cyberfocus@legal:~$ cat privacy.md

Privacy Policy

Version 2026-09-29 · Last updated September 29, 2026 · Operator: CyberFocus Legal · balmzyny780@gmail.com

TL;DR

We collect the minimum: your email and sign-in details if you create an account, your learning progress, and any feedback you choose to send.
Analytics stay off until you click Allow, and never run while your browser sends Global Privacy Control. No ads, no cross-site tracking, no selling or sharing of your data.
As a guest, your progress never leaves your browser.
Download or delete everything, instantly, at Your data.
Your account data is stored in the United States by our providers Supabase and Vercel, under contractual safeguards.

The summary helps you skim; the full text below is what applies.

1. Who we are

CyberFocus Legal operates CyberFocus (https://cyberfocus-seven.vercel.app) and is the controller of your personal data, meaning the party that decides why and how it is processed. This policy explains what we collect, why, how long we keep it, and your rights, including under the EU and UK GDPR, the California Consumer Privacy Act (CCPA/CPRA) and Saudi Arabia's Personal Data Protection Law (PDPL).

2. What we collect and why

This is the complete list. If something isn't listed here, we don't collect it.

Account: What exactlyEmail address, account ID, sign-in method, the dates you joined and last signed in, and a display name taken from the part of your email before the @.; WhyTo create your account, sign you in and sync your progress across devices.; Legal basis (GDPR / PDPL)Contract; Kept forUntil you delete your account
Google / GitHub profile: What exactlyOnly if you sign in with them: the basic profile they share, such as your name, profile-picture URL and provider account ID.; WhyTo sign you in. We don't display it or use it for anything else.; Legal basis (GDPR / PDPL)Contract; Kept forUntil you delete your account
Sessions and security log: What exactlyFor each signed-in device: IP address, browser user agent and session times. Sign-in and sign-out events with IP address.; WhyTo keep your account secure and detect abuse.; Legal basis (GDPR / PDPL)Legitimate interests (security); Kept forSessions: until you sign out or delete your account. Security log: 90 days
Learning progress: What exactlyXP, level, streaks, completed steps and lessons, skill-tree unlocks, badges and XP spent on hints.; WhyTo run the course and keep your progress.; Legal basis (GDPR / PDPL)Contract; Kept forUntil you delete your account
Consent records: What exactlyWhich version of the Terms, Privacy Policy, age confirmation and Ethical-Use Pledge you accepted, and when.; WhyTo prove what you agreed to.; Legal basis (GDPR / PDPL)Legal obligation; Kept forUntil you delete your account
Feedback: What exactlyYour message or lesson rating, its category, the page it came from, an optional reply email, and your account ID if you are signed in.; WhyTo fix problems, improve lessons and reply if you asked us to.; Legal basis (GDPR / PDPL)Legitimate interests (improving the Service); consent for the reply email; Kept for24 months, or until you delete your account
Rate-limit records: What exactlyA hashed (pseudonymized) form of your IP address (guests) or account ID, with a timestamp.; WhyTo stop spam on the feedback form.; Legal basis (GDPR / PDPL)Legitimate interests (security); Kept forAt most 1 hour
Unfinished sign-ups: What exactlyThe email address of a sign-in link that was requested but never used.; WhyTo finish creating your account if you use the link.; Legal basis (GDPR / PDPL)Steps you asked for before a contract; Kept for7 days
Live lab commands (only where enabled): What exactlyIf a lesson runs on a live lab machine instead of the in-browser simulator, the commands you type are sent to our lab server to run in an isolated, disposable container.; WhyTo run the lab.; Legal basis (GDPR / PDPL)Contract; Kept forNot stored; the container is destroyed when the session ends
Analytics (only if you allow it): What exactlyAnonymous page views and two events (feedback sent, lesson rated): page path without query string, referrer, country or region, browser, operating system and device type. Vercel counts unique visitors with a hash of the request and discards it after 24 hours. No cookies.; WhyTo understand which lessons work and which don't.; Legal basis (GDPR / PDPL)Consent; Kept forAggregated statistics only
Hosting logs: What exactlyTechnical request logs kept by our providers: IP address, user agent, requested URL and time.; WhyTo deliver the site, keep it secure and fix errors.; Legal basis (GDPR / PDPL)Legitimate interests (security and operation); Kept forShort-lived; deleted automatically on our providers' schedules, typically within days
Browser storage (on your device): What exactlyYour progress, preferences, terminal history for each lab and your privacy choices, in local storage. Signed-in users also get sign-in cookies.; WhyTo make the Service work, including in guest mode.; Legal basis (GDPR / PDPL)Strictly necessary for the Service you asked for; Kept forUntil you clear it, sign out, or erase it at Your data

