Privacy policy

Reading the site

Reading the articles and doing the Labs requires no account and stores nothing about you on our side. The site uses Google Analytics 4 to count visits; that is the only third party involved in reading, and it is not loaded on the account pages.

What the account stores

The free account stores three things, and nothing else:

• Your email address, because the account signs you in with a link sent to it.
• Your Labs progress: the identifier of each mission step you mark done and the date you did.
• Your self-assessments: the identifier of each finding you tick on a solution page and the date.

With them, the account keeps the date and version of the consent you gave on the welcome screen, and whether you asked for emails about new missions and articles. There is no name, no company, no profile visible to anyone, no ranking, and no sharing between accounts.

Why, and on what basis

The email and the progress are processed to run the account you asked for. Emails about new missions and articles are sent only if you tick the box for them, and you can untick it from your account page at any time. Sign-in links are sent whenever you request one: they are how you get in.

Who processes it

• Supabase hosts the database and the authentication service.
• Resend delivers the emails: sign-in links, confirmation of an email change, and, if you opted in, new missions and articles.
• Vercel hosts the site and runs the account's server code.

None of them uses your data for anything but providing the service to us. Your browser never talks to Supabase directly: every read and write goes through our server, with your session, and the database enforces that an account only ever sees its own rows.

How long

As long as the account exists. An account with no sign-in for 23 months receives one warning email; with no sign-in for 24 months it is deleted, with everything it holds. Technical logs keep account identifiers and results for 30 days and never contain your email, a token, or your IP address.

Your rights

From the My data page you can export everything in JSON, change your email, sign out of every device, and delete the account immediately and permanently. If you prefer to write, hello@analystengineering.com answers within a few days. You can also complain to the data protection authority of the country you live in.

Cookies

The account sets a session cookie (HTTP only, secure, 30 days), a short-lived cookie while a sign-in link is pending, and one display cookie that only tells the page you are signed in. Nothing is stored in cookies for advertising. Your progress is also cached in your browser's local storage so pages paint without waiting for the network; it is cleared when you sign out.

Changes

When this policy changes in a way that matters, the version date at the top changes and the welcome screen asks for consent again. Older versions are available on request.