and the last four digits of your card. Stripe Privacy Policy
• Supabase - authentication and database hosting. Stores your email, account data, and practice progress. SOC 2 Type II certified. Supabase Privacy Policy
• Vercel - website hosting and analytics. Processes IP addresses for routing and provides privacy-focused analytics (no cookies, no cross-site tracking). Vercel Privacy Policy
• Resend - email delivery for magic link authentication and transactional emails. Resend Privacy Policy

5. We Do Not Sell or Share Personal Information

We do not sell, rent, or share your personal information with third parties for their marketing purposes. We do not engage in cross-context behavioral advertising. We honor Global Privacy Control (GPC) signals.

6. Data Retention

• Account data (email, practice progress) - retained while your account is active and for 30 days after deletion request
• Payment records (transaction ID, amount, date) - retained for 7 years for tax and accounting compliance
• Server logs (IP addresses, request data) - retained for up to 1 year for security purposes
• Analytics data - aggregated and anonymized by Vercel Analytics; no personally-identifiable data is retained

7. Your Privacy Rights

Depending on your state of residence, you may have the following rights under applicable privacy laws (including the California Consumer Privacy Act / CPRA, Virginia Consumer Data Protection Act, Colorado Privacy Act, Connecticut Data Privacy Act, and similar state laws):

• Right to know - what personal information we collect and how we use it
• Right to access - request a copy of your personal information
• Right to delete - request deletion of your personal information
• Right to correct - request correction of inaccurate personal information
• Right to opt out of sale - we do not sell personal information, so there is nothing to opt out of
• Right to non-discrimination - we will not treat you differently for exercising your rights

To exercise any of these rights, email us at matthew@opti-ecg.com. We will respond within 45 days.

8. Cookies and Tracking

We use a minimal session cookie (set by Supabase) to keep you logged in. We use Vercel Analytics for privacy-focused, anonymous usage metrics - it does not use cookies and does not track users across sites. We do not use advertising cookies or third-party tracking pixels.

9. Security

We take reasonable measures to protect your information, including: TLS encryption for all data in transit, encryption at rest for stored data, Supabase's SOC 2 Type II certified infrastructure, Stripe's PCI DSS Level 1 compliance for payment data, and role-based access controls. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

10. Data Breach Notification

In the event of a data breach that affects your personal information, we will notify affected users via email and comply with applicable state breach notification laws.

11. Children's Privacy

Symmetria is designed for college-level chemistry students and is not directed at children under 13. We do not knowingly collect personal information from children under 13. If we learn that we have collected personal information from a child under 13, we will delete it promptly. If you believe a child under 13 has provided us with personal information, please contact us at matthew@opti-ecg.com.

12. FERPA Disclaimer

Symmetria is not a school, university, or educational institution subject to FERPA. We do not receive education records from schools. If your school directs you to use Symmetria, your relationship with us is governed by this Privacy Policy, not FERPA.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will post the updated policy on this page and update the “Last updated” date. If we make material changes, we will notify registered users by email. Your continued use of the service after changes are posted constitutes acceptance of the updated policy.

14. Contact Us

If you have questions about this Privacy Policy or want to exercise your privacy rights, contact us at:

matthew@opti-ecg.com