Data	What exactly	Why	Legal basis (GDPR / PDPL)	Kept for
Account	Email address, account ID, sign-in method, the dates you joined and last signed in, and a display name taken from the part of your email before the @.	To create your account, sign you in and sync your progress across devices.	Contract	Until you delete your account
Google / GitHub profile	Only if you sign in with them: the basic profile they share, such as your name, profile-picture URL and provider account ID.	To sign you in. We don't display it or use it for anything else.	Contract	Until you delete your account
Sessions and security log	For each signed-in device: IP address, browser user agent and session times. Sign-in and sign-out events with IP address.	To keep your account secure and detect abuse.	Legitimate interests (security)	Sessions: until you sign out or delete your account. Security log: 90 days
Learning progress	XP, level, streaks, completed steps and lessons, skill-tree unlocks, badges and XP spent on hints.	To run the course and keep your progress.	Contract	Until you delete your account
Consent records	Which version of the Terms, Privacy Policy, age confirmation and Ethical-Use Pledge you accepted, and when.	To prove what you agreed to.	Legal obligation	Until you delete your account
Feedback	Your message or lesson rating, its category, the page it came from, an optional reply email, and your account ID if you are signed in.	To fix problems, improve lessons and reply if you asked us to.	Legitimate interests (improving the Service); consent for the reply email	24 months, or until you delete your account
Rate-limit records	A hashed (pseudonymized) form of your IP address (guests) or account ID, with a timestamp.	To stop spam on the feedback form.	Legitimate interests (security)	At most 1 hour
Unfinished sign-ups	The email address of a sign-in link that was requested but never used.	To finish creating your account if you use the link.	Steps you asked for before a contract	7 days
Live lab commands (only where enabled)	If a lesson runs on a live lab machine instead of the in-browser simulator, the commands you type are sent to our lab server to run in an isolated, disposable container.	To run the lab.	Contract	Not stored; the container is destroyed when the session ends
Analytics (only if you allow it)	Anonymous page views and two events (feedback sent, lesson rated): page path without query string, referrer, country or region, browser, operating system and device type. Vercel counts unique visitors with a hash of the request and discards it after 24 hours. No cookies.	To understand which lessons work and which don't.	Consent	Aggregated statistics only
Hosting logs	Technical request logs kept by our providers: IP address, user agent, requested URL and time.	To deliver the site, keep it secure and fix errors.	Legitimate interests (security and operation)	Short-lived; deleted automatically on our providers' schedules, typically within days
Browser storage (on your device)	Your progress, preferences, terminal history for each lab and your privacy choices, in local storage. Signed-in users also get sign-in cookies.	To make the Service work, including in guest mode.	Strictly necessary for the Service you asked for	Until you clear it, sign out, or erase it at Your data

3. What we never collect or do

No passwords: you sign in with one-time email links or Google/GitHub.
No payment details, precise location, contacts, microphone or camera access.
No special categories of data (such as health, religion or biometrics). Please don't send any in feedback.
No advertising, ad cookies or cross-site tracking. We do not sell your personal data or share it for targeted advertising, and we never have.
No automated decisions with legal or similarly significant effects. Features such as suggesting your next lesson only shape your learning path.

4. Cookies and browser storage

Strictly necessary storage is always on, because the Service can't work without it: first-party sign-in cookies (only when you sign in) and local storage holding your progress, preferences, per-lab terminal history and privacy choices. Local storage stays on your device.

Analytics are off by default. They start only if you click Allow in the privacy banner, and never while your browser sends a Global Privacy Control (GPC) signal. You can change your mind at any time with "Privacy choices" in the footer of every page, and it takes effect immediately.

We use no advertising or third-party tracking cookies.

We share personal data only with the service providers in the table below, which run CyberFocus for us under contracts that require them to protect it and use it only on our instructions. Apart from them:

we may disclose data if the law or a valid legal request requires it, or to protect the rights, property or safety of our users, the public or us;
if CyberFocus is reorganized, merged or sold, your data may pass to the new operator, who must honor this policy, and we will tell you first;
we do not sell personal data, and we do not share it for cross-context behavioral advertising.

