Privacy Policy
Draft version — last updated 2026-09-21. Not yet reviewed by a lawyer; do not treat as final before a real launch.
1. What we collect
| Data | Why |
|---|---|
| Email, password hash, handle | account creation and sign-in |
| Commands you type | graded server-side; only the parts matching the correct answer are stored — everything else is masked before it ever reaches a database, so a password you accidentally type is never kept |
| Progress, streaks, badges, XP | your dashboard, dossier and leaderboards |
| Time zone, reminder time | sending reminders at a sane local hour |
| IP address (short-lived, in rate-limit memory and audit log) | abuse prevention and account security |
| Payment status/plan (not your card number) | billing is handled by our payment processor |
2. What we never collect
- We never see or store your card number — that goes straight to our payment processor.
- We do not sell personal data to third parties.
- We do not run third-party ad trackers on the training app.
3. The Mistake Graph (de-identified)
To improve error explanations for everyone, we keep an anonymous record of which kinds of mistakes are common on which commands (e.g. "flag case error on -sV") — never tied to your account after deletion, and never containing the specific values you typed.
4. Your rights
- Access & export — Settings → Export my data gives you a full JSON export at any time.
- Deletion — Settings → Delete account permanently removes your personal data. Anonymous, de-identified learning signal (see §3) is kept because it no longer identifies you.
- Correction — update your profile any time from Settings.
- If you are in the EU/UK (GDPR) or Saudi Arabia (PDPL) or another jurisdiction with similar rights, these map to your local rights; contact us for anything not covered here.
5. Security
Passwords are hashed with scrypt — we cannot read them. Sessions use short-lived tokens with automatic rotation. All traffic is served over HTTPS in production.
6. Children
The Service is intended for users old enough to hold a school or work account in their jurisdiction. We do not knowingly collect data from young children.
7. Contact
Questions or requests: privacy@terminaldojo.com.