Privacy Policy

TinkerStep (“we”, “us”, “our”) operates the platform at TinkerStep. We’re a software learning platform that helps people build and learn through AI-assisted projects. For privacy questions, contact our privacy team.

Account information. When you sign in with Google, we receive your name, email address, profile picture, and Google account ID. We use these to identify you and personalize your experience.

Billing information. For subscriptions, credit packs and books, payments are processed by Stripe. Stripe handles your card details directly — we never see your card number. We store your Stripe customer ID, subscription status, and billing email.

Project data. Project descriptions, brand information, requirements, and generated previews you create through the platform are stored so you can return to them across devices.

Learning progress. Lesson completions, quiz scores, streaks, credits, and achievements are stored to power the curriculum and learn-to-earn features.

API keys (BYOK). When you start a build, the AI API key you provide is sent over TLS to our build engine, which uses it to call your AI provider (e.g. Anthropic) on your behalf, and is encrypted at rest (AES-256-GCM) scoped to that build. If you choose to save a key to your profile, it is stored encrypted at rest in our database, scoped to your account, revealed back only to your own browser when you start a build, and deletable at any time. We never mark up your AI usage, sell your key, or write it to logs in the clear.

Usage data. Standard server logs (IP address, browser, request paths, timestamps) are kept for security, debugging, and abuse prevention. We retain these for up to 30 days.

Cookies. We use a small number of cookies and browser storage for sign-in, language preference, theme and saved drafts. We don’t use third-party advertising cookies.

• To create and authenticate your account.
• To deliver the service: serve lessons, save your projects, sync progress across devices.
• To process subscriptions, credit packs and book orders via Stripe.
• To send transactional emails (sign-in confirmations, billing receipts, important account changes).
• To send product emails (new lessons, feature announcements) — you can opt out at any time.
• To improve the platform: aggregate analytics on which lessons help most, where users get stuck.
• To prevent abuse: detect and block credential-stuffing, scraping, or platform misuse.
• To comply with legal obligations.

We use a small set of trusted third-party services to operate the platform. Each only receives the data necessary to perform its specific role:

• Google (Firebase Authentication) — sign-in and identity.
• Google Cloud (Firestore, Cloud Storage) — storing your account, project, and progress data.
• Stripe — payment processing for subscriptions, credit packs and books.
• Resend — transactional and product email delivery.
• Vercel — web hosting and edge delivery.
• AI providers — receive the prompts and relevant project context needed to run the feature you use. Project builds use your API key with the selected supported provider, including Anthropic. Platform features such as image previews and content translation use the providers configured for those features.

We do not sell, rent, or trade your data. We do not use your data to train AI models.

Project builds use Bring Your Own Key (BYOK). When you run a build, our build engine uses your API key to orchestrate the AI provider (e.g., Anthropic) on your behalf, so your prompt and the generated files pass through our engine in the course of running the build. Your provider bills this usage directly. Optional platform-generated previews use TinkerStep credits and send the design brief to the configured image provider.

We retain the project files, prompts, and previews you create so you can return to them across devices, and our staff may access them to operate, debug, and secure the service. We do not sell this data or use it to train AI models. Your AI provider’s privacy policy separately governs how they handle the requests we relay to them.

If you’re in the European Union, the United Kingdom, or another jurisdiction with similar privacy laws, you have the right to:

• Access the personal data we hold about you.
• Request correction of inaccurate data.
• Request deletion of your data (“right to be forgotten”).
• Request a portable copy of your data.
• Object to or restrict certain processing.
• Withdraw consent for marketing emails at any time.
• Lodge a complaint with your local data protection authority.

To exercise any of these rights, email our privacy team. We respond within 30 days.

We retain your account and project data for as long as your account is active. If you delete your account, we permanently delete your personal data within 30 days, except for records we’re legally required to keep (e.g., financial records for tax compliance) and anonymized aggregate analytics.

TinkerStep is intended for users aged 13 and older. We do not knowingly collect personal data from children under 13. If you’re a parent or guardian and believe your child has provided us with personal data, contact our privacy team and we’ll delete it.

Users under 18 should have a parent or guardian review these terms before using the platform.

Our service providers operate globally. Your data may be transferred to and processed in the United States and the European Union. Where required, we rely on standard contractual clauses and equivalent legal mechanisms approved by the European Commission to protect your data during these transfers.

We use industry-standard security practices: HTTPS for all traffic, Firebase Authentication for identity, server-side authorization on all admin endpoints, signed webhook verification, and encrypted storage at rest via Google Cloud. No system is perfect — if you discover a security issue, please report it to our privacy team.

We’ll update this page if our practices change. Significant changes will be announced via email and an in-app notice at least 14 days before they take effect. The “Last updated” date at the top reflects the most recent version.

Questions about this policy or your data? Email our privacy team.