Privacy Notice

SkillCoded can be used without an account and without optional analytics. This notice explains the limited personal data used when someone chooses a Google-authenticated account, saved progress, service improvement, security, support, and consent-gated Google Analytics.

Data, purposes, and legal bases

• Optional account and saved progress: a private SkillCoded username, Google account's stable identifier and verified email address, link method, authentication timestamps, sessions, quiz attempts, answers, scores, and duration. Google authentication is required only when you choose to create or use a SkillCoded account; public learning remains available without an account. SkillCoded does not store your Google password and does not use or store the name or profile picture supplied in the identity token. We use this information to create or access the account you request and to protect it under Articles 6(1)(b) and 6(1)(f) GDPR.
• Service improvement: signed-in lesson events, optional ratings, lesson suggestions, and cookie-free daily page totals. These help operate and improve the service under Article 6(1)(f) GDPR. The aggregate page counter creates no browser or account identifier and stores no IP address or complete referrer.
• Optional Google Analytics: only after you accept, Google Analytics measures sessions, traffic sources, sanitized public-page navigation, and allowlisted learning actions. It may receive a pseudonymous browser identifier, session state, sanitized page paths, public lesson/category slugs, approximate location, and browser/device information. The legal basis is your consent under Article 6(1)(a) GDPR. SkillCoded does not send usernames, email addresses, account or attempt identifiers, answers, scores, free text, URL queries or fragments, or user_id.
• Support and lesson suggestions: messages and structured details you choose to send are used to answer or evaluate your request under Article 6(1)(b) or 6(1)(f) GDPR, as applicable.
• Security and legal requests: limited session, timestamp, network, security-event, request, and correspondence data are used to prevent abuse, respond to incidents, and meet legal duties under Article 6(1)(f) or 6(1)(c) GDPR.

A private username and verified Google identity are required only if you choose an account. SkillCoded never links accounts by matching email. Legacy learners migrate once with their recovery code; existing administrators use their enrolled passkey. Neither path creates a SkillCoded password. Suggestion and support fields are required only for those optional features.

Cookies and similar storage

Signed-in accounts use one essential secure session cookie. The sign-in page uses Google Identity Services and a first-party, short-lived security nonce cookie for up to ten minutes. This account authentication is separate from optional analytics. A first-party preference cookie remembers your optional-analytics choice for 180 days. If you accept, Google Analytics may set _ga cookies for no more than 60 days from first set, without renewal on later page loads. Before acceptance and after rejection, no Google Analytics tag, Analytics cookie, or Analytics request is created. See the Cookie Notice.

Recipients and international transfers

• Hosting: Hosting provider pending, with the application hosted in Hosting region pending.
• Support email: only if you choose to contact the published support address, the mailbox providers involved process your message and delivery information.
• Google account authentication: when you choose to create, access, migrate, or reauthenticate a SkillCoded account, your browser communicates with Google Identity Services and Google supplies a signed identity assertion to SkillCoded. Google processes the Google Account interaction under its own privacy information. SkillCoded uses the assertion only for authentication and account security, does not request access to Gmail, Drive, Contacts, or other Google APIs, and does not combine authentication with Google Analytics or advertising consent.
• Transactional email: after an allowlisted Google account or security change, the transactional email provider and mailbox providers process the verified recipient address, fixed message content, and delivery information. These messages are not marketing.
• Optional analytics: only after you accept, limited measurement data is sent to Google Analytics. Google states that EU IP addresses are discarded before logging after being used for routing and approximate geolocation.

Google, the transactional email provider, and mailbox providers may process information outside the EEA. Google states that it uses adequacy decisions, the EU-U.S. Data Privacy Framework, or Standard Contractual Clauses where applicable. SkillCoded does not use Google Analytics for advertising or remarketing, does not sell personal data, and discloses information only to the providers above or where required by law.

Retention

• Account data and private learning history are kept while the account remains open. Sessions expire no later than 24 hours after sign-in. Pending suggestions are kept while they are reviewed.
• A legacy password hash may be retained temporarily for rollback, but this release never reads or accepts it. The hash is erased upon Google migration or final credential retirement.
• A Google identity link is kept while the SkillCoded account remains open and is deleted with the account. An unfinished Google registration or legacy migration expires after ten minutes and is removed by the next scheduled cleanup, no later than fifteen minutes after expiry. A legacy recovery-code hash is invalidated when migration succeeds. Transactional email delivery records are kept for up to 90 days.
• Application logs rotate under fixed limits. Incident or legal-claim records are ordinarily kept no longer than 12 months. Rolling backups are kept for 7 days.
• The analytics preference expires after 180 days and Google Analytics cookies after no more than 60 days from first set. GA4 user-level and event-level data is configured for two months with retention reset disabled. This setting does not cover standard aggregated reports.

Your choices and rights

You can reject optional analytics without losing any feature. Reopen Privacy and cookie settings in the footer to change your choice. Withdrawal stops future Google Analytics collection and removes the known Google cookies available to SkillCoded, but does not undo earlier processing.

You can review the connected Google identity in Account Security. Because Google is the sole account access method, it cannot be disconnected from an open SkillCoded account. Removing SkillCoded from your Google Account stops future authentication but does not delete data already held by SkillCoded. Reconnect access or contact support, and use the Google-reauthenticated export or deletion controls for data-rights actions.

You may request access, correction, deletion, portability, restriction, or object to processing based on legitimate interests. Contact Contact email pending. We may verify the request proportionately and normally respond within one month. You may also complain to Supervisory authority pending.

Changes

Material changes receive a new effective date and appropriate notice.