Legal

Privacy Policy

Effective September 18, 2026

This policy explains how Jason R Media LLC (“we,” “us”) handles personal information when you use Course in a Box and AuthBox. It applies to courseinabox.app, auth.courseinabox.app, worker.courseinabox.app, the Course in a Box dashboard, and the hosted portions of the Service. The sections below describe the categories of personal information we have collected during the preceding 12 months.

The short version: we collect the information needed to sell, secure, support, and operate the product. We do not run behavioral analytics, advertising pixels, or session recording. We do not sell personal information or share it for cross-context behavioral advertising.

1. Our two privacy roles

Course in a Box is used by course creators (“course owners”) to run their own sites. Our legal role depends on whose information is involved:

• We are a controller for Course in a Box account data. We decide how to use information needed for your trial, purchase, subscription, dashboard access, security, support, and our own business records.
• We are a processor for hosted course data. When a course owner uses subscription AuthBox or the Autopilot Worker, we process member and course data on that owner's instructions. The course owner controls that data and is responsible for its lawful collection and use.

2. Information about course owners and visitors

Account, trial, and billing information

• Your email address, optional name, and a one-way hash of your email used to scope your account and projects.
• Your Course in a Box license, trial, subscription, renewal, cancellation, refund, and dispute status, together with Stripe customer, payment, and subscription identifiers.
• The brand and last four digits of a saved card so the dashboard can identify the card on file. Stripe, not us, receives and stores the full card details.
• Dashboard preferences, setup-path choices, session and workspace identifiers, and security information such as request IP address, rate-limit counters, and provider-event identifiers used to prevent abuse and duplicate processing.

Site and service configuration

• Course and project names, your published site domain or origin, public and gated paths, notification addresses, session and Discord invite links, content limits, and related setup choices.
• Stripe or Lemon Squeezy credentials, webhook secrets, store, product, price, order, subscription, and customer identifiers that you provide or authorize us to retrieve for member verification. These credentials are kept server-side and are not returned to site visitors.
• If you enable Discord Linked Roles, your Discord application and client identifiers, encrypted Discord Client Secret and Bot Token, setup status, and timestamps.

Support, concierge inquiries, and concierge access

• Support messages may include your email, subject, message, and up to three screenshots. We deliver them to our support inbox and retain a service-side copy so a delivery problem does not lose a paid support request.
• A concierge-build inquiry includes the name, email, course name, payment-provider choice, course description, and reference URL you submit. It is emailed to us and is not added to the Course in a Box database.
• If you explicitly grant the Course in a Box concierge editor access, we retain the hashed owner and editor identities and grant, revocation, and update timestamps. While the grant is active, that editor can view and modify the ordinary course workspace data available through the dashboard. Owner-only billing and account-level deletion controls remain restricted. Revocation is checked on each dashboard request.

3. Information we process for course owners

The data that reaches us depends on the owner's configuration. A Manual Worker moves course content, files, forms, and video handling to the owner's Cloudflare account. It does not move member authentication if the owner keeps subscription AuthBox. Only the combination of a Manual Worker and AuthBox Portable moves both systems to the owner's own infrastructure.

Subscription AuthBox

For a course using subscription AuthBox, we process:

• Member email address and, if available, name;
• Membership and entitlement status, period end, sign-in and update timestamps, and the applicable product, price, order, subscription, and payment-provider customer identifiers;
• One-time-code records and member session tokens needed to authenticate and gate the course; and
• The course domain and project identifier needed to keep members and tenants separated.

Discord Linked Roles

If the owner enables Linked Roles, a member chooses whether to connect Discord. We then process the member's course email, Discord user ID, the connected account's Discord display name, encrypted Discord OAuth access and refresh tokens, token expiration, connection and sync timestamps, membership end date, active status, whether and when the member finished claiming the role in Discord, and sync diagnostics. We store that display name so the member's own account page can show which Discord account holds their connection. We ask Discord for the connected account's basic identity and send membership-status metadata to the owner's Discord application so Discord can grant or revoke the role. The connection is scoped to one course project.

Autopilot Worker

For a course using Autopilot, we additionally process:

• Course videos and their titles, slugs, type, upload status, and Cloudflare Stream identifiers;
• Downloads and PDFs uploaded by the owner;
• Member uploads, form fields, attachments, email address, name, submission type, and timestamp;
• Lesson comments a member posts, including the comment text, the member's email address and the display name shown beside it, the lesson it belongs to, any reply relationship, and posting, edit, and deletion timestamps. A comment and its display name are visible to other members of the same course, and to the owner, who can delete it;
• Each member's own progress through the course, including which lessons are marked done or favorited and the most recent playback position, so the course can show a member where they left off;
• Per-member or per-project playback, upload, form, and rate-limit usage needed to operate and enforce the configured limits; and
• Landing-page signup data, including subscriber email and optional first name, captured in the owner's dashboard. If the owner has connected their own Resend account, each signup is also added to their Resend audience and sent their welcome email, which we send on their behalf using their key; until they connect one, the signup is only recorded here.

Hosted data is scoped by project. We use it to provide the course owner's authentication, access control, Discord sync, content delivery, communications, and dashboard tools. We do not use one course's member data to benefit another course or for our own marketing.

4. Sources, purposes, and legal bases

We receive information directly from you, from course members, from the browser or device making a request, and from services you connect, including Stripe, Lemon Squeezy, Discord, Cloudflare, and Resend.

