1 · What we collect

Your email address, if you give it to us for the readiness check, the waitlist, or a purchase. Your readiness-check answers, so we can score them and write your gap report. If you buy something, our payment provider collects what it needs to take the payment — we never see or store your card details.

If you create an account, we store that email address and a scrambled version of your password — a scrypt hash, which cannot be turned back into the password you typed. We never store the password itself and cannot read it, which is also why nobody here can tell it to you if you forget it. We keep a record of each signed-in session so that signing out actually ends it on our side rather than only in your browser.

If you sign in with Google, Google tells us your email address and confirms it is yours. We don’t receive your Google password, and we don’t read your contacts, files or anything else in your Google account.

While you study, we store your progress — which notes you’ve read, your practice and mock attempts and their scores — so we can show your readiness and pick up where you left off. If you join a lab or the programme, we see the code and write-ups you share for review, and use them only to review your work. If you enquire about a team cohort, we keep what you tell us about your team to prepare a proposal.

2 · What we do with it

Send you the thing you asked for. Send you your gap report. Tell you when something you joined a waitlist for is ready. We do not sell your data, rent it, or share it with recruiters, employers, or advertisers — this matters more here than on most sites, because plenty of certification businesses do exactly that.

3 · Analytics

We use Google Analytics 4, PostHog to see how people find the site and which pages are useful. Some of these set cookies and send data to a third party. Where that party is Google, it is ad-tech infrastructure. We have turned off ad personalisation and Google Signals. We ask PostHog not to store a persistent identifier on your device. We would rather say plainly what these are than call all of them privacy-respecting. Any tracker blocker stops all of it, and nothing on this site will break.

We also record when someone arrives from an AI assistant — ChatGPT, Perplexity, Claude and similar. That is the referring website only, never the question you asked, which we could not see even if we wanted to.

4 · Cookies

Our own: one, and only if you sign in. It holds a random session identifier — nothing about you, and nothing readable by JavaScript. It is what keeps you signed in between pages, it expires after thirty days, and signing out deletes it at both ends.

Analytics: more than one, and without waiting to be asked. Google Analytics 4, PostHog set their own cookies as soon as a page loads, for every visitor rather than only signed-in ones. Google’s are named _ga and _ga_…, last about thirteen months, and exist to recognise a returning browser, which is how “how many people came back” gets counted at all.

There is no consent banner on this site yet, so these are set before you have a say. We would rather write that down than imply we asked. Any tracker blocker refuses them and nothing here breaks; none of them is used for advertising or sold on.

5 · Who processes it for us

A small number of services handle data on our behalf, each only for the job named:

• Our hosting and database provider — runs the site and stores accounts and progress.
• Stripe — takes payments. Card details go to Stripe, never to us.
• Google — only if you choose “Continue with Google”, and for analytics as described above.
• PostHog — product analytics, as described above.
• Our email provider — delivers the emails you asked for.

Some of these are based outside your country, including in the United States, so your data may be processed there. We use providers that commit to protecting it, and we share only what each needs.

6 · What we don’t do

No advertising trackers, and no ad personalisation — Google Signals and ad-personalisation signals are switched off in our configuration, so what we run counts visits rather than feeding an advertising profile. No selling of lists. No passing your details to anyone hiring. We are not a recruitment service and we do not forward candidate details to employers.

7 · How long we keep it

As long as you want to hear from us, plus whatever we’re legally required to keep for accounting on a purchase. Sessions expire after thirty days on their own. An account lasts until you ask us to delete it — ask, and we delete the account, its email address and its password hash. There is no waiting period and you don’t need to give a reason.

8 · Your rights

Ask for a copy of what we hold, ask us to correct it, ask us to delete it, or withdraw consent to anything you agreed to. One email is enough — you don’t need to cite a regulation at us. These rights apply wherever you live, including under India’s Digital Personal Data Protection Act and the GDPR. If you’re unhappy with our answer, you can also complain to your local data-protection authority.

9 · Security

Connections are encrypted, passwords are stored only as hashes, sessions can be ended from your account, and access to data inside the team is limited to people who need it. No system is perfectly secure; if we ever have a breach that affects you, we will tell you promptly and say plainly what happened.

10 · Age

This site is for professionals. It is not meant for anyone under 18, and we don’t knowingly collect data from children. If you think a child has given us data, tell us and we’ll delete it.

11 · Changes

If this policy changes in a way that matters, we update the date at the top and say so on the site — and if you have an account, we email you before it takes effect.

12 · Contact and grievances

Questions, requests and complaints about your data go to one inbox, read by a person, and we aim to respond within 30 days: hello@hydralogic.dev