Account and learning information
When you register, the service processes your name, email address, password, and account creation time. Passwords are salted and hashed with Node.js scrypt; the plain-text password is not stored. Enrolling in courses or recording lesson progress also stores your course enrollments, completed lesson identifiers, and completion timestamps.
Sessions and account links
Login uses a random session token in an HTTP-only, SameSite=Lax cookie with a 24-hour lifetime. The SQLite database stores a hash of the token, not the cookie token itself. Verification and password-reset tokens are stored as hashes and expire after one hour. You can log out, change your password, download an account-data export, or delete your account from settings.
Storage and retention
Account, session, and learning records are stored in the SQLite database configured for this server. Existing JSON accounts are imported once during migration; the JSON backup is left in place until the site owner removes it securely. Deleting an account removes its live SQLite data and sessions; migration JSON files and external backups may retain copies until the operator securely removes them under a documented backup-retention schedule. Expired sessions are cleaned up during requests.
Messages, email, and external services
When you submit the contact form, your name, email address, subject, and message are sent to the configured site support inbox through Resend; contact messages are not retained in the site database. In production, Resend also receives the recipient email address and message content for verification and password-reset delivery. Google Fonts and cdnjs provide fonts and icons when the browser loads pages; linked social profiles are external websites with their own privacy practices.
Contact and legal review
The contact form requires the site owner to configure a support recipient and email provider; until configured, the form clearly reports that delivery is unavailable. This technical summary is not legal advice. The site operator must confirm the deployed providers, publish a valid support route, and obtain jurisdiction-specific privacy review before public launch.