Legal · Privacy
Privacy Policy
Short version: signing up gets you an email/password (or a Google sign-in), a session cookie, and progress that follows you across devices. There is no analytics, no advertising, no third-party trackers, and nothing here is ever sold or shared. Everything below describes exactly what's stored and why — not a marketing summary of it.
This page covers the platform's own account system (sign-in, sessions, progress sync) — the thing at account/ and the academy-api service behind it. It does not replace any individual course's own privacy notes about client-side-only tools (localStorage-based flashcards, self-check quizzes, and so on all stay on your device regardless of whether you're signed in). A couple of courses also link out to live third-party feeds — those pages say so themselves, on their own terms/privacy pages.
Account data
Creating an account with email and password stores your email address, an optional display name, and your password — never the password itself, only an Argon2id hash of it, a one-way function designed so the original password can't practically be recovered from what's stored.
Signing in with Google instead stores your email address, the name Google reports for your account, and Google's internal account identifier for you (so a returning Google sign-in is recognized as the same account) — nothing else. Google's ID token carries more than that (a profile picture, locale, and so on); none of it is requested or kept. You can hold both a password and a Google sign-in on the same account at once.
Sessions & cookies
Signing in sets one cookie — academy_session — an opaque, random token; only its hash is stored server-side, so a database leak alone can't be replayed as a live session. It's marked HttpOnly (invisible to page JavaScript), Secure (HTTPS only), and SameSite=Lax. It lasts up to 30 days from your last visit, capped at 90 days overall even if you visit every day — after that you'll need to sign in again. Signing in with Google briefly sets two more short-lived (10-minute) cookies during the redirect to and from Google, purely to prevent a forged sign-in attempt — both are cleared the moment you land back.
Each session record also stores your browser's user-agent string (so a "sign out everywhere" style feature can eventually show you what's signed in). It does not store your IP address.
Your course progress
Once signed in, the checkboxes, quiz scores, flashcard states, and lab/checklist progress you'd otherwise only have in your browser's local storage are also synced to the server, keyed to your account — that's the entire point of having an account here: open the same course on a different device and pick up where you left off. If you're signed out, all of that still works, it just stays local to that one browser (see each course's own privacy page for exactly what tool stores what, under which localStorage prefix).
Activity & security logs
A minimal log records account-security events — sign-up, sign-in, a failed sign-in attempt (with a reason, e.g. wrong password — never the password itself), a password change, and an account deletion — tied to your account and a timestamp. This exists so account abuse (repeated failed logins, for instance) is visible and investigable; it isn't used for anything else, and nothing in it is shared outside the platform's own operation. The one exception to "tied to your account": once you delete your account, its log entries (that one included) stop pointing at any account at all — see "Your choices" below for what deletion actually does.
What we don't do
No analytics package, no advertising network, no third-party tracking script of any kind runs on any page — account pages included. Nothing collected here is sold, rented, or shared with a third party, except the one unavoidable case: if you choose Sign in with Google, Google necessarily sees that you're signing in (that's how the button works) — no other data crosses to Google beyond the standard OAuth exchange, and nothing crosses in the other direction beyond the email/name/ID described above.
Your choices
You can change your display name and password any time from your account page. That same page has a Danger zone with two self-service buttons, no email or waiting required:
Download my data gets you a JSON copy of everything described above that's actually yours — your profile, your course progress, and your starred courses — as an immediate download.
Delete my account permanently deletes your account and, with it, your progress and starred courses, right away. It asks you to re-enter your current password first (or, if you signed in with Google and never set one, to type a confirmation instead) so a stolen or left-open session can't destroy the account on its own. The one thing deletion doesn't erase outright is the security log described above — those entries survive, but anonymized: immediately stripped of any link back to you or your account, the moment the account is gone.
This platform isn't directed at children, and account sign-up isn't intended for anyone under 13. It doesn't knowingly collect account data from a child under that age.
Changes to this policy
If what's collected or why ever changes, this page is updated first, not after the fact — as it was the day self-service export and deletion shipped, above.
Contact
Deletion and data export are self-service from your account page (see "Your choices" above) — no request needed. For anything else about this policy, contact the site owner. See the Terms of Service for the rest of the legal detail.