This policy describes the data o30m Academy collects to operate the course, why it is collected, and how you can access or delete it. It reflects the current implementation. The service is operated from Maharashtra, India. This draft is published for owner and legal review and does not yet constitute final legal advice.
Jurisdiction and governing law
This policy and any data-processing dispute arising from your use of the service are governed by the laws of India, including the Information Technology Act, 2000, the Digital Personal Data Protection Act, 2023 (DPDP Act), and applicable sectoral regulations. The courts at Maharashtra have exclusive jurisdiction over such disputes.
Who operates the service
The service is operated under the name o30m Academy, based in Maharashtra, India. Privacy questions, data requests, and grievances can be sent to o30macademy@gmail.com. Under the Information Technology Act, 2000 and the Intermediary Guidelines, the designated grievance officer for this service is reachable at the same email address.
Data we collect
- Google account data. When you sign in, Google returns a stable account identifier, your email address, whether the email is verified, your display name, and your profile photo URL. We store these to create and identify your account.
- Session data. We store a hashed session token, a CSRF token, the session creation and expiry times, the last-seen time, and the browser user-agent string. The raw session token is stored only in an HttpOnly cookie in your browser.
- Learning data. We store lesson checkpoint attempts, module assessment attempts, scores, pass/fail results, and the timestamps needed to enforce the 30-second retry cooldown. We also store which lessons and modules you have completed.
- Sign-in state. A short-lived OAuth state record holds the state value, PKCE verifier, and the internal page to return to. It expires after ten minutes.
- Abuse-prevention data. Rate-limit records use a one-way hash derived from your network address and short time windows. The raw address is not stored in the application database.
- Operational logs. Cloudflare, our hosting and database provider, may process request logs and security events under its own policies. We do not control its retention periods.
Why we use it
- To authenticate you and keep your session secure.
- To deliver lessons and enforce the learning sequence on the server.
- To score checkpoints and assessments and record completion.
- To prevent abuse, replay, and excessive requests.
- To respond to support, privacy, and accessibility requests.
Legal bases
Where a legal basis is required, we rely on performing the service you requested (course delivery and account management), our legitimate interest in keeping the service secure, and compliance with applicable Indian law, including the Information Technology Act, 2000 and the Digital Personal Data Protection Act, 2023.
Cookies and analytics
We use two essential cookies: a session cookie and a short-lived OAuth state cookie. They are described in thecookie notice. We do not use advertising cookies or cross-site tracking. If a Cloudflare Web Analytics token is configured at build time, the site loads Cloudflare's cookieless analytics beacon; no analytics script is loaded when no token is configured.
Sharing
- Google processes the sign-in request and returns your profile data. Google's privacy policy applies to that interaction.
- Cloudflare hosts the site and stores application data in D1. Cloudflare processes data on our behalf under its terms.
We do not sell learner data, share it for advertising, or expose learner emails or progress publicly.
Retention
- Sessions expire after 30 days and are revoked on sign-out.
- OAuth state records expire after ten minutes.
- Assessment tickets expire after 15 minutes.
- Rate-limit records expire within short fixed windows.
- Learning records are kept until you delete your account.
- Account records are deleted when you use the account deletion control, subject to provider backups and legal obligations.
Security
Sessions use HttpOnly, SameSite=Lax cookies and are marked Secure in production. State-changing requests require a same-origin request and a per-session CSRF token. Answers are scored on the server, and answer keys are not sent to the browser before an attempt. No system is perfectly secure; see the project's threat model and known limitations for residual risks.
Your choices and rights
Under the Digital Personal Data Protection Act, 2023, as a data principal you may:
- Access. Request a copy of your personal data through the account export tool.
- Correct. Your name and photo come from Google. Update them in your Google account, or contact us.
- Erase. Delete your account and associated learning records using the account deletion control.
- Withdraw consent. Withdraw consent for processing by deleting your account or contacting us.
- Grievance redressal. Raise a complaint with our grievance officer ato30macademy@gmail.com. If unresolved, you may approach the Data Protection Board of India as provided under the DPDP Act, 2023.
- Export. The account page lets you download a JSON copy of your account, progress, and attempt data.
- Delete. The account page lets you permanently delete your account and associated learning records after typing a confirmation phrase.
- Other requests. Emailo30macademy@gmail.com.
Children
The course is intended for adults and professional learners. We do not knowingly collect data from children. If you believe a child has created an account, contact us so it can be removed.
Changes
We will update this page when the implementation or legal review changes. The date at the top of the page records the latest revision.
Contact
o30m Academy
Email: o30macademy@gmail.com