What we collect, and what we do not.

Every lesson published so far, the glossary, the toolkit templates and the read-only chain explorer work with no account and no email address. We do not require you to identify yourself to read anything.

There is no analytics on this site. No Google Analytics, no Plausible, no Vercel Analytics, no advertising pixel and no third-party tracker of any kind. We do not know which pages you read unless you are signed in and mark a lesson complete yourself.

Our host, Vercel, keeps ordinary server request logs including IP addresses, in the normal way that any web server does. We do not build profiles from them and we do not export them anywhere.

If you submit the form on the homepage or under a toolkit template, we store three things: the address you typed, which page you submitted it from, and the user agent string your browser sends with every request. Nothing else. We do not store your IP address with it.

That list has exactly one purpose, which is telling you when the gates, labs and credentials open. We will not send you anything else, we will not sell or share the list, and being on it grants no access to anything: it is a notification list, not a queue.

Being straight about the state of it: as of 8 August 2026 nothing that sends email to this list has been built. When it is, it will carry an unsubscribe link, and this page will name whoever we use to send it before a single message goes out.

To come off the list, email privacy@xdripacademy.com. We remove the row rather than flagging it.

An account stores your email address and a hash of your password. Authentication is handled by Supabase, which sends the six-digit verification and password reset codes. We never see your password.

Signing in sets a session cookie so that you stay signed in between pages. That is the only cookie this site sets. It is not used for tracking and there is nothing to consent to beyond staying signed in.

If you are signed in, the following is stored against your account, because each of these is something the site has to remember in order to be useful to you:

• Which lessons you have marked complete, and when.
• Your answers to the assessment items at the foot of a lesson, and whether each was correct.
• Your calibration runs: the answer and confidence you gave for each item, and the resulting scores.
• Your spaced repetition schedule. This is a reference to a lesson and a card number, never a copy of the card text.
• Your lab sittings: which lab, the seed the paper was generated from, and whether you passed.
• Artifacts you submit for review, the reviewer's per-criterion marks, and the note they wrote you.
• Trade simulation runs: the plan you committed to, the seed, and the orders you placed.

This is the record a credential would rest on, so it is kept for as long as your account exists. Nobody else can read it. Every one of those tables refuses a read from any account but yours at the database level rather than only in application code, and there is a test in this repository whose whole job is to prove that one learner cannot read, write or forge another learner's rows.

Aggregate counts across all accounts are visible to us on an internal admin page. Named learner work is visible to us only where the design requires it: an artifact you submit for review is read by a human reviewer, which is stated on the submission page.

The sandbox generates a practice wallet whose private key is written to your browser's local storage and never sent over the network. We do not have it and cannot recover it. It only ever signs on BSC testnet, where the funds have no value, which is the entire reason it is safe to hold a key this way. Clearing your browser storage destroys it, and that is by design.

• Supabase. Hosts the database and runs authentication, including the verification and password reset emails.
• Vercel. Hosts and serves the site, and keeps ordinary request logs.

That is the complete list. There is no email marketing platform, no CRM, no analytics vendor, no advertising network and no data broker in this stack. If one is ever added, it will be named here before it is switched on.

You can ask us what we hold about you, ask for it corrected, ask for it deleted, or ask for a copy of it. Email privacy@xdripacademy.com and we will do it. Deleting your account removes the learning record with it, because every one of those tables is keyed to your account and set to delete with it.

Being on the notification list and having an account are separate. Deleting one does not delete the other, so say which you mean, or say both.

When what we collect changes, this page changes in the same commit as the code, and the date at the top moves. We will not quietly widen what is collected and leave this page describing the narrower version.