• Contract: to create accounts, take payment, provide hosted services, authenticate users, deliver content, process plan changes, and provide support.
• Legitimate interests: to secure the Service, prevent abuse and duplicate webhook processing, troubleshoot failures, preserve support requests, enforce limits, and maintain reliable business records.
• Consent or owner direction: for optional actions such as connecting a member's Discord account, granting concierge-editor access, or submitting a concierge inquiry.
• Legal obligations: to keep records, respond to lawful requests, enforce our agreements, and protect legal rights.

For member data that we process as a processor, the course owner determines the applicable legal basis and gives us instructions through these terms, their configuration, and their use of the hosted Service.

5. What we deliberately do not collect or do

• No full card details. Stripe handles card entry and storage.
• No readable sign-in codes. One-time codes are stored as one-way cryptographic hashes incorporating server-side secret and request context, and they expire within minutes.
• No advertising or behavioral profiling. We do not use advertising networks, analytics pixels, session recording, or cross-site behavioral profiles.
• No sale or advertising share. We do not sell personal information or share it for cross-context behavioral advertising, and we do not use sensitive personal information to infer characteristics.

6. Cookies, browser storage, and Do Not Track

The dashboard uses first-party, strictly necessary cookies. cm_session keeps the signed-in person authenticated, and cm_workspace records which owner workspace that person is authorized to use. They are HttpOnly, SameSite cookies and normally expire within 30 days. We may clear older compatibility cookies during logout.

The dashboard also uses local storage for non-sensitive display and setup preferences. On course-owner sites, AuthBox and the Framer components use local or session storage for the member session token, active project, AuthBox and Worker locations, and an in-progress sign-in flow. This storage is used to make authentication and components work, not for advertising.

Stripe.js, embedded Cloudflare Stream video, an embedded Framer preview, Google Fonts, YouTube profile and video images, and static assets loaded from the UNPKG CDN may receive ordinary request information and may use storage under their own policies. We do not authorize them to track people across sites for us, but each provider may independently collect information as described in its policy. Visiting Stripe checkout, a Stripe billing portal, Discord authorization, or another third-party page is also subject to that provider's practices.

Because we do not track people across unaffiliated sites for advertising, browser Do Not Track and Global Privacy Control signals do not change our behavior. We honor applicable opt-out signals if our practices change in a way that makes them relevant.

7. Providers and disclosures

We disclose information to vendors only as needed to operate the Service, to professional advisers under appropriate duties, in a business transfer, to protect rights and safety, or when law requires it. Current operational providers include:

8. Retention

• Account and billing records are kept while your account exists and afterward as reasonably needed for payment, tax, dispute, fraud-prevention, and legal records.
• Subscription AuthBox projects, members, entitlements, and configuration are retained while the project or account remains open. A subscription lapse pauses hosted authentication but does not by itself delete these records. Deletion may occur at the owner's request, when the account is closed, or when reasonably required for security, legal, or operational reasons.
• Autopilot-hosted content, including Stream videos, downloads, PDFs, member uploads, and form submissions, is retained for 90 days after Autopilot becomes inactive. It may be permanently deleted after that window. Course owners should export anything they need before the deadline.
• Lesson comments and member progress are retained while the course project remains open. A comment deleted by its author or by the owner is removed from the course; progress records are removed with the member, lesson, or project they belong to.
• Discord records and encrypted tokens are retained while the connection and related project remain in use, or until the link, member, project, or account is deleted. Limited sync diagnostics may remain with the operational record.
• One-time codes and rate limits expire automatically after their short authentication or abuse-prevention window.
• Support requests and screenshots are kept as needed to resolve and reference the issue. Concierge inquiries remain in our business inbox as needed to respond and maintain ordinary business records. Grant and revocation records are retained with the related account.

Deletion from active systems may not immediately remove information from security backups or a provider's legally required records. Those copies are isolated from ordinary use and age out under the applicable backup or legal-retention cycle.

9. Security

We use HTTPS/TLS, signed sessions, one-way hashes for one-time codes, webhook signature verification, tenant and project scoping, owner-only billing controls, rate limits, and fail-closed access checks. Discord client, bot, and member OAuth secrets are encrypted at rest. Other provider credentials are kept server-side and are not exposed to course visitors. No system can be guaranteed perfectly secure, and course owners remain responsible for the security of their own Framer, Cloudflare, payment-provider, Resend, and Discord accounts.

10. International processing

Jason R Media LLC is based in the United States. We and the providers listed above may process information in the United States and other countries, including on Cloudflare's global network. Where applicable law requires a transfer mechanism or additional data-processing terms, a course owner should contact us before placing covered member data in the hosted Service.

11. Your rights and choices

Depending on your location, you may have rights to access, correct, delete, or receive a copy of personal information, and to object to or restrict certain processing. You may also have the right to withdraw consent, use an authorized agent, appeal a refusal, or complain to a regulator. We do not discriminate against people for exercising applicable privacy rights.

• Email jasonr.audio@gmail.com from the address connected to your account and describe the request.
• We may verify your identity and authority before acting. We normally respond within 30 days and will explain any legally permitted extension or denial.
• If the request concerns a course member, the course owner is the primary contact. We will assist the owner with requests involving data we process for them.
• Deletion is subject to legal-retention duties, security needs, provider and backup cycles, and information needed to complete a transaction or resolve a dispute.

12. Children

Course in a Box accounts are for adults and are not directed to children under 13. Course owners must not use the hosted Service to knowingly collect personal information from a child under 13, or a higher age where local law requires parental consent, unless they have provided all required notices, obtained verifiable permission, and otherwise complied with applicable law. Contact us promptly if you believe covered child data was submitted improperly.

13. Changes to this policy

We may update this policy as the Service changes. We will change the effective date above and provide email, dashboard, or page notice when a change is material.

14. Contact

Jason R Media LLC
Email: jasonr.audio@gmail.com