Privacy Policy

1. Introduction

Tyler Gordon Dev LLC ("we", "us", or "our") operates Complete Debate (the "Service"). This Privacy Policy informs you of our policies regarding the collection, use, and disclosure of personal data when you use our Service and the choices you have associated with that data.

We use your data to provide and improve the Service. By using the Service, you agree to the collection and use of information in accordance with this policy.

2. Information We Collect

2.1 Personal Information

When you create an account, we collect:

• Full name
• Email address
• Password (encrypted)
• Preferred debate format (Policy, PF, LD, or Congress)

2.2 Usage Data

We automatically collect certain information when you use the Service:

• Tool usage logs (which features you use and when)
• Token consumption (for billing and rate limiting)
• API request timestamps and costs
• Browser type and version
• Device information
• IP address
• Pages visited and time spent on pages

2.3 Content Data

We store content you create or upload through the Service:

• Debate cards and evidence
• Speech documents
• Flow sheets and arguments
• Practice session data
• AI-generated content and prompts

2.4 Payment Information

Payment processing is handled by Stripe. We do not store your credit card information on our servers. We receive limited payment metadata from Stripe including:

• Subscription status
• Subscription tier (Free, Pro, Premium)
• Payment method type (last 4 digits of card)
• Billing history

3. How We Use Your Information

We use the collected data for various purposes:

• To provide and maintain the Service
• To process your registration and manage your account
• To process payments and manage subscriptions
• To track usage and enforce rate limits
• To generate AI responses using OpenAI's API
• To improve and personalize the Service
• To send you administrative information and updates
• To monitor usage patterns and detect abuse
• To comply with legal obligations
• To provide customer support

4. Third-Party Services

We use the following third-party services that may collect and process your data:

4.1 Supabase (Database & Authentication)

• Stores user accounts and authentication data
• Hosts all content and usage data
• Privacy Policy: supabase.com/privacy

4.2 OpenAI (AI Processing)

• Processes your prompts and generates AI responses
• Receives content you submit for AI analysis
• Does not use your data for model training (per enterprise agreement)
• Privacy Policy: openai.com/privacy

4.3 Stripe (Payment Processing)

• Processes all payment transactions
• Stores payment method information securely
• Manages subscription billing
• Privacy Policy: stripe.com/privacy

4.4 Render (Hosting)

• Hosts the web application
• Collects access logs and performance metrics
• Privacy Policy: render.com/privacy

4.5 Security Monitoring

To protect the platform from malicious attacks and abuse, we collect security monitoring data:

• What We Log: When suspicious activity is detected (such as potential prompt injection attempts), we log event type, timestamp, feature accessed, severity level, input length, and a cryptographic hash for deduplication
• What We DON'T Log: We do NOT store the actual content of flagged inputs to protect your debate strategy and privacy
• Purpose: Protect against attacks on AI systems, identify false positives, and improve security
• Access: Only platform administrators can view security logs
• Retention: Security logs are automatically deleted after 90 days

If you believe your content was incorrectly flagged, please contact support.

5. Data Retention

We retain your personal information for as long as your account is active or as needed to provide you services. Specifically:

• Account data: Retained until you delete your account
• Content data: Retained until you delete it or close your account
• Usage logs: Retained for 90 days for operational purposes
• Billing records: Retained for 7 years for tax compliance
• Backups: Deleted within 30 days after account deletion

6. Data Security

We implement appropriate security measures to protect your personal information:

• Passwords are encrypted using industry-standard bcrypt hashing
• All data transmission uses HTTPS/TLS encryption
• Database access is restricted to authorized personnel only
• Row-level security policies protect user data in the database
• Regular security audits and updates
• Secure API authentication tokens

However, no method of transmission over the Internet is 100% secure. While we strive to use commercially acceptable means to protect your data, we cannot guarantee absolute security.

7. Your Rights

You have the following rights regarding your personal data:

• Access: Request a copy of the data we hold about you
• Correction: Update or correct inaccurate information
• Deletion: Request deletion of your account and data
• Export: Download your content and data
• Objection: Object to certain processing of your data
• Restriction: Request limitation of processing
• Portability: Transfer your data to another service

To exercise these rights, contact us at tyler@tylergordon.dev

8. Children's Privacy

Our Service is intended for high school students and older. We require all users to be at least 13 years old. If you are under 18, you should have parental consent to use the Service. We do not knowingly collect personal information from children under 13.

If you are a parent or guardian and believe your child has provided us with personal information without consent, please contact us immediately.

9. Cookies and Tracking

We use cookies and similar tracking technologies to improve your experience:

• Essential cookies: Required for authentication and core functionality
• Preference cookies: Remember your settings (theme, debate format)
• Analytics cookies: Understand how you use the Service

You can control cookies through your browser settings, but disabling essential cookies may prevent the Service from working properly.

10. International Data Transfers

Your information may be transferred to and processed in countries other than your country of residence. These countries may have different data protection laws. By using the Service, you consent to such transfers.

11. Do Not Sell My Information

We do not sell, rent, or trade your personal information to third parties for their marketing purposes. We only share data with service providers necessary to operate the Service as described in this policy.

12. Changes to This Privacy Policy

We may update our Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last updated" date. Significant changes will be communicated via email.

Your continued use of the Service after changes become effective constitutes acceptance of the updated Privacy Policy.

13. Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact us: