What we collect, and the choices you control.
Effective 31 July 2026 · Last updated 31 July 2026. Plain-English summary of how Marj (“we”) handles your data. Questions: support@marj.app.
The short version
- We collect the minimum to run your account, take payment, and understand what’s working.
- We never sell your personal data.
- Analytics and advertising cookies load only after you say yes in the consent banner — and you can change your mind any time.
- What you type into the interactive tools runs in your browser and isn’t stored on our servers.
1. Information we collect
- Account: your email; your name and profile picture if you sign in with Google. Passwords are hashed by our auth provider — we never see them.
- Progress & outputs: which lessons you’ve finished and the things you save.
- Payment: handled by Paddle, our payment provider and Merchant of Record. We receive your subscription status — never your card details.
- Analytics & advertising (with consent): cookies and similar tech, loaded through Google Tag Manager, to measure traffic and ad performance — which may involve Google, Meta and TikTok. We also store ad-click identifiers (e.g. gclid, fbclid) in a first-party cookie to tell which campaign a signup came from.
- Technical: IP address, device and browser type, and server logs.
- Support: anything you send us when you get in touch.
2. How we use it
To run your account and deliver lessons; to take payment and manage your subscription; to send you transactional emails and (if you opt in) the newsletter; to measure and improve the product; and to comply with the law. Where the law requires a legal basis, we rely on: performing our contract with you (your account and subscription), your consent (analytics, advertising, newsletter), our legitimate interest (keeping the service secure and preventing abuse), and legal obligations (e.g. keeping tax records).
3. Cookies & consent
- Essential cookies (your sign-in session, your consent choice) are always on — the site can’t work without them.
- Analytics & advertising cookies are off by default and only switch on if you choose Accept. Choose Reject and they stay off (we use Google Consent Mode to enforce this).
- You can withdraw consent any time by clearing the banner choice or contacting us.
4. Who we share it with
Only the providers that make Marj work, each under their own terms:
- Supabase — accounts, authentication and database (hosted in South Korea).
- Vercel — website hosting and delivery.
- Paddle — payments, billing and tax.
- Google — sign-in, transactional email delivery, and (with consent) measurement/advertising.
- Meta & TikTok — advertising measurement, only when we run ads and only with consent.
We may also disclose data if the law requires it, or as part of a business transfer. We do not sell your data or share it with data brokers.
5. Signing in with Google
If you choose “Continue with Google,” Google shares your name, email and profile picture so we can create your account. We don’t receive your Google password or access anything else in your Google account. You can revoke Marj’s access any time from your Google Account’s security settings.
6. Data retention
- Account & progress: kept while your account is active, and deleted within ~30 days of you closing it (short-lived backups clear soon after).
- Payment records: retained by us and Paddle as long as tax and accounting law requires.
- Analytics & ad data: retained by those partners per their own policies and your consent.
7. Security
We use HTTPS everywhere, passwords are hashed by our auth provider, and access to data is limited to what’s needed to run the service. No method of transmission or storage is ever 100% secure, but we work to protect your data and to fix issues quickly.
8. International transfers
Our providers operate in several countries, so your data may be processed outside where you live (for example, account data is stored in South Korea). We only use providers that commit to protecting it.
9. Age & young people
Marj is built for ages 15–22. If you’re under 18, please use Marj with a parent or guardian’s awareness, and only sign up if that’s allowed where you live. We don’t knowingly show personalised ads to under-18s, and we don’t knowingly collect data from children under 15 — if you believe we have, contact us and we’ll remove it.
10. Your rights
- Access, correct or export your data, or delete your account, from settings or by emailing us.
- Object to or restrict certain processing, and withdraw consent to analytics/advertising at any time.
- Unsubscribe from the newsletter in one click.
To exercise any of these: support@marj.app.
11. Changes to this policy
We’ll post material changes here and update the date above; continuing to use Marj means you accept them.
12. Contact
Questions or requests: support@marj.app. See also our Terms and Refunds.