Privacy

This page describes what the site stores, why, and what anyone else can see. It covers the whole site, since there is nowhere else your data goes.

What we store

Creating an account stores your name, your email address, and a bcrypt hash of your password. We never hold the password itself and cannot recover it.

Working through the course adds more:

• Which lessons you have completed, and how many attempts each answer took
• Your exam attempts, the answers you gave, and the score
• Any certificate issued to you, with the name on it, the course, the hours, the capstone title and the date
• Messages you send through the contact form, with the name and email you put on them

If you ask to reset a password we store a hashed token that expires. That is the whole list. There is no profile, no behavioural tracking, and no attempt to work out anything about you that you did not type in.

What is public

Certificates are meant to be checked by other people, so the verification page is public. Anyone holding the serial can see the name on the certificate, the course, the hours, the capstone title, the issue date, and whether it has been revoked. Your email address, your answers and your progress are never shown there.

Nothing else about your account is public.

Why we store it

To run the thing you signed up for. Progress has to be remembered for a course to work, exam answers have to be recorded for a certificate to mean anything, and a certificate has to stay on file for verification to be possible after you graduate.

Cookies

One cookie, called ffa_session. It holds a signed token proving you logged in, lasts 30 days, and cannot be read by scripts in your browser. There are no analytics cookies, no advertising cookies, and no third-party scripts on any page.

How long we keep it

Account data stays while the account exists. Issued certificates are kept indefinitely, because a credential that stops being verifiable is worthless to the person holding it. Contact messages are kept while they are useful and deleted once handled.

Who else sees it

The site and its database run on servers operated by Hostinger, who can technically access what is stored there, as any host can. We do not sell data, share it with advertisers, or send it to analytics services.

Your rights

You can ask for a copy of what we hold about you, ask for it to be corrected, or ask for your account and its data to be deleted. Use the contact form. Deleting an account also deletes its progress and exam records.

Certificates are the exception worth stating plainly. If you ask us to delete an issued certificate, verification for it stops working, which is usually not what people want.

Security

Passwords are hashed with bcrypt. Session cookies are signed and marked http-only. Traffic runs over HTTPS. None of that is unusual, and none of it makes any site immune, so use a password you do not reuse elsewhere.

Changes

If this page changes, the date at the top changes with it. Substantial changes will be announced to account holders before they take effect.

Contact

Questions about any of this go through the contact form, or by post to P.O. Box 882, Montpelier, VT 05620, United States.