Privacy
What this site stores, and why
This site stores only what it needs to run its courses: your account, the courses you are on and your test results. It uses no analytics, no advertising, no third-party services and no tracking of any kind.
What we store
| Data | Why | How long |
|---|---|---|
| Your name and email address | To sign you in and to show the lecturers of your courses who took which test | Until your account is deleted |
| A hash of your password | To check your password when you sign in. The password itself is never stored; the hash uses scrypt with a random salt. | Until your account is deleted |
| The courses you are on | To show you your courses and each course’s lecturers their students | Until you leave the course or your account is deleted |
| Your test attempts | The questions drawn, your answers, scores, and start and finish times — so that you can see your results and the course’s lecturers can support the cohort | Until you leave the course or your account is deleted |
| Sign-in sessions | A fingerprint (hash) of your sign-in token, so that you stay signed in | 14 days after your last visit, or until you sign out |
| A security log | Sign-ins, failed sign-ins, account creation, password resets, enrolment-code changes and deletions — to spot misuse. It records which account was involved, not your IP address. | 12 months |
Cookies and your browser
- Session cookie — keeps you signed in (14 days, renewed as you use the site). Essential.
- Form-security cookie — protects the sign-in and sign-up forms against cross-site forgery (two hours). Essential.
- Reading place — remembers the last chapter you read on each course, so the course home page can take you back to it (180 days).
- Flashcard progress — your “know it” and “again” piles are kept in your own browser’s local storage and never sent to the site.
Who can see your data
The lecturers of a course can see the names, email addresses and test results of the people on that course, and can add people to it, reset students’ passwords and remove people from it. They cannot see other courses. Other students cannot see your data. The site administrator, who runs the server, can see every course and can access the database for maintenance and backups.
Your choices
- Download your own results at any time as a CSV file from your account page.
- Change your password from your account page; this signs out your other devices.
- Ask a lecturer to remove you from a course: this deletes your test attempts on it. When it is your last course, your account, your sessions and the security-log entries about you are deleted too.
Questions
Ask your lecturer or the organisation running your course, who look after this site.