Privacy

What we collect

When you create a Learning Harbour account, we hold:

• Your email address and name, and a hashed (never plain-text) password.
• An optional profile photo, if you upload one.
• Which courses you’ve enrolled in or saved, and your progress through each lesson.
• Your exam attempts, including the answers you submitted, your score, and whether you passed.
• Certificates issued to you (course, score, and the name you had at the time — see “Certificates are different” below).
• Achievement badges you’ve earned.

We collect only what’s needed to run the courses, track your progress, and issue verifiable certificates. A full field-by-field list is maintained internally (the “learner data inventory”) — email support if you’d like a copy.

Tracking and cookies

Learning Harbour keeps its own article counters, and they are first-party and aggregate. On an article page a small script posts to our own server to count a read once per browser tab session, and the share buttons report an aggregate share action for the platform used. Those counters are stored against the article, never against you: no account, name or IP address is recorded with them (an IP is used only, transiently, to rate-limit the updates).

The site also uses Cloudflare Web Analytics — Cloudflare’s cookieless, aggregate performance and visit measurement, delivered as part of how the site is hosted. It records aggregate page and performance data and does not use cookies or track you across sites; see Cloudflare’s data-collection documentation.

We do not run advertising or third-party tracking pixels — no Google Analytics, no Plausible, no PostHog. The cookies the site sets are Auth.js sign-in cookies: a session cookie once you’re signed in, plus a CSRF token and a callback-URL cookie that Auth.js uses to make the sign-in form work. None of them are used for advertising or to track you on other sites. We verified the app’s own scripts and cookies against the code and the live responses rather than assuming it — if that changes, this page needs updating before it changes, not after.

How long we keep it, and what happens if you leave

While your account is active, we keep everything above for as long as it’s useful to you: to show your progress, let you resume lessons, and prove you passed an exam.

You can download everything we hold about you, or delete your account, from your account data page. Deleting your account:

• Is a two-step process with a 24-hour cooling-off period — nothing is deleted until you confirm.
• Permanently deletes your enrolments, saved courses, lesson progress, and achievement badges.
• Replaces your name and email with anonymous placeholders, and your password stops working.
• Signs you out of every device immediately.

Certificates are different — please read this before deleting your account

If you’ve passed a course exam, we keep your exam attempt and any certificate issued to you, even after you delete your account. We can’t delete these outright: a certificate has to remain independently verifiable by anyone who checks it (an employer, for example), or the whole point of issuing one is defeated.

Concretely: your certificate keeps showing the name you had at the time you earned it, on the certificate itself and on its public verification page — deleting your account does not remove or anonymise that name. Everything else about your account (email, saved courses, lesson progress) is genuinely deleted or anonymised as described above; your issued certificates and the exam answers behind them are the one exception, kept for verification integrity.

If you don’t want that name to stay visible, you can choose to revoke your certificates when you request account deletion — tick “Also revoke my certificates” on the deletion form. A revoked certificate’s verification page reports it as revoked instead of showing your details, and its PDF stops working. Revocation cannot be undone, and a revoked certificate no longer counts as proof you passed — that’s the trade.

Your rights

You can access a full export of your data, or request deletion, at any time from your account data page — no need to ask us first. If you have a question this page doesn’t answer, or believe we’re holding something we shouldn’t, contact [email protected].

What this page is not

This is a plain-language summary of what the product actually does, written by the people who built it. It is not legal advice, and it does not assert compliance with GDPR, CCPA, or any other specific regulation — that requires a legal review this draft has not yet had. See Support if you need to reach us about anything on this page.