Privacy notice — Boot Level

Who we are

Avestan Studio LLC, a California limited liability company, which operates Boot Level, is the data controller for the information described here. Contact us at privacy@bootlevel.com.

What we collect

Data	Why	Lawful basis
Email address	Sign-in, password recovery, billing notices	Performance of a contract
Username, and any bio or country you add	Your profile and the leaderboard	Performance of a contract
Password, stored only as a scrypt hash	Authentication	Performance of a contract
If you turn on two-factor authentication: your authenticator app's secret, encrypted, the time of the last code you used, and your backup codes, stored only as keyed one-way hashes	Authentication — a second check at sign-in	Performance of a contract
Learning progress: lessons, labs, exams, projects, XP, badges	The service itself — showing you where you are	Performance of a contract
Subscription and payment records	Billing, and statutory accounting	Contract, and legal obligation
IP address, briefly, as a rate-limiting counter	Preventing brute-force attacks on accounts	Legitimate interests — securing the service
Server logs	Diagnosing faults	Legitimate interests — keeping the service working
Error reports, when something breaks — see below	Finding and fixing faults	Legitimate interests — keeping the service working
Usage statistics, counted without cookies — see below	Knowing which pages are used, and how many people sign up and subscribe	Legitimate interests — improving the service

Usage statistics

We count visits with Umami, which we run ourselves on our own server: the statistics are never sent to an analytics company. It sets no cookies and writes nothing to your device — it only reads one setting, in your browser's storage, that would switch it off.

For each page view it records the page's address (without anything after a ?, and with record numbers removed), its title, the page or site you came from (also without anything after a ?), your browser, operating system, device type, screen size and language, and an approximate location — country, region and city — looked up from your IP address.
Your IP address is used, together with your browser's user agent and a secret that changes every month, to work out an anonymous visitor code, so that one person reading ten pages counts once. The address itself is not stored, and the code cannot be turned back into it or linked to your account.
Five events are counted by our server: a sign-up, the start of a free trial, the start of a checkout, a purchase and a cancellation. Each carries at most the plan, the payment provider, the kind of plan change (new, upgrade or at renewal) and, for a sign-up, whether it came with a trial. None carries your account, your email address or your IP address.
If your browser sends Do Not Track or Global Privacy Control, your page views are not counted at all. Administrators' visits are never counted.

Error reports

When the site fails — an error in our code, on our server or in your browser — a report goes to Sentry, an error-monitoring service, so that we can find and fix it.

A report holds the error message and where in our code it happened, the page address without anything after a ? (password-reset and verification links keep their codes there), your browser and operating system, and the last few steps on the page before the error — pages visited and buttons pressed.
Before it leaves, it is stripped of email addresses, cookies, passwords, access codes and anything typed into a form. Reports from your browser travel through our own server, which does not pass on your IP address, so Sentry never receives it.
We also send timing measurements for a small sample — one page load in twenty — to see where the site is slow. We do not record your screen or your session.

What we do not do

No advertising, and no sale or sharing of personal data with advertisers.
No third-party analytics or tracking scripts. The usage statistics above are counted on our own server, and nobody else sees them.
No profiling, and no automated decisions with legal or similar effects.
Code you write in the exercises runs entirely in your browser and is never sent to us.

Cookies

One cookie, dva_session. It holds a signed session token so you stay signed in, is httpOnly and SameSite=Lax, and lasts 30 days. It is strictly necessary for a service you asked for, so it needs no consent banner. If you use two-factor authentication, a second one, dva_2fa, exists only between your password and your code: it is signed, httpOnly, lasts five minutes and is cleared once you finish signing in. We set no other cookies — the usage statistics and error reports set none either. Your browser may also store display preferences locally; those never reach us.

Who else sees it

PayPal processes payments. We never receive or store card details. PayPal is a controller in its own right for what it collects.
Our email provider delivers verification, password reset and billing messages, and therefore handles your address.
Our hosting provider operates the servers the data sits on — including the usage statistics, which are not shared with anyone else.
Sentry (Functional Software, Inc., United States) receives the error reports described above, as our processor, and stores them in the United States. It uses them only to show them to us.
Have I Been Pwned checks whether a new password appears in a known data breach. Only the first five characters of a SHA-1 hash of it leave our server — never the password, and never the whole hash — so the service cannot tell what the password is, or whose it is.

Nobody else. We do not sell or rent personal data, in any sense of either word.

How long we keep it

Account and progress data: until you delete your account.
Payment records: six years after the transaction, because tax law requires it. That obligation continues after you delete your account, so those records are kept in an anonymised form with nothing identifying you.
A one-way, keyed hash of your email address, kept after you delete your account so the same address cannot start a second free trial. It cannot be turned back into your address, and it is used for nothing else.
Rate-limiting counters: hours.
Password reset tokens: one hour. Verification tokens: 24 hours.
Two-factor data: until you turn two-factor off or delete your account. A sign-in waiting for its code: five minutes.
Server logs: 30 days.
Error reports: deleted by Sentry after 90 days at most.
Usage statistics: kept as totals for as long as they are useful. They contain nothing that identifies you, so keeping them does not keep anything about you.

Your rights

You can see, correct, export or erase your data, object to processing based on legitimate interests, and complain to a supervisory authority — in the UK, the Information Commissioner's Office.

Two of these are built into the product rather than being a request you have to make: your account page exports everything we hold as a JSON file, and deletes your account immediately. For anything else, write to privacy@bootlevel.com; we reply within one month.

Where it is stored

Our servers are in the United States (Boston, Massachusetts), and off-site backups are held with Cloudflare R2. If you are in the UK or EEA, your data is therefore processed outside it, and that transfer relies on standard contractual clauses.

Security

Passwords are hashed with scrypt at above-guidance cost parameters, and a new password is checked against known breaches as described above. Two-factor authentication with an authenticator app is available to everyone and required for administrators; its secrets are encrypted at rest. Sessions are signed and can be invalidated everywhere at once. Sign-in attempts are rate limited. The site sets a strict Content Security Policy. Data is encrypted in transit. Backups are taken, verified as restorable, and kept off-site.

If a breach is likely to put you at risk, we will tell the supervisory authority within 72 hours of becoming aware of it, and tell you without undue delay.

Children

The service is not intended for under-16s and we do not knowingly hold their data. If you believe a child has registered, write to privacy@bootlevel.com and we will remove the account.

Changes

Material changes will be announced by email before they take effect. The date at the top always reflects the current version.