This Privacy Policy explains how Dev Skill (“we”, “the Platform”) collects and uses personal data when you browse, study on, teach on, or buy from the Platform. It applies alongside our Terms & Conditions. If you have questions, write to support@devskill.example.

We collect what the service needs to work, and no more than that:

• Account data: your email address, a securely hashed password, your language preference, and sign-in records
• Profile data: your display name and, if you add one, your profile photo; for instructors and affiliates, the payout method details you register (stored encrypted)
• Learning data: your enrollments, lesson progress, quiz attempts and scores, watch statistics, and certificates
• Purchase data: your orders, payments, refunds, coupon usage, Credit Wallet balance, and — for earners — withdrawals
• Security data: IP addresses at sign-in, device fingerprints, and security events used to detect unauthorized access and abuse
• Communication data: the emails we send you (receipts, security notices) and, only if you subscribe, your newsletter membership
• Measurement data: how the Platform is used — see sections 4 and 5

We use your data to provide the service: to create your account and keep it secure, to activate and track your enrollments, to process payments, refunds, and payouts, to issue and verify certificates, to send transactional emails, and to detect and prevent fraud and abuse. We also use it in aggregate to understand how the Platform is used and to improve it. Marketing messages are sent only with your consent, and you can opt out at any time.

When you first visit, a consent banner lets you choose between third-party measurement categories. “Essential only” keeps strictly necessary cookies (sign-in, security, your consent choice itself) and loads nothing else; “Accept all” additionally enables analytics and marketing tags. You can change or withdraw your choice at any time from the “Cookie preferences” link in the footer — withdrawal takes effect as you navigate.

Third-party analytics and marketing tags (Google Analytics 4, and, for marketing, the Meta Pixel, Google Ads, and TikTok) load only after you grant their category. Before you grant it, no third-party measurement script is loaded at all. Your choice is stored in a cookie that lasts 12 months, after which we ask again.

Separately from the consent banner, the Platform keeps first-party, internal measurement of how our own service is used — pages viewed, courses browsed and searched, lessons started and completed, certificates issued, and purchases — tied to an anonymous visitor identifier. This is operational data about our own service, like server logs: it is not consent-gated, it is not used for third-party advertising, and it is not shared with ad networks. This disclosure is what the consent banner's “analytics” choice is about: only the third-party Google Analytics tag waits for your grant.

One honest limitation: search terms are stored as you type them so search can be improved. Free text can contain personal-looking words. We periodically review stored search text and scrub anything personal-looking, and we do not use it to profile you.

We share personal data only with providers that deliver the service: the payment processor that handles your purchases (they see what payment requires — we never see your full card details), the video provider that streams and protects course video, the email provider that delivers our messages, and our cloud hosting. Each processes data only to provide its service to us. We never sell your personal data.

We keep personal data only as long as it has a purpose. The main windows:

You can request deletion of your account from your account settings. The request is confirmed with your password and a single-use link emailed to you (valid for 24 hours) — confirming that link starts the deletion.

What deletion does, plainly:

• Deleted: your profile, preferences, and photo; your newsletter membership; your notification records; your active sessions, devices, and login history; the link between analytics rows and your account; your review display name (your reviews may remain, shown as anonymized)
• Kept, because the law or our accounting obligations require it: records of your orders, payments, refunds, and withdrawals; your certificates (so they keep verifying); your learning records; administrative audit records
• Guard: deletion is refused while money is encumbered — an open withdrawal, a remaining Credit Wallet balance, an open refund request, or a non-terminal order. Settle those first, then the deletion goes through

Transactional emails (order confirmations, security notices, refund decisions) are part of the service and are sent to your registered address. Marketing email (the newsletter) requires your explicit subscription through a double opt-in, and every issue carries an unsubscribe link that takes effect immediately. You can also manage notification preferences from your dashboard.

Data moves over encrypted connections. Sensitive fields — payout method details for instructors and affiliates — are encrypted at rest and shown masked. Privileged accounts require multi-factor authentication, administrative actions are permission-controlled and individually audited, and we monitor for unauthorized access.

We may revise this policy. Revisions are published as new numbered versions with their effective dates, listed on this page. Questions or requests: support@devskill.example.