Privacy Policy

Who we are

e-xode Learning is published by e-xode (https://www.e-xode.net). For any question about this policy or your data, use the contact page.

Information we collect

We only collect what is needed to run the platform:

• Account: your email address, your name, and your password, which is stored only as a bcrypt hash. You may also upload a profile picture.
• Learning activity: your progress, scores, number of attempts, completion dates, and the answers you submit to exercises.
• Contributions: the rating, text and display name of any course comment you post.
• Subscription: your plan, its status and renewal date, and the customer and subscription identifiers assigned by Stripe. We never see or store your card number.
• Messages: the name, email and message you send through the contact form.
• Technical records: an event log (sign-up, sign-in, failed sign-in, lesson attempts, billing events, contact messages) that includes your IP address and the date, and the last IP addresses used to sign in to your account.

How we use it

We use your information to:

• create your account, verify your email with a one-time security code, and keep you signed in;
• deliver courses, grade exercises and save your progress;
• process payments and manage your subscription;
• send transactional emails such as verification codes and account notifications, and answer your messages;
• protect the service, for example with rate limits and by blocking abusive accounts or IP addresses;
• measure audience, only if you accept analytics cookies. We do not sell your personal data.

Cookies and local storage

We use a small number of cookies and browser storage entries:

• Session cookie (exode.learning.sid): keeps you signed in. It is HTTP-only, valid for 7 days, and only used for authentication.
• Theme cookie (theme): remembers your light or dark theme for one year. It is set when you change the theme.
• Browser storage: your language preference, the tips you have already seen, your cookie choice, and whether you dismissed certain banners. This stays in your browser.
• Analytics: when Google Analytics is enabled on the site, it starts with analytics storage denied. It is granted only if you accept in the cookie banner, and you can refuse.

Service providers

Some data is processed by third parties, only for the purpose described:

• Stripe processes payments and subscriptions. Your email address is sent to Stripe at checkout, and card details are entered on Stripe's pages and handled by Stripe.
• Google reCAPTCHA v3 protects sign-up, sign-in, the contact form and the AI assistant chat against abuse. When enabled, Google receives the signals needed to score the request.
• Email delivery: verification codes, notifications and contact messages are sent through our SMTP email provider.
• Anthropic provides the AI features. The questions you ask the AI tutor, the messages you send to the Spark assistant (including as a visitor), and answers submitted for AI grading are sent to Anthropic's API together with the relevant course context.
• Text-to-speech: by default, text is read aloud by your browser. If server-side voices are enabled, the text to read is sent from our server to Microsoft's speech service to produce the audio.
• Our database is a MongoDB database where all account and progress data is stored.

Retention and deletion

We keep your account and learning data for as long as your account exists. Sessions expire after 7 days, and security codes expire after 10 minutes.

There is currently no self-service button to delete an account. To delete yours, send a request through the contact page. Deleting an account removes the account and its learning progress; your course comments are kept but detached from your identity. Payment records held by Stripe are governed by Stripe's own retention rules.

Technical event logs are kept for security and troubleshooting purposes.

Your rights

You can ask us at any time to:

• give you access to the personal data we hold about you;
• correct it. You can already change your name, email address, password and profile picture from your account page;
• delete it.

Send your request through the contact page and we will answer as soon as we can.

Security

Passwords and security codes are stored hashed, the session cookie is HTTP-only, and sign-in and other sensitive endpoints are rate-limited. No system is perfectly secure, so we cannot guarantee absolute security.

Changes to this policy

We may update this policy as the service evolves. The date at the top of this page shows the latest revision.

Contact

Questions about this policy or your data? Reach us through the contact page.