Privacy Policy
This policy explains what personal data ShadowStack collects, why we collect it, how we look after it, and the rights you have over it.
1.Who we are
ShadowStack (“we”, “us”) is a gamified IT-learning platform, based in the United Kingdom. ShadowStack is the “data controller” for the personal data described here. If you have any questions or want to exercise your rights, contact us at [[CONTACT EMAIL]].
2.What we collect
When you create an account and use ShadowStack, we hold:
| Data | Why we have it |
|---|---|
| Full name | To personalise your account. |
| Email address | To sign you in, verify your account and recover access. |
| Username | Your public handle, shown on the leaderboard. |
| Date of birth | To confirm you meet our minimum age. |
| Password | To secure your account. It is stored only in a hashed form by our authentication provider — we never see or store your actual password. |
| Learning data | Your level, XP, coins, course progress, unlocked skills, cosmetics and any lesson notes you write — so your progress is saved and follows you between devices. |
| Technical data | Some progress and settings are also cached in your browser’s local storage on your own device. |
We do not use advertising or third-party tracking cookies, and we do not sell your data.
3.Why we can use it (legal basis)
- To provide the service (performance of a contract): creating your account, saving progress, showing the leaderboard.
- Consent: which you give when you create an account and agree to this policy. You can withdraw it at any time by deleting your account.
- Legitimate interests: keeping the platform secure and working correctly.
4.Cookies & local storage
We don’t use tracking or advertising cookies. We use your browser’s local storage to remember your progress and preferences on your device, and our sign-in provider sets a cookie that is strictly necessary to keep you logged in. Fonts are served from our own servers, so loading a page does not share your details with any font provider.
5.Who we share it with
We only share data with the service providers (“processors”) that run ShadowStack for us:
- Supabase — hosts our database and handles sign-in and account storage.
- [[EMAIL PROVIDER, e.g. Resend]] — sends account emails such as confirmation and password resets (if enabled).
Our data is hosted in the [[SUPABASE REGION, e.g. EU (Frankfurt)]] region. Where any provider processes data outside your country, we rely on that provider’s approved safeguards for international transfers.
6.How long we keep it
We keep your account data for as long as your account exists. When you delete your account, your profile and learning data are erased. Backups, if any, are overwritten on a rolling basis.
7.Your rights
Under data-protection law you have the right to:
- Access a copy of your data — use Settings → Privacy & Data → Download.
- Erase your data — use Settings → Privacy & Data → Delete account.
- Rectify inaccurate data — edit it in Settings, or contact us.
- Port your data — the download is a machine-readable JSON copy.
- Restrict or object to certain processing, and to withdraw consent.
If you believe we’ve mishandled your data you can complain to your local supervisory authority (in the UK, the ICO; elsewhere, your national data-protection regulator).
8.Children
ShadowStack is not intended for children under 16. We ask for date of birth at sign-up and do not knowingly create accounts for anyone below that age. If you believe a child has created an account, contact us and we will remove it.
9.Changes to this policy
If we make significant changes we’ll update this page and the “last updated” date above, and where appropriate we’ll let you know in the app.
10.Contact
Questions about your data? Email [[CONTACT EMAIL]].