What this site keeps, and what it never sees

The short version

Grading happens in your browser. Nothing you type into a cell is sent anywhere. The exercises need JavaScript, and they need no account.

If you create an account, this site stores your progress so it follows you to another device. That is the only reason a server is involved.

There are no analytics, no advertising and no third-party requests on this site. The only cookie is the one that keeps you signed in.

You can export everything as one JSON file, and delete the account and the data behind it, from your account page.

What stays in your browser

This site keeps six keys of its own in localStorage for the work you do signed out. They never leave the device unless you sign in. At that point the progress key is sent once, so your history survives the sign-in.

es.progress

Which exercises you finished, the last score, and whether you opened the answer

es.grace

That you used the one free pass past the wall

es.feedback

The note you typed in the feedback box

es.resume

The exercise you left half finished, so it reopens where you stopped

es.flashcards

The flashcard schedule: when each card is due next

es.shortcuts-banner

That you closed the keyboard-shortcut note

Clearing site data in your browser deletes all six, and the exercises keep working. Your browser decides how long they last. Nothing here expires them on its own.

What an account adds on the server

An account stores exactly these rows, and nothing else:

Account

Your email address, and the password the auth server stores as a hash you and we cannot read

Profile

A username, an optional display name, an optional LinkedIn URL, and a timezone

Progress

Per exercise: whether it is complete, the score, how many checks you missed, whether the answer was opened

Attempts

One row per screen you submitted, which is where first-try accuracy comes from

Points and streaks

The daily points total and the streak, both derived from the attempts above

Every row is scoped to your account by a row-level security policy. That is a database rule rather than a promise in the application code. A request carrying your session cannot read another learner's rows. Yours cannot be read by theirs.

Cookies, and why there is no banner

Signed out, this site sets no cookies at all.

Signed in, the auth server sets one first-party session cookie. It is the only way to know that the next request is still you, so it is strictly necessary. A consent banner exists to ask permission for cookies that are not. There is nothing here to ask about, so no banner is shown.

The same applies to storage: the keys above are this site's own functionality, not tracking. A banner offering to switch them off would have to switch the exercises off with them.

What this site never does

• No analytics script, and no page-view counter of any kind.
• No advertising or tracking cookie, and nothing that survives you closing the tab.
• No third-party font, stylesheet, image or script: every page loads only from this site.
• No profile built from your behaviour, and nothing sold or handed to a data broker.

The pages are checked for this mechanically: the build fails if any page, stylesheet or script refers to an origin other than this one.

Who else can see it

The database and the sign-in service are the Supabase project this deployment is configured against. They process the rows listed above on this site's behalf.

The host that serves the pages may keep access logs of requests, as any web server does. Nothing in this application reads those logs or joins them to an account.

The application writes its own operational lines: that a checkout started or failed, that a note arrived. They carry a plan name and an outcome, never an address, an account id or an IP. The host's log retention keeps them, not the database.

If you buy the track once billing opens, a payment processor (Stripe) handles the card. The card number never reaches this site. The processor returns an identifier and a payment record, which is the row listed under retention below.

There is no other recipient. Nothing is sold, shared for advertising, or sent to an analytics provider, because none is configured and none could be added without this page changing.

Taking your data out

Your account page has a download that returns everything in one JSON file: the profile, every progress row, every recorded attempt, points, streaks, and the entitlement and payment history. It is the same data the code reads, in a format you can compare.

The document also lists what would survive a deletion, so the copy in your hands and the copy on the server say the same thing.

Deleting your account

The same page deletes the account. It happens immediately, with no grace period to wait out and no support ticket to open.

Erased: the profile, every progress row, every attempt, the daily points, the streak, and any feedback you sent through the account.

Kept, unlinked from you:

Payment records

amount, currency, kind, refunded, date, tax and refunds have a legal life of their own, and a refund needs the payment it refunds.

Entitlement records

the plan, its status and when it ran out, it is what the payment bought, and it is what a dispute is argued from.

Nothing that names you

no name, no username, no email, no LinkedIn URL, no group, the profile row is deleted with the sign-in itself, and the kept rows are unlinked first.

Kept rows lose the link to your account in the same transaction that removes it. What remains is a payment and a plan with no person attached. Your email address and your name are gone with the profile.

Children

This is a study tool for people learning spreadsheets, and it is not directed at children under 13. This site does not knowingly keep an account for a child. If you believe a child has one, write to the address below and it will be deleted.

Changes to this page

This page is part of the repository and carries the date of the build you are reading. When what the code stores changes, this page changes in the same commit. A policy that drifts from the schema is a bug, not a revision.

Contact

Questions, corrections, or a deletion request: danil.gorbunofff@gmail.com.