Privacy Policy

Last updated: 1 October 2026

This policy explains what personal information Taming AI collects when you use tamingai.app, why we collect it, who helps us handle it, and what choices you have. We collect only what we need to run the lessons, your account and, if you subscribe, your subscription. We never see your Claude conversations, we do not use analytics or advertising trackers, and we do not sell your personal information.

Who we are

Taming AI is a trade name of Desert Shine Auto Spa, LLC, an Arizona limited liability company. In this policy, "we", "us" and "our" mean Desert Shine Auto Spa, LLC, which runs Taming AI. We run the website at https://tamingai.app. We decide how your personal information is used on this site.

Taming AI is independent. We are not affiliated with or endorsed by Anthropic. Claude is a trademark of Anthropic, PBC. When you use Claude itself, Anthropic's own terms and privacy policy apply to that use, not this policy.

You can contact us at hello@tamingai.app.

The short version

You can read the free lessons without an account.
If you have an account, we store your first name, email address, a one-way coded version of your password (a "hash"), your lesson progress, your settings, and what you can access.
If you subscribe, we also store a few details about your subscription. Our payment partner collects your card and billing details. We never receive full card numbers.
We never collect your Claude prompts, outputs, conversations or files.
We use no analytics, no advertising or tracking cookies, and no third-party scripts.
We do not sell your personal information or share it for advertising.
We use only cookies that are necessary, or that remember a choice you made.
You can ask us to delete your account and data at any time by email.

What we collect and why

What we collect depends on whether you only read free lessons or have an account. This section groups it by purpose.

Account

When you create an account, we store:

Your first name.
Your email address.
Your password, stored only as a hash. A hash is a one-way code made from your password. We use a method called scrypt. We can check that a password is right, but we cannot turn the hash back into your password or look it up.

We use this to create your account, sign you in, and match you to your invite.

Sign-in security

You can add extra protection to your account. This is optional. If you do, we store:

For a passkey: the public key, an ID for the passkey, the name you give it, and a few technical details your device reports (such as whether the passkey is backed up). None of this can unlock your device or reveal your fingerprint or face.
For an authenticator app: the secret used to check your codes, and your backup codes.

We use this only to protect your account.

To stop people from guessing passwords, we limit how many sign-in attempts can come from one IP address. We keep that count only briefly, in the server's temporary working memory. It is not saved in our database.

Sessions

When you sign in, we create a session record. It holds your IP address, your browser user agent (a short piece of text your browser sends that names its type and version), and an expiry time. Sessions last about 7 days.

We use sessions to keep you signed in and to help protect your account.

Lesson progress and settings

We store which lessons you have finished, as lesson IDs with the time you completed them. We do not store your answers to any quiz questions.

We also store your settings:

Whether you see a weekly or daily progress view.
Your pause date, if you pause your progress view.
Which Claude screen layout you chose to see.

We use this to save your place and show the lessons the way you picked.

Invites and access

Accounts are currently by invitation only. For each invite we store:

The email address it was sent to.
Who sent it.
Which levels it unlocks.
When it was sent, and when it was used, cancelled or expired.

We store only a hash of the invite link's token, not the token itself.

For each account we also keep an access record. It shows which levels the account can open, and whether the account belongs to someone who runs the site.

We use this so that only people with an invite or an active subscription can open the paid levels.

Subscriptions

If you subscribe, we store:

Your Stripe customer ID.
Your subscription status.
Whether your plan is monthly or yearly.
Your current period dates and any cancel date.

We use this to know whether to open every level for you, to show you your plan, and to let you manage it.

When you start checkout, we send Stripe your first name, your email address and an internal account ID, so Stripe can create your customer record and match your payment to your account.

Your billing name, billing address and card details are collected by Stripe and Link at checkout, not by us. See "Payments and Link" below.

Server logs

Our hosting provider keeps short-lived server logs. They include your IP address, the page you asked for, and your browser user agent. This applies to everyone who visits the site, including people who do not have an account.

We use these logs for security and to find and fix problems.

Emails you send us

If you email us, we keep your message and your email address so we can reply and keep a record of your request. This includes requests to delete your account or use your other rights. We keep these for as long as we need to deal with your request and to show we handled it.

What we never collect

Your Claude prompts, outputs, conversations or files. The lessons teach you about Claude, but you use Claude on Anthropic's own service. We cannot see what you do there.
Analytics. We do not use analytics tools. Our hosting provider's server logs record page requests (described above), and we use them only for security and for fixing problems.
Advertising or tracking cookies.
Anything from third-party scripts. We do not use any, and our fonts are hosted on our own site.
Your full card number, or your billing details. Stripe and Link handle those.

We do not send marketing emails. When we email you, it is because you asked us something or we are sending you a personal invite.

Cookies

We use only cookies that are necessary, or that remember a choice you made:

A sign-in session cookie, called "session_token", set by our sign-in system (Better Auth). It keeps you signed in.
Short-lived cookies used only while you finish a two-factor or passkey sign-in.
A "theme" cookie that remembers whether you chose light or dark mode. It lasts for one year.

We do not use advertising, analytics or tracking cookies. Because our cookies are necessary or only remember your own choice, and are not used for tracking, we do not show a cookie consent banner.

When you go to checkout or the billing portal, Stripe and Link may set their own cookies under their own policies.

Do Not Track: some browsers send a Do Not Track signal. We do not track you across other websites, so we handle all visitors the same way.

Who we share data with

A few companies help us run the site:

Vercel hosts the website. It is based in the United States.
Neon stores our database, which holds the account information described in this policy. The database is hosted on Amazon Web Services (AWS) in Oregon, United States.
Stripe and Link handle your payment if you subscribe.

