Privacy policy

Last updated 29 September 2026.

Knowledge Porridge is operated by Data Alchemy Labs Ltd (dataalchemylabs.com), a company registered in England and Wales (company number 17107058), registered office Apartment 2205, 8 Walworth Road, London SE1 6EH, United Kingdom. Data Alchemy Labs Ltd is the data controller for the service. Questions and requests: support@knowledgeporridge.ai.

What we store

• Your email address, to sign you in with one-time links or with Google.
• If an AI agent signs you up: the email address it gave us, the name it gave itself, and hashes of its network address, used only for abuse limits. We send nothing to that address until the agent asks us to email you a confirmation, and every such email lets you block it. Accounts nobody confirms are deleted after 30 days.
• Your learning data: the whys you add, the terms on your self-map, your answers and confidence ratings, your notes, your progress estimates, your review schedule, and your "how I learn best" text.
• AI connections: when you connect an AI app, a record that you authorized it. Its access tokens are stored only as hashes.
• Security records: hashed sign-in and session tokens, and a hash of the IP address that requested a sign-in link, used only for rate limiting.

What we never see

Your conversations with Claude, ChatGPT or any other AI. The AI app sends us only what a tool call contains, for example the answer you chose or a note you asked it to save. Your AI provider's own privacy policy covers your conversations.

Why we process it (legal bases)

We follow the UK GDPR and the Data Protection Act 2018, and the EU GDPR for users in the EU.

• To provide the service you signed up for (Art. 6(1)(b)): sign-in, placing you on the map, planning lessons and scheduling retests.
• To keep the service secure (Art. 6(1)(f), our legitimate interest): rate limits, abuse prevention and short-lived technical logs.

We don't sell data, show ads, run analytics or advertising trackers, or train AI models on your data.

Who processes it for us

• Cloudflare: hosting, database (D1, created in the EU jurisdiction) and key-value storage.
• Resend: sending sign-in emails (EU sending region).

Signing in with Google. If you choose "Continue with Google", Google confirms your email address to us. We ask only for your email; Google also tells us it's verified and, for a work account, your organisation's domain. We store only the email address. Google handles your Google sign-in under its own privacy policy.

These providers may process data outside the UK and EU, under the UK International Data Transfer Addendum, the EU standard contractual clauses or an adequacy decision.

How long we keep it

• Your account and learning data: until you delete your account.
• Sign-in links: expire after 20 minutes and are deleted within a day.
• Sessions: expire 30 days after you sign in and are removed by a daily clean-up.
• AI connections: until you disconnect the app or delete your account.

Cookies

We use only strictly necessary cookies: one to keep you signed in, and short-lived ones that protect the step where you connect an AI app or sign in with Google. No analytics or advertising cookies, so there's no cookie banner.

Your rights

You can access, correct, export, restrict or delete your data, object to processing based on legitimate interest, and take your data elsewhere. In the app, under Account, you can download everything we hold about you as JSON, and delete your account, which removes all of your data and disconnects every AI app immediately. For anything else, email support@knowledgeporridge.ai. You also have the right to complain to the UK Information Commissioner's Office (ico.org.uk) or, in the EU, to your local data protection authority.

Children

Knowledge Porridge is not intended for anyone under 16.

Changes

If we change this policy in a way that matters, we'll say so on this page and, for significant changes, by email.