Privacy Policy
Last updated: August 2026
LHS Reference: Framework Library is operated by LHS Legacy LLC ("we", "us", "our"). We are committed to protecting your privacy and complying with the EU General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA), the Children's Online Privacy Protection Act (COPPA), and other applicable global data protection laws. This policy describes what data we collect, how we use it, your rights, and how to exercise them. By using the platform you agree to the practices described here. See also our Terms of Service and Refund Policy.
Data We Collect
We collect the following categories of personal data: • Account data: your name, email address, and optional profile information. • Age data: your date of birth (optional), used solely for parental control and age-appropriate content filtering. • Research data: topics viewed, articles read, saved collections, notebooks, bookmarks, notes, and search queries. • Submission data: when you submit a Rare Book or manuscript, we store your author/pen name, email, the uploaded file, and an optional cover image. • Purchase data: transaction records including product purchased, amount, date, and payment method (processed by Stripe — we never see or store your full card number). • Affiliate data: if you join our affiliate program, we store your name, email, payout email, referral code, and performance metrics (clicks, conversions, earnings). • Usage data: IP address, browser type, device information, and interaction logs collected automatically for security and service improvement. We do not collect data from children under 13 without verifiable parental consent. See "Children's Privacy" below.
Legal Basis for Processing (GDPR)
Under the EU General Data Protection Regulation (GDPR), we process your personal data on the following legal bases: • Performance of a contract (Art. 6(1)(b)): processing necessary to provide the services you requested, including account creation, content delivery, and purchase fulfillment. • Consent (Art. 6(1)(a)): processing of non-essential cookies, affiliate tracking, and optional marketing communications. You may withdraw consent at any time. • Legitimate interests (Art. 6(1)(f)): security monitoring, fraud prevention, service improvement, and analytics using anonymized or pseudonymized data. • Legal obligation (Art. 6(1)(c)): retaining transaction records and tax documentation as required by law. You have the right to object to processing based on legitimate interests. Contact us to exercise this right.
How We Use Your Data
Your data powers personalized research recommendations, research tracking across sessions, AI-assisted analysis through the LHS Lens, and the assembly of your private notebooks and saved collections. Purchase data is used to deliver digital goods and process payments. Affiliate data is used to track referrals and process commission payouts. Aggregated, anonymized data may be used to improve the library and surface popular topics. We never use your data to train external AI models or sell your personal data to third parties.
Cross-App Affiliate Tracking
Our affiliate program operates across two apps: LHS Lab (lhs-lab.com) and You're Not Crazy Deprogram. When you visit via a referral link (?ref=CODE), we store the referral code in your browser's local storage and record an anonymous click event. If you make a purchase, the referral code is passed to our payment processor (Stripe) as metadata so the referring affiliate can be credited. The referral code is stored for up to 30 days. You can clear this at any time by clearing your browser data or selecting "Essential only" in our cookie consent banner.
Children's Privacy (COPPA)
Our services are not directed to children under 13. We do not knowingly collect personal information from children under 13 without verifiable parental consent. If we learn we have collected personal information from a child under 13 without parental consent, we will delete it promptly. Parents who believe their child has provided personal information can contact us at support@lhslegacy.com to request deletion. For users aged 13-17, we provide parental control features that allow a parent or guardian to restrict access to adult-themed content. The platform asks for age confirmation on first visit. Users under 13 without parental consent will have parental controls automatically enabled, restricting access to mature content.
Third-Party Services
We use the following third-party services, each operating under their own privacy policies: • Stripe — payment processing (PCI-DSS compliant; we never store full card numbers). • Resend — transactional and support email delivery. • Base44 — hosting, authentication, and data storage infrastructure. • Google (optional connectors) — Calendar, Drive, Sheets, and Classroom integrations for authenticated users who explicitly connect them. • Lulu.com — print-on-demand book fulfillment. Each provider processes data under their own privacy and security policies. We share only the minimum data necessary to provide the service. We never sell your personal data to any third party.
International Data Transfers
Your data may be processed in countries other than your own, including the United States. When we transfer personal data outside the EU/EEA, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission, or other lawful transfer mechanisms under GDPR Chapter V. By using our services, you acknowledge that your data may be transferred and processed in the United States and other jurisdictions with different data protection laws. We take appropriate measures to ensure your data receives an equivalent level of protection regardless of where it is processed.
Cookie & Local Storage Usage
We use the following categories of storage: • Essential: authentication tokens, session identifiers, and security state — always active, required for the service to function. • Functional: dark mode preference, language, and UI settings — stored in local storage, no tracking. • Affiliate tracking: referral codes stored in local storage for up to 30 days to attribute purchases to affiliates — disabled if you select "Essential only" in our consent banner. • Analytics: anonymized, aggregated page view and funnel events to understand content popularity — no cross-site tracking, no advertising cookies. We do not use third-party advertising cookies, fingerprinting, or cross-site tracking pixels. You can manage your consent at any time; the banner reappears if you clear your browser data.
Your Rights (GDPR & CCPA)
Residents of the EU, UK, California, and other jurisdictions with data protection laws have the following rights: • Access: request a copy of your personal data. • Rectification: correct inaccurate or incomplete data. • Erasure ("right to be forgotten"): request deletion of your personal data. • Data portability: receive your data in a structured, machine-readable format. • Restriction: limit how we process your data. • Objection: object to processing based on legitimate interests. • Withdrawal of consent: withdraw consent for non-essential processing at any time. • Opt-out of sale: we do not sell personal data. California residents can still exercise this right by contacting us. To exercise any right, contact us at support@lhslegacy.com. We respond within 30 days. You also have the right to lodge a complaint with your local data protection authority.
Data Retention
Account data is retained while your account is active and deleted within 30 days of account deletion. Purchase and transaction records are retained for 7 years for tax and accounting compliance. Rare Book submissions are retained per the contributor agreement. Affiliate data is retained while your affiliate account is active and for 3 years after deactivation for audit purposes. You can delete your account at any time via Settings → Delete Account.
Academic Data Use
Saved collections, notes, and reading history remain private to you. The public knowledge base (Topics, Sources, KnowledgeEntries) is openly viewable. Your private research contributions are never published without your explicit consent. Peer review submissions are attributed to you only if you choose to publish your name; anonymous submissions are supported.
Security
We use industry-standard security measures including TLS encryption in transit, encrypted storage at rest, and access controls limited to authorized personnel. Payment data is handled exclusively by Stripe (PCI-DSS Level 1 certified). While we strive to protect your data, no system is 100% secure. In the event of a data breach affecting your rights, we will notify you and the relevant authorities within 72 hours as required by GDPR Article 34.
Changes to This Policy
We may update this Privacy Policy as our services evolve and as laws change. Material changes will be communicated through the app or by email at least 30 days before taking effect. The last-updated date below reflects the current version. Continued use after changes take effect constitutes acceptance.
Questions about this policy? Contact support@lhslegacy.com. For EU data protection inquiries, you may also contact your local Data Protection Authority.