Supabase, Inc.: What they doDatabase and sign-in (authentication); WhereUnited States (AWS us-east-1, via Supabase)
Vercel, Inc.: What they doWebsite hosting and delivery; anonymous analytics if you allow it; WhereGlobal edge network, with processing in the United States
Google LLC / GitHub, Inc.: What they doOnly if you choose them to sign in. They provide your account with them independently, under their own privacy policies; WhereTheir own infrastructure

Provider	What they do	Where
Supabase, Inc.	Database and sign-in (authentication)	United States (AWS us-east-1, via Supabase)
Vercel, Inc.	Website hosting and delivery; anonymous analytics if you allow it	Global edge network, with processing in the United States
Google LLC / GitHub, Inc.	Only if you choose them to sign in. They provide your account with them independently, under their own privacy policies	Their own infrastructure

6. International transfers

Our database is hosted in the United States and our website is served from a global network, so your data may be processed outside the country where you live, including outside the EEA, the UK and the Kingdom of Saudi Arabia.

Where the law requires it, we protect these transfers with appropriate safeguards, such as the European Commission's Standard Contractual Clauses (with the UK Addendum) in our providers' data-processing terms, and we follow the PDPL's rules for transfers outside the Kingdom. The transfers are also necessary to provide the Service you asked for.

7. How long we keep data

Account data, progress and consent records: until you delete your account. Deletion is immediate and covers our live database, including sign-in identities, sessions and security logs.
Feedback: 24 months. Security log: 90 days. Unfinished sign-ups: 7 days. Abandoned sign-in attempts: 1 day. Rate-limit records: 1 hour.
These limits are enforced by an automatic daily clean-up job in our database, not just promised here.
Copies may remain in our providers' routine backups for a limited time before being overwritten. We never restore deleted accounts from backups.
Guest data lives only in your browser until you clear it.

8. Your rights, wherever you live

We give everyone the same core controls, free of charge. If you ask by email, we may need to confirm that the request comes from the account's owner, for example by asking you to reply from that email address. We will never treat you differently for using your rights.

Access and take away your data instantly: Your data → Download my data (a machine-readable JSON file).
Delete your account and data instantly: Your data → Delete my account.
Withdraw analytics consent at any time with "Privacy choices" in the footer.
Ask us to correct inaccurate data, restrict or object to processing, or explain anything in this policy: balmzyny780@gmail.com.

10. California and other U.S. state residents

Where the CCPA/CPRA or similar state laws apply, you have the right to know what personal information we collect, use and disclose; to access, correct and delete it; to opt out of its sale or sharing; to limit the use of sensitive personal information; and not to be discriminated against for using these rights.

In the past 12 months we collected identifiers (such as email address, account ID and IP address), internet or other electronic network activity (such as learning progress and, with consent, anonymous analytics), and the content of feedback you sent. We collected it from you and your devices, for the purposes in section 2, and disclosed it only to the service providers in section 5. We do not sell or share personal information, we do not use sensitive personal information in ways that would require a right to limit, and we honor Global Privacy Control as an opt-out signal.

You or an authorized agent can make a request at Your data or by email. We respond within 45 days, extendable once by another 45 days where the law allows.

11. Kingdom of Saudi Arabia (PDPL)

You have the right to be informed about how and why your data is processed; to access your data and get a copy in a readable format; to ask for it to be corrected, completed or updated; to ask for data we no longer need to be destroyed; and to withdraw your consent.

We respond within 30 days, extendable as the PDPL's Implementing Regulations allow. You may also file a complaint with the Saudi Data & AI Authority (SDAIA), the competent authority, within 90 days of the incident.

12. Children

CyberFocus is not directed to children. You must be 16 or older to create an account, and every user confirms this at sign-up. If we learn that we have collected personal data from someone under 16, we delete it. If you believe a child has given us data, contact balmzyny780@gmail.com.

13. How we protect your data

No system is perfectly secure, but we build CyberFocus the way we teach it:

HTTPS everywhere, enforced with HSTS, plus a Content Security Policy that limits where scripts and data can load from, and anti-framing headers.
Row-level security on every database table: each account can reach only its own rows, and some, like consent records, can't be changed at all.
No passwords stored. Privileged database functions act only on the signed-in caller's own account and use a fixed search path.
Rate limiting and validation on public forms, with IP addresses kept only in hashed form, for at most an hour.
If a personal-data breach happens, we will notify the competent authorities where required (for example within 72 hours under the GDPR and the PDPL) and tell affected users without undue delay.

14. Changes to this policy

Every version has a version number and date, shown at the top of this page.
For material changes, signed-in users are asked to review and accept the new version before continuing, and we give notice in the Service.
We will never apply a less protective policy to data collected under an earlier version without your consent.

15. Contact

Privacy questions, requests or complaints: balmzyny780@gmail.com. Controller: CyberFocus Legal.

You can also contact your data protection authority (see sections 9 to 11).