Privacy Policy

1. Who this is about

Day Dreamer English is the service described here. The controller’s legal name, address and privacy contact are intentionally left as placeholders until the owner completes this draft.

2. Information we handle

Depending on how you use the service, this can include:

• account details such as your name, e-mail address, password hash and account role;
• optional contact details such as country, phone number and address;
• teacher profile details such as biography, courses, language levels, availability, price, profile photo and lesson notes;
• booking details such as teacher, student, course, date, time, price, status, cancellation, payment review, refund destination and transfer references;
• lesson content you or a teacher submit, including published notes, vocabulary, homework, classroom messages and whiteboard strokes;
• security and technical details such as your session cookie, browser user agent, IP address in server logs, request records and error logs.

We do not need your GCash login or card number for the simulated transfer workflow. Do not submit those credentials.

3. Why we use it

We use information to:

• create and protect accounts, sign you in and confirm account links;
• show teacher profiles and availability and coordinate requests, proposals and lessons;
• record the simulated transfer report, let an administrator review it, and manage refunds and refund destinations;
• provide the browser classroom, lesson notes, chat and whiteboard features;
• send essential account or booking messages when those features are enabled;
• prevent misuse, investigate incidents, maintain the service and meet legal obligations;
• respond to requests about your account and privacy.

The site does not use analytics cookies or advertising cookies. It does not sell your personal information or use lesson content for advertising.

4. Cookies and sessions

The essential ddl_session cookie keeps you signed in. It is HttpOnly and SameSite=Lax, so browser scripts cannot read it and cross-site requests receive the browser’s normal protection. The cookie is used for the session and security flow, not for analytics or advertising.

5. Service providers

The service uses infrastructure providers to host the application, database and job queue, Resend as the transactional email processor, and LiveKit to provide the browser classroom. These providers process information only as needed to provide their service to Day Dreamer English. The owner should add the final provider names, locations and contractual details before publication.

Administrators who operate Day Dreamer English can access booking, payment-review, refund, account and audit information needed for their work. Teachers and students can see only the lesson and account information made available to them by the product.

6. Retention

We keep account and booking information while it is needed to provide the service, resolve bookings and refunds, protect security, and meet legal or accounting obligations. Lesson notes and classroom content are kept while they are needed for the notebook and lesson history features.

Exact retention periods are not set in this draft. The owner should add a schedule for each category, including account records, payment-review records, lesson content, logs and backups. Deletion from active systems may not immediately remove protected backups.

7. Your choices and rights

You can ask what personal information we hold about you, request a copy or export, ask us to correct inaccurate information, or ask us to delete your account and personal information. You can also ask us to limit a use or object where the applicable law gives you that right.

To request an export or deletion, contact the privacy placeholder above and include enough information for us to identify the account. We may need to verify the request. Deletion may be limited where information is needed for a pending booking, refund, security investigation or legal obligation; we will explain that limit.

If you believe your request was not handled correctly, the final policy should identify the relevant supervisory authority or complaint route after the owner completes the legal review.

8. Security

We use measures intended to protect accounts and service data, including server-side session handling, access controls and protected connections where the service supports them. No online service can promise absolute security. Use a unique password, keep it private and contact the owner if you notice suspicious activity.

9. Updates and contact

We will update this page when the service or its privacy practices change. This draft is version 2026-10-25 and is pending owner review; the controller, privacy contact, retention schedule and provider details must be completed before it is treated as final.