What we collect, and what we do not.

Every lesson published so far, the glossary, the toolkit templates and the read-only chain explorer work with no account and no email address. We do not require you to identify yourself to read anything.

This site uses Vercel Web Analytics, which counts page views in aggregate so we can see how much each page is read. It sets no cookie, collects no personal data, and does not build a profile of you or follow you across sites. There is no Google Analytics, no advertising pixel and no other third-party tracker. A page view is never tied to a person, so we still do not know which pages a specific reader read unless they are signed in and mark a lesson complete themselves.

Our host, Vercel, keeps ordinary server request logs including IP addresses, in the normal way that any web server does. We do not build profiles from them and we do not export them anywhere.

If you submit the form on the homepage or under a toolkit template, we store three things: the address you typed, which page you submitted it from, and the user agent string your browser sends with every request. Nothing else. We do not store your IP address with it.

That list has exactly one purpose, which is telling you when the gates, labs and credentials open. We will not send you anything else, we will not sell or share the list, and being on it grants no access to anything: it is a notification list, not a queue.

When you join, we send one message confirming it. It is plain text, it carries the address below for coming off the list, and it repeats that being on the list unlocks nothing. Beyond that we send a short note when a course, lab or teardown goes up.

That mail is sent by Resend, named in the processor list below. This page was updated to name them before the first message went out, which is what the previous version of this section promised would happen.

To come off the list, reply to any message we send you or email academyprivacy@xdrip.io. We remove the row rather than flagging it.

An account stores your email address and a hash of your password. Authentication is handled by Supabase, which generates the emailed verification and password reset codes and hands them to Resend to deliver. We never see your password.

Signing in sets a session cookie so that you stay signed in between pages. That is the only cookie this site sets. It is not used for tracking and there is nothing to consent to beyond staying signed in.

Enrollment is open in the United States, Canada, the United Kingdom, the European Union and EEA, Switzerland and Australia, and to adults only. At signup and on every lab page the country the platform attaches to the request is compared against that list. It is read and compared, never stored. When you create an account you confirm you are 18 or older, and that confirmation is recorded as the first of your acknowledgments, below.

Some things open only after you accept a statement: the age confirmation at signup, the acknowledgment of base rates before the Senior year, and the consents to the Gauntlet labs. Each acceptance is stored against your account as the exact text you were shown, its version, a hash of it, and the time. Withdrawing one is a second timestamp on the same row, not a deletion, so the record of what you consented to and when you withdrew it survives.

The Gauntlet consents also store a hash of a stop code you are shown once. Posting the code to the stop page withdraws them without signing in. We store the hash and cannot recover the code.

No lab captures your voice. The Gauntlet's voice notes are spoken in a synthetic voice that belongs to nobody, generated once from a written script and stored as a file; nothing about you is recorded, and no biometric identifier is ever collected. That is written into the consent itself, which you can read on your account page.

If you are signed in, the following is stored against your account, because each of these is something the site has to remember in order to be useful to you:

• Which lessons you have marked complete, and when.
• Your answers to the assessment items at the foot of a lesson, and whether each was correct.
• Your calibration runs: the answer and confidence you gave for each item, and the resulting scores.
• Your spaced repetition schedule. This is a reference to a lesson and a card number, never a copy of the card text.
• Your lab sittings: which lab, the seed the paper was generated from, and whether you passed.
• Artifacts you submit for review, the reviewer's per-criterion marks, and the note they wrote you.
• Trade simulation runs: the plan you committed to, the seed, and the orders you placed.
• Gauntlet runs: the channels you nominated, the address the emails went to, the seed, and every message the Academy sent you in the run with the time it was sent, whether you reported it, opened its link, or acted on its page, and which field you filled if you did. Never what you typed: the landing pages keep nothing.

This is the record a credential would rest on, so it is kept for as long as your account exists. Nobody else can read it. Every one of those tables refuses a read from any account but yours at the database level rather than only in application code, and there is a test in this repository whose whole job is to prove that one learner cannot read, write or forge another learner's rows.

Aggregate counts across all accounts are visible to us on an internal admin page. Named learner work is visible to us only where the design requires it: an artifact you submit for review is read by a human reviewer, which is stated on the submission page.

The sandbox generates a practice wallet whose private key is written to your browser's local storage and never sent over the network. We do not have it and cannot recover it. It only ever signs on BSC testnet, where the funds have no value, which is the entire reason it is safe to hold a key this way. Clearing your browser storage destroys it, and that is by design.

• Supabase. Hosts the database and runs authentication, including generating the verification and password reset codes.
• Vercel. Hosts and serves the site, keeps ordinary request logs, and provides aggregate page-view analytics (Vercel Web Analytics), which sets no cookie and holds no personal data.
• Resend. Delivers every email this site sends, which means the verification and password reset codes and anything sent to the notification list. They receive the address the message is going to and the message itself, and they keep a delivery log.

That is the complete list. There is no CRM, no advertising network and no data broker in this stack. The only analytics is aggregate, cookieless page-view counting, and it runs on Vercel, our existing host, so it adds no new processor. Resend is a sending provider and we use it as one: we do not run campaigns, score opens, or track whether you clicked anything. If any of that changes, or another processor is added, it will be named here before it is switched on.

You can ask us what we hold about you, ask for it corrected, ask for it deleted, or ask for a copy of it. Use the request form or email academyprivacy@xdrip.io. Both reach the same place, and you need no account for either. Deleting your account removes the learning record with it, because every one of those tables is keyed to your account and set to delete with it.

The form is the better route, and not for our convenience. It puts your request in a queue with the date on it, which is what lets us show a request was answered rather than only say so. It also sends you a copy of what you filed, so the record is not ours alone. We answer within thirty days.

Being on the notification list and having an account are separate. Deleting one does not delete the other, so say which you mean, or say both.

When what we collect changes, this page changes in the same commit as the code, and the date at the top moves. We will not quietly widen what is collected and leave this page describing the narrower version.

Every address on this page is academyprivacy@xdrip.io, which is xdrip.io and not xdripacademy.com. That is deliberate and worth explaining, because this site spends a course teaching you to treat a contact address on a domain that does not match the site as a warning sign.

XDRIP Academy is part of XDRIP, and xdrip.io is the company domain. It already runs mail; the academy domain does not, and standing up a second mail service only to answer privacy requests would add a processor to the list above for no benefit to you.

The general rule still holds, and you should keep applying it. The difference is that you are reading the claim here, on the site itself, over HTTPS, rather than being told it by an email that arrived asking you to trust it. That is the check: verify the address from the source, never from the message.