Privacy Policy

Matrix Studios Software (“Signpost,” “we,” “our,” or “us”) operates the Signpost platform at signpostasl.com and the demo application at demo.signpostasl.com. This Privacy Policy explains what data we collect, why we collect it, and how we keep it safe — written in straightforward language because you shouldn’t need a law degree to understand your rights.

Signpost is built by students, and a significant portion of our user base consists of students. We take your privacy seriously — especially if you are under 18 or part of an educational institution.

1. Information We Collect

1.1 Account Information

When you sign up for the waitlist or create an account, we collect your name, email address, and (optionally) your school or institution. We don’t ask for anything beyond what we need to run the service.

1.2 Hand Landmark Data

This is the one most people care about, so let’s be direct: your webcam feed never leaves your device. All hand-tracking processing runs locally in your browser through on-device computer vision models. The only data transmitted to our servers is numerical hand landmark coordinates — a series of X/Y/Z joint positions. No images. No video frames. No facial data. These coordinates help us improve sign recognition accuracy over time.

1.3 Usage Analytics

We collect anonymized usage data — page views, feature engagement, session length — through Vercel Analytics. This data does not include personal identifiers and is used exclusively for improving the product.

1.4 Device & Technical Data

Standard web metadata like browser type, operating system, screen resolution, and language preference. We use this to ensure compatibility across devices and to debug issues.

2. How We Use Your Data

• To deliver the service: Your account data powers login, progress tracking, and curriculum personalization.
• To improve sign recognition: Aggregated, de-identified hand landmark coordinates are used to train and refine our computer vision models.
• To communicate with you: Transactional emails (account verification, password resets) and, only with your explicit opt-in, product updates.
• To maintain security: Detecting and preventing fraud, abuse, or unauthorized access.

We do not sell, rent, or trade your personal data. We do not serve behavioral advertising. We have no interest in monetizing your information — our business is teaching you ASL, not profiling you.

3. Data Sharing & Third Parties

We share data with third-party services only when strictly necessary to operate:

• Vercel — hosting and deployment infrastructure (analytics, edge functions).
• Email provider — transactional email delivery (waitlist confirmations, etc.).

Each provider is bound by data processing agreements and is required to handle your data in compliance with applicable privacy laws. We do not share hand landmark data with any third party.

4. Data Retention

Account data is retained for as long as your account is active. If you delete your account, we will remove your personal data within 30 days, except where retention is required for legal or compliance requirements.

Aggregated, de-identified landmark data used for model training does not contain personal identifiers and may be retained indefinitely since it cannot be tied back to any individual.

5. Children & Student Privacy

Signpost is designed with students in mind. If you are under 13, you may only use Signpost with verifiable parental or guardian consent. We comply with the Children’s Online Privacy Protection Act (COPPA) and do not knowingly collect personal information from children under 13 without such consent.

For students aged 13–17, we limit data collection to what is necessary for the educational service. We do not serve targeted advertising to any user and do not build behavioral profiles of student users.

If you believe we have inadvertently collected data from a child under 13 without appropriate consent, please contact us at [email protected] and we will delete the data promptly.

6. Your Rights

Depending on your jurisdiction, you may have the right to:

• Access the personal data we hold about you.
• Request correction of inaccurate data.
• Request deletion of your data (“right to be forgotten”).
• Export your data in a portable format.
• Withdraw consent at any time (where processing is consent-based).
• Object to or restrict certain processing activities.

To exercise any of these rights, email us at [email protected]. We aim to respond within 15 business days.

7. Security Measures

We implement industry-standard safeguards including TLS encryption in transit, encrypted storage at rest, strict access controls, and security headers (CSP, HSTS, X-Frame-Options, and more). For a detailed breakdown, see our Security page.

8. Changes to This Policy

We may update this policy from time to time. If we make material changes, we will notify you by email or through a prominent notice on our platform at least 14 days before the changes take effect. Your continued use of Signpost after the effective date constitutes acceptance of the updated policy.

9. Contact Us

Questions about this policy? We’re real people — reach out any time.