Privacy Notice
This notice describes exactly what the site stores, where it is kept, and how to get rid of it. It is written to be checkable rather than comprehensive-sounding: everything below describes what the software actually does.
The short version. There is no analytics, no tracking pixel, no advertising, no third-party script of any kind, and nothing is sold or shared with anyone beyond the three processors named below that are needed to run accounts and payments. You can read the entire course without an account, and delete everything yourself at any time.
Using the course without an account
An account is optional. Without one, your progress — lessons completed, answers, exam scores, notes and bookmarks — is saved only in your own browser's local storage. It never leaves your device, and we cannot see it. Clearing your browser data erases it, and we have no copy.
What we store if you create an account
| What | Where | Why |
|---|---|---|
| Email address | Supabase authentication records, copied to your profile | Signing in, and password reset |
| Display name, if you give one | Your profile | Greeting you by name |
| Password | Supabase, hashed. This site never stores or sees your password | Signing in |
| Study progress: lessons completed, answers, exam scores, notes, bookmarks | Your progress record | The reason to have an account — your work follows you between devices |
| Signup date and last-active date | Your profile | So we can see how many people are using the course |
| Donation amount, date, type and the Stripe reference ids | Donation records | Receipts, and reconciling the books |
| Card number, expiry, CVC | Never sent to this site. Payment details go directly to Stripe and this site never receives them | — |
Who else processes your data
Three companies, each because something has to run somewhere:
- Supabase — hosts the database and the authentication system. Your email, profile and progress live here.
- Stripe — processes donations. If you donate, Stripe receives your name, email and payment details directly from their own payment form, and holds them under their own privacy policy.
- Resend — delivers the confirmation and password-reset emails. It handles your email address in order to send them.
The site's files are served by DigitalOcean, which keeps ordinary server access logs. Nobody else receives your data, and it is never sold, rented, or shared for advertising.
Cookies and tracking
No advertising cookies, no analytics cookies, no tracking pixels, no fingerprinting, and no third-party scripts. If you sign in, a session token is kept in your browser so that you stay signed in — that is what it is for and nothing else. Your theme preference and, if you are not signed in, your progress are also kept locally in your browser.
Deleting your account and your data
You can delete your account yourself, from the account page, without emailing anyone. Deletion is immediate and it removes:
- your authentication record and email address;
- your profile, including your display name;
- all of your study progress, answers, exam history, notes and bookmarks.
What is kept, and why: if you have donated, the donation record itself survives — the amount, the date, and Stripe's reference numbers — because a business has to be able to reconcile payments it has received. The personal link is removed: both your user id and your email address are cleared from that record at the moment you delete your account, leaving a payment that is no longer connected to a person. Stripe keeps its own record of the transaction under its own policy, and you can ask them about it directly.
How long things are kept
Your account and progress are kept until you delete them — there is no automatic expiry, because studying for a certificate can take months and losing someone's work would be worse than keeping it. Donation records are kept for as long as ordinary business and tax record-keeping requires, in the de-identified form described above once an account is deleted.
Your rights
Depending on where you live, you may have rights to see, correct, export or delete the personal data an organisation holds about you — for example under the California Consumer Privacy Act or the UK and EU GDPR. We will honour those requests regardless of where you live. Deleting your account from the account page already accomplishes the deletion; for anything else, email [email protected] and we will respond. We do not sell personal information, and we never have.
Children
An FAA remote pilot certificate requires you to be at least 16 years old, so this course is aimed at people 16 and over. It is not directed at children under 13, and we do not knowingly collect their personal data. If you believe a child under 13 has created an account, email us and we will remove it.
Security
Traffic is encrypted in transit. Passwords are hashed by Supabase and never reach this site. Payment details never touch this site at all. Access to the database is restricted at the row level, so one account cannot read another's progress. No system is perfect, and we will tell you promptly if something happens that affects your data.
Changes to this notice
If this changes, the date at the top changes with it. Material changes will be noted on the site rather than made quietly.
Contact
Delaware Valley Drones LLC, Pennsylvania, United States — [email protected].