Privacy Policy

1. Who this is about

Day Dreamer English is the service described here. The controller’s legal name, address and privacy contact are intentionally left as placeholders until the owner completes this draft.

2. Information we handle

Depending on how you use the service, this can include:

• account details such as your name, e-mail address, password hash and account role;
• optional contact details such as country, phone number and address;
• teacher profile details such as biography, courses, language levels, availability, price, profile photo, introduction video link and lesson notes;
• booking details such as teacher, student, course, date, time, price, status, cancellation, payment review, refund destination and transfer references;
• lesson package details such as the teacher, the number of lessons, the price, the period of use, the transfer reference, the lessons used and returned, and refunds;
• lesson content you or a teacher submit, including published notes, vocabulary, homework, classroom messages and whiteboard strokes;
• classroom attendance: the times each person joins and leaves a lesson, used to decide a no-show and the refund that follows;
• classroom guests: the name a guest types when joining through a teacher’s guest link, and when they joined;
• teacher reviews: the rating and text a student writes after a completed lesson, shown publicly on the teacher’s profile with the student’s first name;
• support conversations and tickets, including the messages you send; if you use the support chat without an account, the name and e-mail address you give us;
• level test results, when you take the test signed in to a student account (see section 4);
• security and technical details such as your session cookie, browser user agent, IP address in server logs, request records and error logs.

We do not need your GCash login or card number for the simulated transfer workflow. Do not submit those credentials.

3. Why we use it

We use information to:

• create and protect accounts, sign you in and confirm account links;
• show teacher profiles, availability and reviews, and coordinate requests, proposals and lessons;
• record the simulated transfer report, let an administrator review it, and manage refunds and refund destinations;
• provide the browser classroom, guest links, lesson notes, chat and whiteboard features;
• decide no-shows and refunds from classroom attendance;
• answer support conversations and tickets;
• send essential account or booking messages when those features are enabled;
• prevent misuse, investigate incidents, maintain the service and meet legal obligations;
• respond to requests about your account and privacy.

The classroom does not record audio or video. The site does not use analytics cookies or advertising cookies. It does not sell your personal information or use lesson content for advertising.

4. Level test results

New in version 2026-11-10.

The level test runs in your browser. Your answers to the questions are not sent to us or stored anywhere. If you take the test without an account, nothing about it is kept: not the answers, not the result, and nothing in cookies or in your browser’s storage.

If you take the test while signed in to a student account, or choose to save a result to your account afterwards, we store the result: the level you reached (A1 to C2), the number of questions you answered and the date. Each attempt you save is kept as its own entry, and the most recent one counts as your current level. The page tells you this before you start.

We use a saved result to show you your level, to suggest teachers and courses for it, and to let a teacher prepare your lesson. It is your own estimate, not an assessment by Day Dreamer English, and it is always shown with that label and its date.

Your current saved level can be seen by:

• you;
• a teacher you have a booking with, whatever the state of that booking;
• administrators who operate Day Dreamer English.

It is never shown on a public page, to other students, or to a teacher you have no booking with.

A saved result is kept until you remove it or delete your account. You can remove all your saved results at any time in Account; they then disappear for your teachers and for administrators too. Saved results are included in the copy of your data you can download, and deleting your account deletes them.

5. Cookies and browser storage

The site sets two essential cookies and no others:

• ddl_session keeps you signed in. It is HttpOnly and SameSite=Lax, so browser scripts cannot read it and cross-site requests receive the browser’s normal protection.
• ddl_support_guest is set only if you use the support chat without an account. It keeps your conversation for up to 30 days, with the same HttpOnly and SameSite=Lax protection.

The site also keeps a few things in your browser’s own storage, which stays on your device and is not sent to us: a classroom guest’s session, which ends when the tab closes; your classroom preferences (camera, microphone and background blur choices, whether you join muted, one-key shortcuts, the stage layout and the picture-in-picture view); and which whiteboard strokes are yours, so you can undo them during the lesson.

None of these are used for analytics or advertising.

6. Content from other services

A teacher can add an introduction video to their profile. It plays in a player from YouTube (on its privacy-enhanced domain, youtube-nocookie.com) or from Vimeo, which loads when the profile is open and the video comes close to the screen. When it loads, that service receives your IP address and browser details, and its own privacy policy applies.

7. Service providers

These providers process information only as needed to provide their service to Day Dreamer English:

• Vercel hosts the website;
• Fly.io hosts the application server and the classroom service;
• Supabase hosts the database and teacher profile photos;
• Upstash runs the job queue for reminders and deadlines;
• LiveKit carries the classroom audio and video;
• Resend sends transactional e-mail;
• Sentry receives error reports from the server, set up to leave out account details, cookies, request bodies and query parameters;
• YouTube and Vimeo play teacher introduction videos (see section 6).

The owner should add each provider’s location and contractual details before publication.

Administrators who operate Day Dreamer English can access booking, payment-review, refund, account, support and audit information needed for their work. Teachers and students can see only the lesson and account information made available to them by the product.

8. Retention

We keep account and booking information while it is needed to provide the service, resolve bookings and refunds, protect security, and meet legal or accounting obligations. Lesson notes and classroom content are kept while they are needed for the notebook and lesson history features.

Exact retention periods are not set in this draft. The owner should add a schedule for each category, including account records, payment-review records, lesson content, support conversations, logs and backups. Deletion from active systems may not immediately remove protected backups.

9. Your choices and rights

You can download a copy of your personal data, or delete your account, yourself in Account. Deleting is permanent and asks for your password. It waits while you have a paid request, a confirmed lesson, a transfer under review, a refund we have not sent yet, or a lesson package that is under review or still has lessons to use. Once your account is deleted, your personal details are removed, and the booking, package and payment records needed for accounting stay without them.

You can also ask what personal information we hold about you, ask us to correct inaccurate information, or ask us to limit a use or object where the applicable law gives you that right. Contact the privacy placeholder above and include enough information for us to identify the account; we may need to verify the request.

If you believe your request was not handled correctly, the final policy should identify the relevant supervisory authority or complaint route after the owner completes the legal review.

10. Security

We use measures intended to protect accounts and service data, including server-side session handling, access controls and protected connections where the service supports them. No online service can promise absolute security. Use a unique password, keep it private and contact the owner if you notice suspicious activity.

11. Updates and contact

We will update this page when the service or its privacy practices change. Each change gets a new version, and earlier versions stay published. When a change needs your agreement, we ask you to accept the new version before you keep using your account.

This draft is version 2026-11-10 and is pending owner review; the controller, privacy contact, retention schedule and provider details must be completed before it is treated as final. The previous version, 2026-11-09, stays published at /privacy/2026-11-09.