Privacy Policy

What Data We Collect

• Account data: username, email address, password hash, optional OAuth IDs (Google/Apple), and a last_activity_at timestamp used to enforce our inactive-account deletion policy.
• Session data: session identifiers stored in cookies to keep you logged in.
• Learning progress: which topics you have marked as completed and your quiz scores.
• Quiz answers: your responses to quizzes, stored so you can review past attempts.
• Usage analytics: anonymised page views, feature usage, and error events to improve the platform.
• Audit log: IP address and timestamp of administrative actions for security.

Cookies

We use the following categories of cookies:

• Essential cookies: required for authentication and core site functionality. These cannot be disabled.
• Consent preference cookie: remembers whether you have accepted or rejected analytics tracking.
• Analytics cookies: only placed if you explicitly consent. Used to understand how visitors use the site.

How We Use Your Data

• To provide and maintain your account and learning progress.
• To generate quiz results and personalised recommendations.
• To detect and prevent abuse or security incidents.
• To improve the platform based on anonymised usage patterns (only with your consent).

We do not sell your personal data to third parties.

Data Retention & Inactive Accounts

To comply with GDPR storage-limitation principles, student accounts that remain inactive for 365 consecutive days may be automatically deleted, along with all associated personal data. Activity is determined by the last_activity_at timestamp, which is updated when your session is refreshed. We do not use this timestamp for profiling or analytics.

We will send a single courtesy email to the address on your account approximately 30 days before deletion, reminding you to log in if you wish to keep your account.

Administrative accounts are excluded from automatic deletion.

Your Rights (GDPR)

You have the right to:

• Access: request a copy of all data we hold about you.
• Rectification: correct inaccurate personal data.
• Erasure ("Right to be Forgotten"): request complete deletion of your account and all associated data.
• Object: opt out of analytics tracking at any time via the cookie banner or your browser settings.
• Data portability: receive your data in a structured format.

To exercise any of these rights, please contact us using the details below.

Contact

If you have questions about this privacy policy or wish to exercise your data rights, please email [email protected].