Privacy Policy

Who is responsible

BiliMind is run by Oybek Odilov as an individual, who is the data controller for everything on this page. For anything here, including a request to see or delete your data, email [email protected].

What we collect

Because you gave it to us

• Your name and email address, or your Telegram account identifier if you sign in through Telegram.
• Your password, stored only in scrambled form (a hash). We cannot see it and cannot recover it.
• Your language, timezone and study preferences.
• What you ask to learn: topics, goals, and your answers to the questions we ask.
• Documents, notes and links you upload as source material.
• If you connect your own AI model key, the key itself. It is encrypted before it is stored and used only for your own lessons.

Because you used the product

• Your answers to quizzes, exercises and exams, and their scores and feedback.
• Voice recordings you make in speaking exercises.
• Which lessons you opened, when, and for how long. This is what makes your review schedule work.

Because your browser sent it

• Standard technical data: IP address, browser type, and the pages requested.

When you buy something

Paddle, which sells our plans as merchant of record, collects your payment details and billing address. We receive your email address, what you bought, and whether your plan is active. Your card number never reaches us.

Why we hold it

• To run your account, because you asked us to (performance of a contract).
• To generate, grade and schedule your courses, because that is the service (performance of a contract).
• To take payment when you buy something (performance of a contract).
• To keep the service working and secure: rate limits, abuse prevention and fixing faults (legitimate interests).

We do not sell your data. We do not use it to train AI models. We do not show advertising of any kind.

Who else sees it

To generate and grade a course, parts of what you write go to the services that do that work:

• OpenRouter, and the AI model provider it routes each request to: your topics, uploaded material, and the answers being graded.
• Microsoft Edge text-to-speech: lesson text to be read aloud.
• Your browser's own speech recognition: in Chrome, Edge and on Android, a speaking exercise is transcribed by the browser, which may send the audio to the company that makes it, such as Google or Microsoft. In other browsers the recording comes to our server instead, is transcribed there, and is not sent to anyone else.
• Paddle: your payment details, billing address and purchase history, which Paddle handles under its own privacy policy.
• Cloudflare: network traffic, for delivery and protection, and anonymous page-view counts.
• Telegram: your account identifier, if you sign in that way.

These services operate outside your country, so your data may be processed abroad.

How long we keep it

• Your account details, for as long as your account exists.
• Your courses, answers and progress, for as long as your account exists. They are the thing you use BiliMind to keep.
• Voice recordings that reach our server are deleted as soon as they have been transcribed.
• Technical logs, for a short operational period.

Delete your account and we delete all of the above, apart from anything the law requires us to keep, such as records of payments.

Your rights

Wherever you live, you can ask us to show you what we hold, correct it, delete it, give you a copy, or stop a particular use of it. Email [email protected] and you will get an answer within 30 days. If you are in the EU or the UK, you also have the right to complain to your data protection authority.

Children

You must be at least 13 to use BiliMind, and under 16 a parent or guardian has to agree for you. BiliMind is used to prepare for school and university exams, so we expect some learners to be under 18. We collect nothing more from them than from anyone else, and nobody's data is used for advertising. If you believe a child has given us information without the permission they needed, email [email protected] and we will delete it.

Security

Traffic is encrypted in transit, and the application is reachable only through an encrypted tunnel, never directly from the internet. Passwords are hashed, and any AI key you provide is encrypted at rest. Code you run in exercises runs inside your own browser and never touches our servers.

No system is perfect. If you find a vulnerability, email [email protected] and you will get a reply.

Changes

If this policy changes materially, we will say so on this page and, where the change matters to you, by email.