Privacy policy

Who we are

Squared Academy runs this website and the courses, books and community it sells. We decide how the personal data described here is used, and we are the people to contact about it.

Write to mail+support@squared.academy with any question about your data, or to make any of the requests described below.

What we collect, and why

We collect the least we can while still running an account, taking a payment and remembering where you are in a course.

• Your account: the email address you sign in with, the name you give us, and either a password we store only as an Argon2 hash, or a link to the GitHub or Google account you chose to sign in with. We never see your password for those providers.
• Your sessions: each signed-in device holds a token, and we record the browser it identified itself as and the IP address it connected from, so you can be signed out everywhere if a device is lost and so we can investigate abuse.
• Your learning: which lessons you have completed, how far through a video you were, every quiz attempt and its score, and any certificate issued to you.
• Your purchases: what you bought, when, how much it cost and whether it succeeded, was refunded or is still pending. Payment card details never reach us at all.
• Your email preferences: whether you agreed to hear from us, which course email series you are in, and whether a message to you bounced or was reported as spam.

What is public

Certificates are public by design, because a certificate nobody can check is worth nothing. A certificate page shows the name of the person it was issued to, the course they finished, the date, and its serial number, and anybody who has the serial or the link can open it.

Nothing else about your account is public. Your email address, your progress, your quiz scores and your purchases are never shown to other students.

If you would rather not have a public certificate, tell us and we will revoke it. Revoking keeps the serial recorded so it cannot be reused, and the page then says the certificate was revoked.

Who else processes it

We keep the number of companies touching your data small, and each one only receives what it needs to do its job.

• Polar is the merchant of record for every purchase. They take the payment and handle the tax, and they hold the card details; we receive only the outcome, the amount and a reference.
• Postmark sends account email such as receipts, verification links and password resets, and receives your email address and the contents of those messages.
• Listmonk, which we run ourselves, holds the address of anyone who confirmed a newsletter subscription.
• Bunny hosts and delivers the course videos and downloadable files. Video is served through short-lived signed links, and a lesson video carries a faint identifier so a leaked recording can be traced to the account it came from.
• alwaysdata hosts the application and its database.

What we do not do

We do not sell or rent your personal data to anybody, for any price.

We run no advertising trackers and no third-party analytics. The site's content security policy blocks scripts from anywhere but this domain, so an advertising network could not load here even if somebody added one by mistake.

The only cookies we set are the ones that keep you signed in and protect forms against cross-site request forgery. There is no cookie banner because there is nothing to consent to.

How long we keep it

Your account and its learning history stay for as long as the account exists, because that is what lets you come back to a course you bought years ago.

Records of a payment are kept for as long as tax and accounting rules require, even after an account closes.

A suppressed email address is kept as a fact about that address, so we do not write to somebody whose mail server has already refused us.

Sign-in tokens expire on their own and are deleted when they do, or immediately when you change your password or sign out.

Your rights

You can ask us for a copy of the personal data we hold about you, to correct anything wrong with it, or to delete it. Write to mail+support@squared.academy from the address on the account and we will answer within thirty days.

Deleting the account removes your profile, your progress and your email preferences. We keep the record of any payment, because we are required to, and we keep any certificate serial so it cannot be reissued to somebody else; the certificate stops naming you.

You can leave the newsletter or stop a course email series at any time using the link at the foot of any message we send, without contacting us and without signing in.

If you think we have handled your data badly, tell us first and we will try to put it right. You can also complain to the data protection authority where you live.

Children

This is a service for professional engineers and is not directed at children. We do not knowingly create accounts for anyone under 16. If you believe a child has an account here, tell us and we will remove it.

Changes to this policy

When this policy changes we update the date at the top of the page. If a change materially affects what we do with data we already hold, we will email account holders before it takes effect rather than change it quietly.