Privacy Policy
Welcome to Exhume (exhume.dev). This Privacy Policy explains what information we collect, how it is used, and how it is protected when you use our web platform and browser extension (collectively, the "Service").
The Service is operated by Sriram (trading as Exhume / sudosriram, "we," "us," or "our"). We believe in data minimalism: we only collect what is strictly necessary to authenticate you, deliver your coding drills, and manage your subscription.
1. Information We Collect
A. Information You Provide Directly
- Account Details: When you register via GitHub or Google (managed via Better Auth), we receive your primary email address, public profile name, and OAuth provider identifier.
- Support & Communication: If you email us at exhume@sudosriram.com, we collect your email address and any message content you share to provide assistance.
B. Information Collected Automatically
- Progress & Drill Data: We store your drill completion history, scores, streaks, and drill answers so you can monitor your progress over time.
- Timezone Preference: We record your local timezone so we can schedule and serve your daily micro-drills at the correct local hour.
- Technical & Log Data: Cloudflare automatically logs standard technical metadata (such as IP addresses, browser user-agent, and request timestamps) to maintain network stability, prevent DDoS attacks, and block abuse.
C. Billing & Payment Information
- All payment transactions are handled directly by our Merchant of Record and payment processor, Creem (creem.io).
- We never see, collect, or store your credit card or bank account details. Creem provides us only with transaction confirmation, subscription status, and billing country.
D. What We DO NOT Collect (Important)
- No Social Media Harvesting: The Exhume browser extension overlays puzzle drills on social media websites. It never reads, logs, or transmits your social media feeds, private messages, cookies, passwords, or activity on those third-party sites.
- No Advertising Trackers: We do not use third-party advertising cookies or cross-site behavioral tracking scripts (no Meta Pixel, no Google Ads tags).
2. How We Use Your Data
We use the collected information solely for the following purposes:
- To provide the Service: Authenticating your logins, saving your coding progress, and delivering puzzles tailored to your schedule.
- To manage subscriptions: Ensuring your account has access to the features associated with your Creem payment tier.
- To communicate with you: Sending transactional emails (such as login magic links, security notices, and receipt updates) via Resend.
- To prevent fraud and abuse: Ensuring users do not maliciously flood our APIs, queues, or Workers.
- To monitor aggregate app performance: Tracking high-level, cookieless usage metrics via Cloudflare Web Analytics.
3. AI Processing & Prompts
Exhume uses OpenRouter to dynamically route prompt requests to underlying artificial intelligence models to generate micro-drills and validate drill outputs.
No Personal Data in AI Prompts: Drills and coding prompts sent to OpenRouter contain programming context, problem parameters, and technical parameters. We do not pass your real name, email, or personally identifiable information (PII) into the prompt payloads.
4. Third-Party Service Providers (Sub-Processors)
We only share information with trusted third-party service providers that help us host, run, and maintain Exhume. Each provider is restricted to using your data only to perform its specific task:
| Provider | Purpose | Data Handled |
|---|---|---|
| Cloudflare | Edge hosting, Workers (crons), DDoS protection, and CDN | IP addresses, request logs |
| Supabase | Primary relational database and account storage | User IDs, emails, drill progress, timestamps |
| Upstash | Serverless Redis & message queues (QStash) | Temporary task payloads, rate limiting counters |
| Creem | Merchant of Record, subscription billing & checkouts | Payment metadata, subscription status |
| Resend | Transactional email delivery | User email address |
| OpenRouter | AI model routing for puzzle/drill generation | Programming parameters & code context (no PII) |
| Cloudflare Web Analytics | Privacy-first, cookieless website and traffic analytics | Aggregated page views, referrers (no personal tracking or cookies) |
| GitHub / Google | Third-party authentication (OAuth via Better Auth) | Basic profile info (name, email) |
6. Data Retention & Deletion
- Retention: We retain your account data and drill history for as long as your account remains active.
- Account Deletion: You can request the permanent deletion of your account and associated drill records at any time. Simply email exhume@sudosriram.com from the email associated with your account with the subject "Delete My Account." Upon verification, we will delete your records from our primary Supabase database within 30 days.
7. International Data Transfers & Global Users
Exhume operates globally. Because our infrastructure relies on globally distributed networks (such as Cloudflare edge servers and Supabase databases), your information may be routed and processed across servers located outside of your home country. By using the Service, you consent to this standard technical processing.
8. Your Data Rights (GDPR & Global Standards)
Regardless of your location, we respect your privacy rights. You have the right to:
- Access: Request a copy of the personal data we hold about you.
- Correction: Ask us to correct inaccurate or outdated information.
- Erasure: Request that we permanently delete your account and personal data.
- Withdraw Consent: Stop using the Service, uninstall the browser extension, or cancel your subscription at any time.
To exercise any of these rights, contact exhume@sudosriram.com.
9. Children's Privacy
Exhume is not intended for use by children under the age of 13. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided us with personal data, please contact us immediately at exhume@sudosriram.com so we can remove it.
10. Changes to This Privacy Policy
We may update this Privacy Policy periodically to reflect changes in our practices or changes to the Service. The "Last Updated" date at the top will always indicate the latest version. Your continued use of Exhume after updates are posted signifies your acceptance of the revised policy.
11. Contact Us
For any privacy questions, data requests, or feedback, please reach out to: