Privacy

T Academy is run by H2Security LLC, a company registered in Wyoming, United States. We decide what happens to your data. For anything on this page, e-mail security@h2security.io or use our contact form.

• Your account. Your name and e-mail address when you sign up, and the settings you choose (language, time zone, accessibility, the path you want to go deep in). We need these to give you an account and to sign you in. Your password and second factor are kept only by our sign-in service, and the password only as a salted hash: nobody, including us, can read it. The academy itself never receives your password.
• Your learning. Your progress, completed lessons and tasks, notes, review cards, the work you submit, and exam and practical attempts. This is the service itself: without it we cannot show where you are or what you have proven.
• Your labs. When you start and stop a lab, which objectives you met, and a record of lab activity needed to check your work and keep the labs secure. We do not store the text of what you type. A lab is deleted when you stop it or leave it idle.
• Payments. Payments are handled by our payment processor on its own checkout page. Your card details never reach our servers. We receive only what we need to know you have paid: your subscription and its status.
• E-mails. We send account e-mails, such as confirming your address or resetting your password, through our e-mail provider.
• Server logs. Like every website, our servers log requests: the address of your connection, your browser type, the page and the time. We use them to keep the service secure and working, and delete them after 30 days.

We use no advertising cookies, no analytics trackers and no third-party scripts in the academy.

• Sign-in cookies keep you signed in and protect the sign-in form. They are required for the academy to work and are deleted when you sign out or the session ends.
• Which site sent you. If you arrive through a link that names where it was posted (for example ?ref=reddit), we ask whether we may remember that. Only if you say yes do we keep that one word in a cookie, for up to 30 days, so we can count how many sign-ups each site brings. It holds no identifier and no personal data, it is never shared, and it is deleted as soon as you sign up. You can delete it at any time in your browser settings.
• Our company site, h2security.io, is served through our hosting provider's network, which sets a short-lived security cookie (__cf_bm) to tell people from bots.

We do not sell your data and we do not share it for advertising. Only providers we have chosen process it for us, under contract and only to run the service. The list of these providers is available on request:

• our hosting provider;
• our payment processor;
• our e-mail provider, for account e-mails.

Our ads on other sites send you to us with a plain link. No advertising pixel or tracker from those sites runs in the academy.

Our own servers are in the United States. Some of our providers also process data in other countries. If you are in the European Union, the United Kingdom or elsewhere, your data is therefore transferred outside your country to provide the service you signed up for. Wherever it goes, we rely on safeguards such as the EU-U.S. Data Privacy Framework or the European Commission's standard contractual clauses.

• Your account and learning record: as long as you have an account.
• Server logs: 30 days.
• Labs: until you stop them or they go idle.
• Payment records: as long as the law requires us to keep them.

You can ask us for a copy of your data, to correct it, to delete it, or to stop a use of it. E-mail security@h2security.io or use our contact form, and we will answer within one month. If you are in the European Union or the United Kingdom, you can also complain to your data protection authority.

When what we do with data changes, we update this page and the date below. If a change matters for your account, we tell you by e-mail first.