Privacy policy · CyberHero

Who is responsible

CyberHero is operated as a personal educational project at cyberhero.clintonemok.eu. For privacy questions, contact clintonneemok11@gmail.com.

What we collect

Account data: your name, email address, hashed password and, if you use social sign-in, the account identifier and profile image returned by that provider.
Learning data: lessons completed, quiz answers and scores, bookmarks, notes, streaks, badges and certificates.
Technical data: session records including IP address and browser user agent, kept to secure the service and investigate abuse.
Email delivery data: the address and message metadata needed to send verification and password-reset emails.

What we do not collect

No advertising identifiers, no third-party analytics trackers, no location data, no payment data (the site is free) and no content from your device beyond what you type into the site.

Why we process it

To provide the service (contract): creating your account, saving progress, issuing certificates and authenticating you.
To keep it secure (legitimate interests): rate limiting, abuse prevention, audit logs and session security.
To send essential email (contract or legitimate interests): verification and password-reset messages. We do not send marketing email.

Cookies and local storage

The site uses an essential session cookie to keep you signed in. It is HTTP-only, secure in production and scoped to the site. Your theme preference is stored in your browser's local storage. There are no advertising or cross-site tracking cookies.

Who processes data for us

We use a small number of infrastructure providers:

Vercel for application hosting and delivery.
Neon or Supabase for the PostgreSQL database.
Resend for transactional email, when configured.
Cloudflare for DNS.

These providers process data on our instructions and under their own data processing terms. Where data is transferred outside your region, the provider's standard contractual clauses apply.

How long we keep it

Account and learning data are kept while your account exists. Server and security logs are kept for a short operational period, normally no more than 30 days. If you delete your account, associated learning data is removed by database cascade; residual backups expire on their normal cycle.

Your rights

Depending on where you live, you may have the right to access, correct, export or delete your personal data, to object to processing, or to complain to a supervisory authority. Email clintonneemok11@gmail.com and we will respond within a reasonable period, normally within 30 days.

Children

The site is intended for learners aged 16 and over. It is not directed at younger children, and we do not knowingly collect their personal data. If you believe a child has created an account, contact us and we will remove it.

Security

Passwords are hashed, traffic is encrypted with TLS, access to production data is restricted, and administrative actions are logged. No service is perfectly secure; if you spot a weakness, please report it responsibly using the contact on the ethics page.

Changes

If this policy changes materially, the “last updated” date will change and, where appropriate, signed-in users will be notified by email or an in-app notice.

What we collect

Account data: your name, email address, hashed password and, if you use social sign-in, the account identifier and profile image returned by that provider.

Learning data: lessons completed, quiz answers and scores, bookmarks, notes, streaks, badges and certificates.

Technical data: session records including IP address and browser user agent, kept to secure the service and investigate abuse.

Email delivery data: the address and message metadata needed to send verification and password-reset emails.

Why we process it

To provide the service (contract): creating your account, saving progress, issuing certificates and authenticating you.

To keep it secure (legitimate interests): rate limiting, abuse prevention, audit logs and session security.

To send essential email (contract or legitimate interests): verification and password-reset messages. We do not send marketing email.

Who processes data for us

We use a small number of infrastructure providers:

Vercel for application hosting and delivery.

Neon or Supabase for the PostgreSQL database.

Resend for transactional email, when configured.

Cloudflare for DNS.

These providers process data on our instructions and under their own data processing terms. Where data is transferred outside your region, the provider's standard contractual clauses apply.