Effective 6 Oct 2026. This policy covers stemlores.com and its subdomains (math., physics., chemistry.stemlores.com) and the Rubik’s Cube Coach at rubik.stemlores.com. It describes what actually happens in our code and services, in plain language. Our YouTube channels and social pages are run on those platforms and follow their own policies.
Who we are. STEM Lores (Math Lore, Physics Lore, Chemistry Lore). Contact: hello@stemlores.com. STEM Lores is run by Nguyen, an individual based in Singapore, who is responsible for the personal data described here. Please send any privacy request to that address.
The short version
- No ads, no advertising or tracking cookies, no analytics scripts, no accounts on the website.
- The Cube Coach works without an account; a guest’s progress stays in their own browser.
- An optional Cube Coach account is for adults (a parent or teacher): we store the adult’s email address and one learner’s nickname and progress. Nothing else — no password, no birth date, no real name required.
- We never sell data and never use it for advertising.
The website (stemlores.com)
Server logs and statistics. The site runs on Cloudflare. Like every web server, Cloudflare processes each request — your IP address, the page asked for, the time, your browser’s user-agent and the referring page — to deliver it and to protect the site from abuse. We see Cloudflare’s aggregate traffic statistics (for example, how many times a story page was viewed per day); we do not build profiles of visitors. The site’s Worker also has Cloudflare’s request logging turned on for troubleshooting; Cloudflare keeps those logs for a few days.
Cookies. The website itself sets no cookies and uses no analytics or advertising scripts. Fonts, styles and images of the site are served from our own domain.
YouTube videos. Videos are played with YouTube’s privacy-enhanced mode (youtube-nocookie.com). YouTube loads only when you press play: until then every page, story pages included, shows just the video’s thumbnail, which loads from YouTube’s image server (i.ytimg.com). When the player or a thumbnail loads, Google/YouTube receives your IP address and browser details, and once you play a video YouTube may store data on your device, under Google’s privacy policy.
Links out. Share buttons and social links are plain links: nothing is sent to Facebook, X, LinkedIn, Reddit, Instagram, Threads or TikTok unless you click one.
The Rubik’s Cube Coach (rubik.stemlores.com)
As a guest (the default) the learner’s nickname, lessons, practice and timer history, settings and language are saved only in that browser (IndexedDB and local storage), and an offline cache keeps the app working. None of it is sent to us (requests for the app’s files are handled by Cloudflare as described above). Clearing the browser’s site data deletes it; the coach’s Profile page can export a backup.
The optional account syncs one learner’s progress across devices. It is meant for an adult — a parent, guardian or teacher — who signs in with their own email address and a one-time code (no password). When an account is used we store, in a Cloudflare D1 database (located in the Asia-Pacific region):
- the adult’s email address, an account ID and the date the account was created;
- the learner’s nickname and progress: lessons, practice results, badges, solve times and scrambles, minutes practised per day, and coach settings;
- sign-in sessions: a hashed session token with its sign-in and expiry times. The session is kept in one strictly
necessary cookie (
__Host-rubik-session), set only when you sign in and used only to keep you signed in for up to 90 days; - sign-in codes: the email address the code was sent to and a hashed copy of the code, valid for 10 minutes;
- to stop abuse, a keyed hash of the email address and of the IP address for each code request, with its date. These cannot be read back as an address.
Sign-in emails are sent by Resend, which receives the email address and the message containing the code, and keeps delivery records under its own policy. We send no marketing email and no newsletters.
Use a nickname, not a real name. The coach does not ask for a learner’s real name, age, birth date, school, photo or location, and there is no public profile, chat or messaging.
Children
The Cube Coach is made for children, and children can use all of it as guests, without giving us any personal information. Accounts are for adults only: before a code is sent, the person signing up must confirm that they are an adult and own the email address. We do not verify ages, so this relies on that confirmation. We do not knowingly collect personal information from a child under 13 (or the age of digital consent where you live, up to 16 in parts of the EU). If you believe a child has created an account, email hello@stemlores.com and we will delete it.
How long we keep data
- Account email and the learner’s progress: until the account is deleted. “Start over” on the Profile page erases the stored progress for good.
- Sign-in sessions: each stops working after 90 days; the record is removed when you sign out or delete the account, and expired records are deleted within a day after they expire.
- Sign-in codes: expire after 10 minutes; they are deleted, with the email address they were sent to, within a day after they expire (sooner if another code is requested or the account is deleted).
- Abuse-prevention hashes: cleared after about two days.
- Cloudflare request logs: a few days. Cloudflare also keeps short-term database recovery copies, so deleted account data can remain in those for a limited period before it expires.
- Emails you send us: as long as needed to answer and to keep a record of corrections.
Deleting your data and your rights
An account holder can delete the account at any time from the coach’s Profile page (it asks for a fresh sign-in code first). That removes the email address, sessions and all synced progress from our database. Backups you exported and progress saved in your own browser stay on your device until you remove them.
You can also email hello@stemlores.com from the account’s address to ask what we hold, to correct it, to get a copy, or to delete it. We answer within 30 days. We follow Singapore’s Personal Data Protection Act (PDPA). Depending on where you live (for example under the GDPR in the EU/UK or COPPA in the US), you may have further rights, including complaining to your data-protection authority (in Singapore, the Personal Data Protection Commission).
Who else handles data
- Cloudflare — hosting of the website and the coach, the account database, request logs and traffic statistics, and forwarding of mail sent to hello@stemlores.com. Cloudflare privacy policy.
- Resend — sending Cube Coach sign-in codes.
- Google / YouTube — the video player and thumbnails; messages to hello@stemlores.com are delivered to a Gmail inbox.
These services may process data outside your country, including in the United States. We do not sell or rent personal data, and we share it with no one else unless the law requires it.
Changes
If we change what we collect, we update this page and its effective date first. Questions: hello@stemlores.com or the contact page.
