Privacy Policy

1. Information we collect

• Account details: email address and country code you submit, email verification status, and account security data. Passwords are stored as password hashes; we do not store the original password.
• Authentication data: hashed session tokens, session expiration, and short-lived verification and password-reset records. The browser receives an essential HTTP-only session cookie when you sign in.
• Learning data: lesson completion, course sequence, and related progress and activity timestamps associated with your account.
• Technical and security data: information needed to deliver and protect the Service, such as request and error details. Short-lived rate-limit records use hashed identifiers derived from email addresses or IP addresses to reduce automated abuse.
• Messages to us: information you include when contacting our support or privacy address.

2. How we use information

We use personal data to create and maintain learner accounts; verify email ownership; authenticate users and recover or secure accounts; provide lessons and synchronize progress; respond to support and privacy requests; prevent abuse and protect the Service; diagnose service failures; and meet legal obligations. We send account-related messages such as verification and password-reset emails. We do not currently use learner email addresses for a marketing newsletter.

Depending on the context and applicable law, we process information because it is needed to provide the Service you request, to pursue legitimate interests such as account security and service reliability, to comply with legal obligations, or based on consent where consent is required.

3. Cookies and similar technologies

The learner service uses a first-party session cookie to keep you signed in and protect authenticated requests. It is HTTP-only, secure in production, and configured as a host-only, same-site cookie. It is necessary for the account features you request. Our public-site code currently does not intentionally set advertising or analytics cookies. Your browser may still receive essential technical cookies from hosting or third-party services when those services are used.

4. When information is shared

We do not sell personal data. We share it only as needed to operate the Service, protect users, or comply with law, including with these service providers:

• Google Cloud: application hosting and service infrastructure.
• MongoDB Atlas: database hosting for account, authentication, and learning records.
• Brevo: delivery of verification and account-recovery email.
• YouTube/Google: delivery of lesson videos when an embedded player is loaded or used.

These providers process data under their own terms and privacy notices and, where applicable, our instructions. We may also disclose information to a competent authority when legally required or to protect the rights, safety, and security of users and the Service.

5. International processing

Our service providers may process or store information in countries other than the country where you live. Where applicable law requires safeguards for an international transfer, we will use a permitted transfer mechanism and appropriate protections.

6. Retention

We keep account and learning information while your account is active and for as long as reasonably necessary to provide the Service, resolve disputes, enforce our terms, maintain security, or meet legal obligations. You may request account deletion by contacting us. Verification codes, password-reset codes, and session records are designed to expire; database cleanup may not happen at the exact expiration time. Short-lived abuse-prevention records expire on a rolling schedule. Backups and records that must be retained may remain for a limited period before deletion or anonymization.

7. Security

We use measures designed to protect personal data, including password hashing, hashed session tokens, access controls, and secure session cookies in production. No system or transmission is completely secure. Keep your password private and contact us promptly if you suspect unauthorized access to your account.

8. Your choices and rights

Depending on where you live and the law that applies, you may have the right to request access to or correction, deletion, restriction, or portability of your personal data; object to certain processing; or withdraw consent where consent is the basis. You can also ask questions about how your data is used. We may need to verify your identity before responding and may retain information where the law allows or requires it.

If the Nigeria Data Protection Act, 2023 applies to you, its data-subject rights and complaint options are described by the Nigeria Data Protection Commission. You may also contact the relevant supervisory authority in your jurisdiction.

9. Children

The Service is intended for people who are at least 18 years old or the age of legal majority where they live if higher. We do not knowingly collect personal data from children. If you believe a child has provided us personal data, contact us so we can review and take appropriate action.

10. Changes and contact

We may update this policy as our practices, services, or legal obligations change. We will post changes here and update the effective date. For a privacy request or question, email privacy@onoffchain.com.