Privacy Policy
This Privacy Policy explains what data we collect when you use the website and the "Beyond the Rules" course, why we use it, and how we protect it. We collect only what is needed to run the Course and give you access to it.
1. Who is responsible for your data
The data controller is Noam Brand, the operator of the "Beyond the Rules" course, of 26 HaRav Aberbuch St, Ramat Hasharon 4740020, Israel. For any privacy question you can reach him at noambbb@gmail.com.
2. What data we collect
We collect a small amount of data:
- Email address. This is the main piece. It is used to sign you in (without a password) and to identify your access to the Course. We send sign-in links and service messages to it.
- Purchase record. Confirmation that you bought, when your access starts and when it ends. The payment details themselves reach us from Lemon Squeezy.
- Course progress. The progress you save in the Course, such as which parts you finished, so you can continue where you left off.
- Activity inside the Course. We record what is opened and what is solved: which ideas you opened, which puzzles you attempted and solved, and when you signed in. This is what lets us see where people get stuck and fix the parts that are not working. We look at it to improve the Course, not to track you personally.
- Display name. When you signed up you were given a random name of the form UserName4821, which you can change in Settings. That name, together with how many puzzles you have solved, is shown to other learners on the leaderboard inside the Course. You choose the name and it is never derived from your email address, and your email address is never shown to any other learner. A switch in Settings takes you off the board entirely.
- A hash of your IP address. To protect the sign-in system from abuse, we store a salted SHA-256 hash of the IP address a sign-in request comes from. It is used only to rate-limit requests. The raw IP address itself is never stored on our side.
We do not collect passwords (there are none), and we do not collect card numbers or bank details. Payment is handled by Lemon Squeezy, and from them we receive only confirmation that the transaction went through, plus what we need to manage your access.
3. Why we use your data and on what basis
- To give you access to the Course and identify you at sign-in. Basis: performance of the contract between you and us.
- To save your progress and restore it on your next visit. Basis: performance of the contract.
- To improve the Course, based on what is actually opened and solved, so we can find where people get stuck. Basis: our legitimate interest in improving the service.
- To protect the sign-in system from abuse (rate-limiting via the IP hash). Basis: our legitimate interest in running a secure service.
- To send service messages, such as sign-in links, a reminder before your access ends, or notice of a material change. Basis: performance of the contract.
- To meet legal obligations, such as keeping records for tax and accounting. Basis: a legal obligation.
We do not send you marketing email without your separate consent, and we do not sell your data or share it for advertising.
4. Who we share data with
We rely on a small number of service providers, each of which processes data only on our instructions and only as needed:
- Lemon Squeezy handles payment, invoicing and VAT as the Merchant of Record. Payment details go to it directly.
- Cloudflare hosts the site and the database (using Workers and D1) and processes requests to the site.
- Resend sends our service emails for us, including the sign-in links.
- Advisors and authorities, such as an accountant or a competent authority, where required by law or to run the business.
5. International transfers
Some of our providers operate from servers outside Israel and outside the European Economic Area, including in the United States. When data is transferred there, the transfer relies on the safeguards in those providers terms, such as Standard Contractual Clauses. You can contact us for more details.
6. How long we keep your data
- Email, access record, course progress and in-course activity: while your access is active, and for a reasonable period afterward, unless you ask us to delete it sooner.
- Purchase and billing records: for the period the law requires for tax purposes (typically up to 7 years).
- The IP address hash: only for a short period, as needed for rate-limiting, after which it is deleted.
After these periods, data is deleted or irreversibly anonymized.
7. Your rights
Subject to applicable law, you have the right to:
- Get a copy of the data we hold about you;
- Correct data that is wrong or incomplete;
- Ask us to delete your data, except where we must keep certain data by law;
- Object to processing based on legitimate interest, or ask us to restrict it;
- Receive your data in a common, readable format.
To exercise any right, write to us at noambbb@gmail.com. We will respond within a reasonable time. If you believe we did not handle your request properly, you may lodge a complaint with the data protection authority where you live.
8. Security
We use reasonable technical and organizational measures to protect your data, including an encrypted connection (HTTPS) for all communication with the site, access limited to those who need it, and storing IP addresses as a salted hash rather than as visible text. No system is completely secure, but if we become aware of a security incident affecting your data, we will act as required and notify you and the competent authority to the extent the law requires.
9. Children
The Course is not intended for children under 16, and we do not knowingly collect data from children. If you learn that a child has given us data, contact us and we will delete it.
10. Changes to this policy
We may update this policy from time to time. The updated version will be posted on this page with a new effective date, and for a material change we will notify you by email.
11. Contact
For any question about your privacy, write to us: noambbb@gmail.com.