Privacy Policy

This policy covers Bitty Course's website, studio and the course sites we host. It's written for creators, their team members, and students. Bitty Course is offered only in the United States.

"Bitty Course", "we" and "us" mean Bitty Course, based in Missouri, USA. Contact: hello@bittycourse.com.

Who is responsible for your data

It depends on the activity. Each creator is responsible for their own course site, and we're responsible for the service as a whole.

Activity	Who is responsible
Accounts, sign-in, security, fraud prevention, plan billing, support and our own marketing	Bitty Course
Your student account, which works across course sites, and deleting it	Bitty Course
A creator's enrollments, progress, quiz results, certificates, comments, messages and orders	The creator; we handle this data for them as their service provider, and are responsible ourselves when moderating abuse
Payments to a creator	The creator and Stripe, under Stripe's privacy policy
Google Analytics or Meta Pixel on a course site	The creator, with Google or Meta. See "Cookies and tracking"

Questions about how a creator uses your data go to that creator; their contact details are on their course site. If you write to us instead, we'll answer what we can and pass on the rest.

What we collect

• Account details: email address, name if you give one, profile photo if you add one, and for creators the workspace name and course address. Passwords, if you set one, are stored only as a secure hash.
• Google sign-in: if you continue with Google, Google tells us your email address, name and whether the address is verified. See "Continue with Google".
• Sign-in data: one-time sign-in codes, sessions with the browser type and IP address, and sign-in attempts used for rate limiting.
• Learning activity (students): which courses you have access to, lesson progress and position, watch time per day, quiz answers and scores, certificates, comments, reviews and private messages to a creator.
• Purchases (students): the order, price, discount, tax, your country if we detected one, and the Stripe payment reference. Card details are entered on Stripe's checkout page and never reach us.
• Creator content: courses, videos, captions, transcripts, files and settings. If a creator uses AI dubbing, audio from their lessons goes to our dubbing provider.
• Notifications: if you turn on notifications on a device, that device's push address and keys, and your browser type.
• Messages: emails we send you and whether they were delivered.
• Technical data: server logs with IP addresses and requests.

Students' data comes from them, from the creator who adds or imports them, and from Stripe.

Why we use it

• To provide the service: sign-in, hosting and playing courses, access, purchases, progress, receipts and service emails.
• To keep the service and its users safe: security, abuse and fraud prevention, rate limits and logs.
• To check that purchases come from where Bitty Course is offered.
• To show creators the progress and activity of their own students.
• To keep business, tax and accounting records, including order records after a student deletes their account.
• To send device notifications you turned on, and to run a creator's analytics tools if you allowed them.

We don't make decisions with legal or similarly significant effects about you by automated means alone.

Who receives data

Recipient	What for	Data	Location
Hetzner	Servers and database	All data we hold	Finland
Backblaze	File storage and encrypted database backups	Files, photos, full database in encrypted form	United States
Bunny.net	Video storage, encoding and playback	Course videos and captions; viewer IP for delivery	Global network
Stripe	Course checkout and payouts; our plan billing	Purchase, card and payout details	United States and elsewhere
Postmark	Sending email	Email address, message content	United States
Cloudflare	Domain name service and email forwarding	Messages sent to our addresses	Global network
Google	Continue with Google, when you choose it	Sign-in details	United States
Your browser's push service (such as Google, Apple, Mozilla or Microsoft)	Delivering notifications you turned on	Your device's push address, delivery timing; message contents are encrypted	Varies
OpenAI	Captions, when a creator turns them on	Lesson audio	United States
Anthropic	Translation and drafting, when a creator uses them	Lesson captions and titles	United States
ElevenLabs	AI dubbing, when a creator uses it	Lesson audio	United States

The creator of each course you take can see your name, email, progress, activity and orders for that course. Other students can see your name, photo, comments and reviews on a course. AI features process course content, not student data, and AI assistants connected by a creator never receive student names or emails. We may disclose data if the law requires it, or to protect people or the service.