Vercel and Neon handle your data only to host the site and database for us. Stripe and Link work differently. Link is the seller and merchant of record, and it uses your payment details under its own terms and privacy policy. See "Payments and Link" below.

We also use Namecheap to manage our website address (tamingai.app). It does not receive your personal data.

We do not sell your personal information. We do not share it for advertising. We may share information if the law requires us to.

Payments and Link

When you subscribe, you pay through Stripe using Stripe Managed Payments. The seller and merchant of record for your payment is Link (Sold through Link, LLC, a Stripe company).

This means Link, not Taming AI, is the company that sells you the subscription and handles your payment details. Link is responsible for the payment information it collects.

Link:

Collects your billing name, billing address and card details at checkout.
Calculates and collects any sales tax or VAT.
Sends your receipts and invoices.
Handles payment support and disputes.

Link's own terms and privacy policy also apply to your purchase. Please read them before you subscribe.

We send Stripe only your first name, email address and an internal account ID, and we receive back only the details listed under "Subscriptions" above. We never receive your full card number.

Where your data is stored

We store your data in the United States. Vercel and Neon host it there.

If you live outside the United States, your data is sent to and stored in the United States when you use the site. Privacy laws in the United States can differ from the laws where you live. We choose providers that offer legal safeguards for moving data across borders. You can ask us for details by emailing hello@tamingai.app.

How long we keep data

Account data: we keep your name, email, progress, settings, sign-in security details and access record for as long as your account exists.
Sessions: they last about 7 days and then expire.
Server logs: they are short-lived. Our hosting provider does not keep them longer than it needs to for security and fixing problems.
Invite records: we keep them until you ask us to delete your data. If you were invited but never signed up, you can email us and we will delete your invite record too.
Subscription records: we keep them while your account exists. Payment records are kept by Stripe and Link under their own policies.
Emails you send us: we keep them for as long as we need to deal with your request and to show we handled it.
Deletion requests: if you ask us to delete your account, we delete it and its data from our live systems within 30 days. We may keep records that the law requires us to keep.
Backups: our database backups expire within 30 days. After we delete your account, copies can stay in our backups for up to 30 more days, then they expire. So complete removal can take up to about 60 days from your request.

How we protect your data

We store your password only as a one-way hash. Passwords must be at least 12 characters.
You can add a passkey or an authenticator app with backup codes for extra protection.
We store only a hash of each invite token.
We limit sign-in attempts by IP address.
Sign-in sessions expire after about 7 days.
We never receive full card numbers. Stripe and Link handle them.
We collect as little as we can, and we do not collect your Claude conversations at all.

No website can promise perfect security. If a problem affects your information, we will tell you and the right authorities as the law requires.

Your rights and how to use them

You can ask us to:

Give you a copy of the personal information we hold about you (access).
Fix anything that is wrong (correction).
Delete your account and data (deletion).
Send you your data in a common format you can reuse (export).
Stop using your data in a way you object to (objection).
Pause our use of your data while we look into a concern about it (restriction).

To use any of these rights, email hello@tamingai.app. We may ask you to confirm who you are before we act. If you do not have an account, we may ask you to write from the address your invite was sent to, or the address you first contacted us from.

We will reply as soon as we can, and within the time your local law requires. If you ask us to delete your account, we delete it and its data within 30 days.

There is no delete button in the site yet. For now, email us and we will delete your account and its data. Cancelling a subscription does not delete your account. If you have a paid plan, please cancel it in Settings before you ask us to delete your account, so that it does not renew.

Other rights your local law gives you also apply.

Extra notes for people in the EU and UK

We need a legal reason to use your personal information. Ours are:

Contract: to create your account, save your progress and settings, open the levels you can access, and run your subscription.
Legitimate interests (our reasonable need to keep the site safe and working, balanced against your privacy): to keep the site secure and working, and to reply to the messages you send us. This covers sessions, server logs and limits on sign-in attempts. You can object to this use.
Legal obligation: to keep records that the law requires us to keep.

We do not use cookies that need your consent, so we do not ask for it.

Your data is sent to the United States. See "Where your data is stored" above.

You have the right to complain to a data protection authority. In the UK, that is the Information Commissioner's Office (ICO). In the EU, you can contact the authority in your country. We would welcome the chance to fix a problem first, but you do not have to contact us before you complain.

Extra notes for California

We do not sell your personal information. We do not share it for advertising. We have not sold or shared personal information in the past 12 months.

In the past 12 months, we collected these kinds of information:

Identifiers: your name, email address and IP address, and your Stripe customer ID if you subscribe.
Account log-in details: your email address and password hash, and passkey or authenticator details if you add them. We use these only to run and protect your account.
Commercial information: your subscription status and plan, if you subscribe.
Internet activity: sessions and server logs.

If you live in California, you can ask us what personal information we hold about you, ask us to correct it, and ask us to delete it. Email hello@tamingai.app. We will answer within the time California law requires. We will not treat you differently for using these rights.

You can ask someone to make a request for you. We may ask for proof that they act for you.

Children

Taming AI is meant for adults 18 and over. We do not knowingly collect personal information from anyone under 18. If you think a child has given us information, email us and we will delete it.

Changes to this policy

We may update this policy from time to time. We will change the "Last updated" date at the top whenever we do. If we make a big change, we will post a notice on the site.

Contact us

Taming AI, a trade name of Desert Shine Auto Spa, LLC.

Email: hello@tamingai.app

Website: https://tamingai.app