Privacy
The short version: we keep what you type into the grid, because marking it is the product, and we keep your account so your progress survives a new laptop. We do not sell anything to anybody and there is no advertising on this site.
The first two lessons need no account, and nothing that identifies you is stored while you are doing them.
What is collected
| What | When | Why | Kept |
|---|---|---|---|
| Name, username and email | When you make an account | To sign you in and to put a name on a certificate. | Until you delete the account. |
| Every answer you submit | Each time you press Enter on a step | To mark it, to score it, and to find steps where everyone types the same wrong thing. | Until you delete the account. |
| Lesson progress and points | As you work through a lesson | So a lesson resumes where you left it, on any device. | Until you delete the account. |
| Counts, with no name attached | Every attempt, signed in or not | How many people reached step 3, which wrong answers are common. Totals only. | Indefinitely. Nothing in them points to a person. |
| Product analytics | Only if you allow it in the cookie banner | To see where people stop, so we can fix the lesson they stopped on. | Until you clear it, or you decline and it is never collected. |
| Error reports | When something breaks in your browser | To find the break. The report holds the page and the error, not your answers. | 90 days. |
Deleting everything
Your account page has a delete button. It removes the account, every lesson's progress and every answer you have submitted, immediately and without a copy. You do not have to email anybody and there is no waiting period.
What survives is arithmetic: how many people attempted a step and which wrong answers are common. Those totals contain no identifier and cannot be traced back to a person, which is why removing them would destroy the only measurements we have while protecting nothing.
Who else touches it
- Google Firebase — sign-in, the database and the code that marks your answers. Data is held in the EU.
- Cloudflare — serves the pages. It sees the request, not your answers.
- Sentry — error reports, when something breaks.
- PostHog — product analytics, only if you allowed it.
- Paddle — will handle payments as merchant of record when they are switched on. They are not switched on, and no card details have ever reached this site.
Fonts are served from this domain, not from a font CDN, so loading a page does not tell a third party that you visited.
Your rights
Under the GDPR you can ask for a copy of what we hold, ask us to correct it, or ask us to delete it. A copy and deletion are both buttons on the account page: the copy downloads as a file straight away. For a correction, or if you cannot sign in, email [email protected] and we will answer within 30 days.