This Privacy Policy explains what information LearnIT collects, how it is used, and the choices you have. It applies to the LearnIT web app and PWA.
1. Information We Collect
- Account information: email address, display name (optional), and a securely hashed password. We never store your password in plain text.
- Study activity: question responses, spaced-repetition progress, mock exam scores and category breakdowns, and podcast/flashcard playback state -- used to personalize your study plan.
- Legal agreement records: the date/time and document versions you agreed to at signup, and a timestamped log each time you acknowledge the Driving Mode Safety Policy.
- Technical data: browser type, device type, coarse IP-derived signals (stored only as a one-way hash, never the raw IP), and basic error/audit logs used for security and abuse prevention.
- Local device storage: a theme preference (light/dark) and a per-browser-session flag recording that you acknowledged the driving-safety notice, both stored only in your browser, not on our servers.
2. How We Use Information
- To create, secure, and approve your account.
- To operate core features: spaced-repetition scheduling, mock exam scoring, Team Battle multiplayer, and Driving Mode.
- To detect and prevent fraud, abuse, and unauthorized access (e.g., rate limiting and audit logging of login/signup events).
- To communicate essential account and security notices (e.g., password reset emails, account approval/denial notices).
3. Data Sharing
We do not sell your personal information. We share data only with the infrastructure providers necessary to operate the Service (for example, our hosting provider and managed Postgres database provider), each acting under their own data-processing and security commitments, and only to the extent needed to provide the Service. We may disclose information if required by law or to protect the rights, safety, or property of LearnIT or others.
4. Data Security
- Passwords are hashed with Argon2id (OWASP-recommended parameters) -- never stored or logged in plain text.
- Session and password-reset tokens are stored only as one-way hashes; the raw token is never persisted server-side.
- All traffic is served over HTTPS; session cookies are HttpOnly, SameSite, and marked Secure in production.
- Sensitive fields (passwords, tokens, secrets) are automatically redacted before anything is written to application logs.
- Authentication endpoints are rate-limited to slow down credential-stuffing and brute-force attempts.
5. Data Retention
We retain account and study-progress data for as long as your account is active. If you request deletion, we will delete or irreversibly anonymize your personal data within a reasonable period, except where retention is required for legal, security, or fraud-prevention purposes (e.g., certain audit log entries).
6. Your Rights
Depending on your location, you may have the right to access, correct, export, or delete your personal information, or to object to certain processing. You can update your name and password directly in Account settings, or contact us at apexhit01@gmail.com for any other request.
7. Children's Privacy
LearnIT is intended for adults preparing for professional licensure exams and is not directed to children under 16. We do not knowingly collect personal information from children under 16.
8. Changes to This Policy
We may update this Privacy Policy from time to time. Material changes will update the "last updated" date shown on this page.
9. Contact
Privacy questions or data requests can be sent to apexhit01@gmail.com.