We don't sell personal data. Google or Meta receive data through a creator's tracking tools only if you allow them; see below.

Where data is kept

Our servers are in Finland, and our staff and several of our providers are in the United States and elsewhere, as the table above shows. Your data may be stored or accessed in those places.

How long we keep it

• Account and workspace data: while the account is active. After a creator cancels, the workspace stays for a 30-day grace period, then goes offline. We keep the data after that so the creator can come back, and delete it within 30 days if they ask.
• Replaced video versions: kept so creators can roll back, until the creator deletes them or we clean them up.
• Sign-in codes: until used or expired. Sessions: up to 30 days, or 14 days without activity.
• Server logs: a short period; older entries are overwritten as logs rotate.
• Database backups: 30 days, encrypted.
• Our plan billing records: 7 years.
• Order records: while the creator's workspace is active and as long as tax and accounting duties require, with identifying details removed after a student deletes their account.

Deleting your account

Students can delete their account or download a copy of their data from Your profile. Team members leave or close their workspace first.

When you delete your account, we remove your name, email, photo, password and other sign-in methods, reviews, messages, certificates and notification devices, and your comments show as deleted. Your access to every course on every course site ends. Deletion is permanent.

We keep your orders, learning progress and the record that you accepted our terms, without your name or email, so that creators can meet their tax duties and their course statistics stay correct. An order still holds its Stripe payment reference, and a creator's own Stripe account may keep its own records, so this is de-identified data rather than fully anonymous data. Backups containing your details expire within 30 days.

Your rights

Whichever state you live in, you can ask to access, correct, export or delete your data, and you can withdraw any consent you gave. Some state laws give you further rights, including the right to appeal our decision, and to complain to your state attorney general. Write to hello@bittycourse.com; we'll answer within 45 days.

Continue with Google

If you choose it, we ask Google for your basic profile: your account ID, email address, name and picture. We keep only your email address and name, to create or find your account, and we don't store your Google password or access tokens. We don't sell this data or use it for advertising, and we don't share it except as this policy describes. You can remove Bitty Course's access from your Google account settings and delete your data as above.

Device notifications

If you turn on notifications, we use your device's push address to tell you when a creator replies to you. Your browser's push service delivers them and sees delivery details, but not the encrypted contents. You can turn them off in Your profile or in your browser settings. We delete the address when you do, or when you delete your account.

Your country

We use your IP address to work out your country, with a database on our own servers: your IP address isn't sent to the database's provider, and the result is only a country. We use it to check that purchases and sign-ups come from where Bitty Course is offered, and save it with your order. Anyone already enrolled keeps their access.

Cookies and tracking

Name	What for	How long
session_id	Keeps you signed in	30 days
Session cookie	Security and sign-in steps	Until you close your browser
sign_in_code	Remembers the code you're waiting for	Minutes
Coupon cookie	Remembers a coupon you entered	30 days
player_view, courses_view, studio_sidebar	Your display preferences	1 year
tracking_consent	Your choice about a creator's analytics tools	6 months

Your browser also stores player preferences, such as speed and captions, on your device.

Bitty Course adds no advertising trackers of its own. A creator can choose to add Google Analytics or Meta Pixel to their course site. If they do, the site asks you first. These tools load only if you choose Allow, and then set cookies and send your activity on that site, including the names of pages you view, to Google or Meta. To change your choice, clear this site's cookies in your browser and you'll be asked again. The creator is responsible for how they use these tools.

We don't respond to Do Not Track signals, because there is no common standard for them.

Children

Bitty Course isn't directed at children under 16, and we don't knowingly collect data from anyone under 13. If you believe a child under 13 has an account, write to hello@bittycourse.com and we'll delete it.

Security

We protect data with encrypted connections, access checks and encrypted backups, and we don't hold card details. No service is perfectly secure. If a breach affects your data, we'll notify you and the authorities as the law requires.

Changes

We'll publish changes here with a new version date, and email account holders about material changes before they apply. If we want to use your data for a new purpose, we'll tell you first.