Privacy policy

1. Information we collect

• Account information: the email and display name you sign up with. Your password is stored only as an irreversible cryptographic hash, so we can't see it. We also record whether your email is verified, when you signed up and when you last logged in.
• Learning data: lessons you've completed, courses you've added, quiz questions you got wrong (for review), practice arena results, certificates you've earned, and the dates you studied (to calculate your learning streak).
• Statistics: page views, the number of visitors per lesson, and how often each quiz answer is chosen. These are stored only in aggregate and used to improve the courses. To count unique visitors we use a randomly generated visitor ID that is not linked to your name or email.
• Technical data: to prevent abuse (such as password guessing), we rate-limit requests like logging in, signing up and resetting passwords, and keep the related counters only briefly. Our hosting provider also keeps basic access logs under its own policies.
• Error reports: when a page or the server runs into an error, we record the error message, the page address and the browser type so we can track down and fix the problem. They don't include your IP address, account or cookies.

We don't collect your real name (your display name can be anything you like), phone number, address, ID documents or any payment information. This website has no paid features.

2. How we use this information

• To provide the service: logging in, saving and syncing your progress, reviewing missed questions and issuing certificates.
• To keep accounts secure: sending email verification and password reset emails, and spotting unusual login attempts.
• To improve the content: using aggregate statistics to find lessons that are hard to follow and questions people often get wrong.

We don't send you marketing emails. We only send transactional emails when you sign up, verify your email or request a password reset.

3. Cookies and local storage

• tc_session: keeps you logged in; valid for 14 days and readable only by the server (HttpOnly).
• tc_vid: a randomly generated visitor ID used to count unique visitors; valid for 1 year and readable only by the server.
• lab72_locale, lab72_updown: remember the interface language and up/down colors you chose.
• Browser local storage: remembers your dark / light theme.

The analytics and performance monitoring services we use don't use cookies and don't track you across websites. We don't use any advertising or third-party tracking cookies.

4. Who processes your data

To run this website we use the following service providers. They process data only on our instructions and only to provide their services:

• Vercel: website hosting, visitor analytics and performance monitoring.
• Neon: the database that stores account and learning data.
• Upstash: stores rate-limit counters, one-time links and aggregate statistics.
• Resend: sends email verification and password reset emails.

These providers' servers may be located outside your country or region. Apart from the above and where required by law, we don't share your personal information with any third party.

5. Public information

Each course certificate has a public link that shows your display name, the course name and the date it was issued. Only people who have the link can see it, and certificate pages are not indexed by search engines. If you'd rather not show your real name, change your display name in Account settings.

6. How long we keep data

• Account and learning data: kept until you delete your account.
• Password reset links expire after 30 minutes, and email verification links after 24 hours.
• Daily page view statistics are kept for 120 days, and the markers that keep quiz answers from being counted twice are kept for 90 days.
• Error reports are kept for 30 days.

7. Your rights

• View and correct: see and change your display name and password in Account settings.
• Clear your learning history: reset your progress in Account settings.
• Export your data: download a JSON file with your account details and your full learning history in one click from Account settings.
• Delete your account: enter your password in Account settings to delete it. Your account and learning data are deleted right away, and your certificate links stop working. You can also email info@72lab.com and we'll handle it after verifying your identity.

8. Children

This website is not intended for children under 16. If you believe a child has given us personal information, please contact us and we will delete it.

9. Security

We use HTTPS to encrypt data in transit, store passwords as cryptographic hashes, and sign out all earlier sessions when you change your password. No online service can guarantee absolute security, though, so please use a password for this website that you don't use anywhere else.

10. Changes to this policy and contact

If this policy changes in an important way, we will update the date on this page and post a notice on the website.

For any questions about privacy, contact info@72lab.com.