Privacy

Before the lesson library opens, the site asks whether you are 13 or older. It does not ask for your name, date of birth, or a real email address.

Answering no opens an unavailable page and does not create an account.

Answering yes, then accepting the on-page terms, creates a Supabase Auth user. The email is generated in the form guest-<random id>@yoloed.local. The password is random and is not shown to you. The account stores that the age check was passed and when.

The age-check code does not send email. A later visit with the same signed-in session skips the check and opens the library.

To limit automated sign-ups, the age check stores a one-way hash of your IP address and the time of the attempt. Those rows are deleted after one day. If the site turns on a Cloudflare Turnstile check, your browser also talks to Cloudflare to complete it.

Guest accounts that have not been used for a long time may be deleted.

After the age check, Supabase Auth keeps the session in cookies. The server auth client and the request proxy read and refresh those cookies. That is how you stay signed in.

The application code does not read or write localStorage or sessionStorage, and it does not store an age-gate flag there.

This repository does not set any other first-party cookies.

Signed-in playback can report watch time to this site. The stored row includes the account id, the lesson id, which title variant was shown (A or B), seconds watched, a watch ratio, whether the lesson was completed, and timestamps. The title variant is chosen from a hash of the account id and lesson id. It is not sent to a third-party analytics product.

The app loads Vercel Web Analytics on each page. That records the page you visit, the referrer, the device, and a coarse location for the people who run the site. It does not load Google Analytics, Plausible, or PostHog.

Choosing a share button opens X, Facebook, Reddit, or LinkedIn in a new window with the lesson title and page URL. The app does not embed tracking pixels from those sites. Copy link writes the URL to the clipboard only if you use that button.

Flagging a lesson stores the lesson id, your account id, a flag type (factually incorrect, offensive or mature, resembles a real person, or playback error), and the time. The account id lets each account flag a lesson only once.

Lessons are hosted on Cloudflare Stream. After you are signed in, the browser loads the Stream player from embed.cloudflarestream.com and plays the video with a short-lived token minted by this site. Thumbnails used inside the library are signed Stream images. Those media URLs are not rendered on the public homepage.

The site is hosted on Vercel. The hosting provider tells the site which country a request comes from, and the site is not available in some countries. The country is not stored by this app.

A separate, invite-only form lets someone suggest future lesson topics. The invite email is sent with Resend when that service is configured. The database stores the email address of the invited person, a hash of the invite token (not the token itself), an expiry, and the topics they submit. Submitted topics can be sent to Anthropic to draft a report. This flow is not part of watching a lesson, and the public homepage does not offer it.

Anthropic is also used on the server when operators generate or check lesson content. During import, operators can send source audio to OpenAI Whisper to make a transcript. Those calls are not started from the public homepage.

Messages sent through the contact form are stored with the topic you choose, your message, the reply email if you give one, and the time. To limit spam, the form also uses the same one-way IP hash as the age check. Messages are read by the people who run the site.

The app does not include advertising scripts, and it does not contain code that sells personal information to data brokers.