Privacy Policy

In short

• There is no sign-up: instead of a name, email and password there is a course code.
• The site has no visit counters, analytics or ads.
• IP addresses are stored in the database only as a hash.
• Data is stored on a server in Russia run by a cloud provider.
• Data is not sold or shared for advertising.

Access code

The code is stored in the database in two forms: a hash (HMAC-SHA256) to recognise the code at sign-in, and an encrypted copy (AES-256-GCM) to show the code to its owner under “My courses and devices”. The key is kept in the server settings, not in the database. Server logs and notifications get only the last 4 characters of the code.

Cookies and the browser

• The site sets one cookie, sid: a random browser number that tells the server which code is open here. The database stores only its hash. The cookie appears when the browser gets a code or signs in with one, lasts 180 days and is extended on visits.
• There are no other cookies: no analytics and no ads.
• Browser storage (localStorage) holds only settings: the page language and the sound of the mini-games on the course home page. Progress is not stored in the browser.
• The site fonts load from Google Fonts. When a page opens, the browser contacts Google's servers, and they see the IP address and browser details, as with any request.
• Course videos come from storage at the same cloud provider that runs the server. Links to other sites open only when clicked.

Devices and IP address

• For each browser where a code is open, the server keeps: when it first and last visited, the browser string (device type, system, browser) and a hash of the IP address. This is needed for the list under “My courses and devices” and for the device limit.
• The IP address is stored in the database only as a hash with a secret key. The hash is used for limits: how many codes, orders and sign-ins come from one address. The address cannot be recovered from the hash.
• The web server keeps a technical request log: time, page address, IP address with its last part removed, and browser. The log has a size limit and overwrites itself, and it is not part of the database copies.
• A record of a browser that never got a code is deleted after an hour.

Course progress

Progress is stored on the server, by code: step checkmarks, test answers, choices in tasks, notebook notes and the name for the certificate, if one was entered. Progress is shared by all devices of a code. The server does not accept images. Without a code, progress lives only in the open page and is lost on reload.

Orders and payment

• For an order the server keeps the course, order number, price, time limit, status, payment time and the agreement to the terms: the version and the time.
• Each code has its own payment address on the TRON network. The address is created by the project's server, and the database keeps which code it belongs to.
• For transfers to this address it keeps the sender's wallet address, the transaction number, the amount and the time, and if something other than USDT arrived, the name of the coin or token. This is public TRON network data: anyone can see it in a blockchain explorer.
• The server gets transfer details from public TRON network services, TronGrid and Tronscan. They receive only payment addresses and transaction numbers. Through TronGrid the server also sends its own transfers to the network: money is forwarded automatically from the payment address to the author's wallet.

The payment address is tied to the code

• There are no payment problem requests: the payment address is tied to the code, so a USDT transfer to it counts for that code on its own, with no details from the buyer.
• The “I have a problem with the payment” button on the order page only shows what has already arrived at the code's address and gives the author's contacts. It collects nothing: no sender address, no seed phrase, no wallet keys.

Notifications and log

• The author learns about payments from their own Telegram bot: order number, course, amount, last 4 characters of the code and a link to the transfer. The sender address and the full code are never sent there.
• The server logs important events: code issued, sign-ins, device changes, orders, payments and the author's actions. The log has the last 4 characters of the code and a hash of the IP address.

Where data is stored

• The database is on a server in Russia run by a cloud provider.
• Once an hour a copy of the database is encrypted with the author's key and sent to storage at the same provider. For the first 30 days a copy cannot be deleted, even by accident, and after 90 days it is deleted. Once a day the author downloads the encrypted copies. Only the author can decrypt them.
• Once a day the provider takes a snapshot of the whole server, and only the latest one is kept.

How long data is kept

• An unpaid code (progress code) is deleted together with its progress and devices after 180 days without activity: a sign-in, saved progress or an order.
• A paid code, its progress and devices are kept until the code's owner asks for them to be deleted. Orders, transfers and payment addresses are kept for accounting.
• A record of a browser without a code is kept for an hour.
• Database copies are kept for up to 90 days in the provider's storage, and also by the author.

Who sees the data

Data is not sold or passed to third parties for advertising or analytics. Apart from the author, only these deal with it:

• the cloud provider: the database, copies and videos are on its server and in its storage;
• the TRON network: transfers on it are public to everyone;
• TronGrid and Tronscan: the server asks them about transfers to payment addresses and sends transfers to the author's wallet through TronGrid;
• Telegram: the author gets notifications through it;
• Google Fonts: the browser loads fonts from there.

How to delete data

Devices can be viewed and removed under “My courses and devices”.

To delete the data completely, write to any of the channels under Contacts and give the course code. It is better to send the code in a private message, not in a public comment. The author will delete the code, its progress and devices. If the code is paid, access to the course closes with it.

Records of transfers stay for accounting, and they are public on the TRON network anyway. Deleted data remains in the encrypted database copies for as long as those copies are kept.

Changes and contacts

A new version of this policy appears on this page with a new date. Academy Igor is a project by the author of the studioigor channel. Questions about data can go to any of these channels: