Privacy Policy

Last updated: May 18, 2026

1. Introduction

LastWrite ("we," "us," or "our") is committed to protecting your privacy. This Privacy Policy explains what personal information we collect, how we use and share it, and the choices you have. It applies to all users of the LastWrite platform (the "Service").

2. Information We Collect

  • Account information: name, email address, hashed password.
  • Google sign-in profile (if you use it): name, email, profile picture; password is not stored.
  • Multi-factor authentication codes: 6-digit codes hashed before storage; codes expire after 10 minutes.
  • Usage data: lessons completed, assessment attempts, progress markers.
  • Payment information: processed by Stripe; we receive transaction metadata (amount, status, last 4 digits of card) but do not store full card numbers.
  • Security telemetry: IP address, user agent, sign-in timestamps, failed login attempts. Used for brute-force protection, rate limiting, and to alert you to logins from new IP addresses.
  • Reports and warnings: if you file or receive a report, we store the report details and any administrator review notes.
  • Communications: messages you send to [email protected] for support, bug reports, or appeals.

3. How We Use Your Information

  • To provide the Service: authenticate you, deliver lessons, process payments.
  • To enforce safety: review reports, suspend or ban accounts for violations, maintain a record of moderation actions.
  • To detect and prevent abuse: rate-limiting, brute-force lockout, suspicious IP review, IP banning.
  • To send transactional emails: registration verification, password reset, MFA codes, booking confirmations, report notifications, account moderation notices.
  • To improve the Service through aggregated analytics. We do not sell your personal information.

4. Third Parties We Share Information With

We share data with vendors and service providers only as necessary to operate the Service. Each of the following processes data under its own privacy policy:

  • Stripe, payment processing.
  • Resend, transactional email delivery.
  • Cloudflare, CDN, DDoS protection, and Turnstile CAPTCHA on auth forms.
  • Vercel, application hosting.
  • Neon, managed PostgreSQL database hosting.
  • Google, only if you choose to sign in with Google.

5. Cookies and Local Storage

LastWrite uses a single session cookie (HttpOnly, SameSite=Lax, Secure in production) to keep you signed in. We do not use third-party advertising cookies. Cloudflare may set additional cookies for security and performance.

6. Data Security

  • Passwords are hashed with bcrypt at cost 12.
  • All traffic is encrypted in transit with TLS; HSTS is preloaded.
  • Database connections are encrypted; database backups are managed by Neon.
  • We use brute-force protection (escalating lockouts), rate limiting, IP banning, and admin audit logging.
  • Multi-factor authentication is available for all users and recommended for accounts with administrative privileges.

7. Your Rights and Choices

  • Access and update: view and edit your name and email in Profile settings.
  • Email changes: require confirmation via a link sent to both your old and new addresses.
  • Password changes: sign out all other sessions when applied.
  • MFA: opt in or out at any time from your profile.
  • Login history: view your last 10 sign-in attempts in your profile.
  • Account deletion: write to [email protected] to request deletion. We will confirm and remove your account; certain records (financial, legal, abuse reports) may be retained as required by law.
  • Appeal a suspension or ban: one written appeal per account from your dashboard.
  • Data export: contact [email protected] to request a portable copy of your data.

8. Children Under 13

LastWrite is intended for users 13 years of age and older. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided us with information, contact [email protected] and we will delete it. Users between 13 and 18 should obtain parental consent before using the Service.

9. International Users

LastWrite is operated from the United States. By using the Service you consent to the transfer of your information to the United States, which may have different data protection laws than your country.

10. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated by email or by notice in the Service. Continued use after the changes take effect constitutes acceptance of the updated Policy.

11. Contact

Privacy questions, data export requests, deletion requests, bug reports, or any other concerns, write to [email protected].