Privacy Policy
Last updated: November 7, 2026
- Free lessons collect no personal data. Your progress stays in your own browser.
- If you sign in, we store your Google name, email and user ID so Pro works on any device.
- Payments go through Lemon Squeezy. We never see your card.
- The newsletter is optional. If you join, your email goes to MailerLite, and you can unsubscribe in one click.
- No ads, no tracking cookies, no website analytics, and we never sell or share your data.
1. Who is responsible
The data controller is Zahi Zohar, Artzi Sherman 4, Netanya, Israel. Contact us about privacy at support@sheetschool.cc.
2. What we collect and why
| Data | When | Why | Legal basis (GDPR) |
|---|---|---|---|
| Lesson progress and points | Always | Remember where you left off | Stored only on your device; we never receive it |
| Google account name, email, profile photo URL and user ID | When you sign in | Create your account and link Pro to it | Contract (Art. 6(1)(b)) |
| Subscription status, plan, renewal date, Lemon Squeezy customer and subscription IDs | When you buy Pro | Unlock Pro and keep access in sync with your payments | Contract (Art. 6(1)(b)) |
| Billing name, email, address, country and payment details | At checkout | Collected by Lemon Squeezy as seller, not by us | See Lemon Squeezy's privacy policy |
| IP address, browser type and request logs | Every visit | Deliver the site, keep it secure and prevent abuse | Legitimate interests (Art. 6(1)(f)) |
| Email address, signup date and page, IP address at signup, and whether you open or click our emails | When you join the newsletter | Send you new-lesson updates, Sheets tips and offers; keep proof of your consent | Consent (Art. 6(1)(a)). Withdraw anytime with the unsubscribe link |
| Emails you send us | When you contact us | Answer you | Legitimate interests / contract |
We don't use your data for advertising or profiling, and we make no automated decisions with legal or similar effects about you.
3. Cookies and browser storage
We don't use tracking or advertising cookies, so there's no cookie banner. SheetSchool stores two things in your browser, both strictly necessary for features you ask for:
- Local storage, which keeps your lesson progress and points. Clear it anytime with "Reset my progress" or your browser settings.
- Firebase sign-in data (IndexedDB), which keeps you signed in. It exists only if you sign in, and is removed when you sign out.
4. Who processes your data
- Google (Firebase). Hosting, Google sign-in, our database and server functions. Our database and functions run in the EU (Belgium, europe-west1). Google acts as our processor under its data processing terms.
- MailerLite (MailerLite UAB, Vilnius, Lithuania). Stores newsletter subscribers and sends our newsletter, as our processor under its data processing agreement. Newsletter emails may contain open and click tracking so we can see what's useful; we never use it for advertising.
- Lemon Squeezy (Lemon Squeezy LLC, part of Stripe). Lemon Squeezy is the Merchant of Record: it sells you the subscription and handles payments, invoices, tax and fraud checks as an independent controller. See its privacy policy.
We share data only with these providers, or when the law requires it. We do not sell or share personal information as those terms are defined by the CCPA/CPRA and other US state privacy laws.
5. International transfers
Google and Lemon Squeezy may process data in the United States and other countries. Where data leaves the EEA, UK or Switzerland, the transfer is covered by the EU–US Data Privacy Framework (and its UK and Swiss extensions) where the provider is certified, or by the European Commission's Standard Contractual Clauses. SheetSchool is operated from Israel, which the European Commission recognizes as providing an adequate level of data protection.
6. How long we keep it
- Account and subscription data: while your account exists. If you ask us to delete it, we do so within 30 days.
- Records the law requires us to keep, such as tax and accounting records: for the legally required period. Lemon Squeezy keeps its own transaction records.
- Server logs: as kept by Google, usually 30 days or less.
- Newsletter: until you unsubscribe. We then keep only your email address and the unsubscribe record, so we never email you again by mistake.
- Support emails: up to 2 years after the conversation ends.
7. Your rights
Everyone can email us to see, correct, export or delete their data. We'll answer within 30 days.
EU, EEA, UK and Swiss residents also have the right to access, rectification, erasure, restriction, data portability and to object to processing based on legitimate interests. You can complain to your local data protection authority.
Israeli residents have the right under the Protection of Privacy Law, 5741-1981, to review the information we hold about them and to ask us to correct or delete it.
US residents (including California, Colorado, Connecticut, Virginia and other states with privacy laws) have the right to know what we collect, to access, correct and delete it, and to opt out of sale, sharing or targeted advertising. We do none of those three things. We won't treat you differently for using your rights. You may use an authorized agent; we may need to verify your identity, usually through the email address on your account.
8. Children
Free lessons collect no personal data, so anyone can use them. Signing in and buying Pro are for people aged 13 and over (or the minimum age in your country, up to 16 in parts of the EU). Younger learners need a parent's or school's consent. If you believe a child under 13 has given us personal data without consent, email us and we'll delete it.
9. Security
All traffic uses HTTPS. Database access is limited by security rules, so only you can read your own account data. Payment details never touch our systems.
10. Changes
If we change this policy, we'll update the date above. If the changes are significant, we'll also email signed-in users.