Privacy policy

• We keep only what we need to run your account: your email address, your name if Google sends it, your lesson progress and what you bought.
• There are no passwords, and we never see your card number.
• We don't sell your information. There are no ad trackers on the site, and we don't use AI on your data.
• We email you about new courses only if you said yes. You can unsubscribe any time.
• You can ask to see, download or delete your data. Email [email protected].

Learnford is run by Dhaka Co (ABN 89 224 504 274), in Victoria, Australia. In this policy, "we" and "us" means Dhaka Co, which runs Learnford. To ask anything about your data, email [email protected].

For people in the EU and the UK: we are the "controller" of your data under the GDPR.

Your account

When you sign in with Google, Google sends us your name, your email address and an ID for your Google account. It also offers a link to your profile picture, which we don't keep. We never get your Google password or anything else in your Google account.

When you sign in with a code by email, we keep your email address.

We also keep how you signed in, the date your account was made, and your answer to "Do you want an email when new courses and free lessons come out?"

Sign-in codes

When you ask for a code, we keep your email address, a scrambled copy of the code and a scrambled copy of your network (IP) address. They limit how many codes can be sent, and we delete them after a day. Before a code is sent, Cloudflare Turnstile checks your browser to tell people from bots.

Your lessons

Signed in, we keep your progress: the lessons you opened and finished and the step you reached, your typing speed and accuracy, your bookmarks and the path you chose. The paid lessons you open also count toward the money-back guarantee.

Not signed in, your typing progress and a few settings stay in your browser. They move to your account when you sign in.

What you buy

Payments go through Stripe, and Link, a Stripe company, takes the payment (see Buying a course). We never see your card number.

We keep the courses you bought, the amount and the tax, the date, whether it was refunded, Stripe's IDs for the payment, and the email address you gave at checkout, so the course can reach your account. If you ask for a refund, we keep the date, and the reason if you give one.

How the site is used

We keep simple records of what happens on the site, with the date and time. For example: a lesson was started, a button on a course page was clicked, checkout was started. They show us where lessons are hard and how people find the courses. They are linked to your account or, if you're not signed in, to a random ID in a cookie (anon_id). They don't hold your name or your IP address.

Emails with us

If you email us, we keep the conversation so we can help you.

Visits

Cloudflare delivers the site and protects it from attacks. It sees your IP address, your browser and the pages you open, under its own policy. Our own server doesn't keep a log of visits.

What we don't keep

Passwords, card numbers, your location, or anything about your health, beliefs or other sensitive matters. We don't build ad profiles.

• To run your account and sign you in.
• To save your progress and give you the courses you bought.
• To handle refunds and keep tax records.
• To send your sign-in codes, and emails about your account or a purchase when we need to.
• To email you about new courses and free lessons, only if you said yes.
• To see where lessons are hard and how people find us, so we can improve them.
• To keep the site and your account safe.

For people in the EU and the UK, the legal reasons (the GDPR's "legal bases") are: providing what you asked for (your account, lessons and purchases); our legitimate interests (improving the lessons, keeping the site safe); your consent (the emails about new courses); and the law (tax records).

• Sign-in codes, when you ask for one.
• About your account or a purchase, when we need to. For example, a change to these policies.
• New courses and free lessons, only if you said yes. Turn them off any time with Unsubscribe on your Account page, or the unsubscribe link in the email.

Our emails come from addresses at learnford.com and are sent through Google Workspace. Receipts come from Link, which takes the payment.

We don't sell your information. These companies handle it to run Learnford:

• Hetzner runs our server and database, in Nuremberg, Germany.
• Cloudflare delivers the site, protects it from attacks and checks the sign-in form for bots.
• Google signs you in if you choose Google. Google Workspace sends our emails and holds our support inbox.
• Stripe and Link run checkout and take payments. They decide for themselves how they use payment details, under their own policies.

Their privacy policies: Hetzner, Cloudflare, Google, Stripe and Link.

We also share information when the law requires it, to stop fraud or abuse, or with a business that takes over Learnford, which must then keep to this policy.

Cookies are small files a website saves in your browser. We use the ones the site needs to work, and one for our own usage records. There are no advertising or tracking cookies.

• __Secure-authjs.session-token keeps you signed in. It lasts 30 days and renews while you use the site.
• Other authjs cookies protect the sign-in step. They last until you close the browser, or a few minutes.
• anon_id is a random ID for our usage records when you're not signed in. It lasts a year and is never shared.
• lf_checkout connects a payment to your confirmation page. It lasts a day.
• theme remembers your Appearance choice, if you pick Light or Dark. os remembers whether to show Windows or Mac shortcuts. Each lasts a year.
• Cloudflare may set __cf_bm or cf_clearance to tell people from bots.

Your browser's storage keeps a few things on your computer only: your typing progress when you're not signed in, your typing settings, text you add to Practice, and how you left the lesson panel.

Stripe, Link and Google set their own cookies on their own pages. You can block or delete cookies in your browser, but signing in won't work without them.

We don't track you across other websites, so the site works the same whether or not your browser sends a Do Not Track signal.

• Your account, progress and email choice: until you delete your account.
• Purchase records: 5 years after the purchase, even if you delete your account, because Australian tax law asks for it.
• Sign-in code records: a day.
• Usage records: 2 years.
• Emails with us: as long as we need them to help you and to keep a record of what we agreed.

When you ask us to delete your account, we delete your data within 30 days. Copies in our backups are gone within another 30 days.

Our server and database are in Germany, in the EU. We run Learnford from Australia and reach the data from there. Cloudflare, Google, Stripe and Link also handle data in the United States and other countries.

Where the law asks for safeguards when data leaves a country, we rely on the ones these companies offer, such as the EU's standard contractual clauses and the EU-US Data Privacy Framework. Email [email protected] for a copy.

You can ask us to:

• show you what we keep about you, and give you a copy;
• correct it;
• delete it, and your account; and
• stop the emails about new courses (or click Unsubscribe on your Account page).

Email [email protected] from the address on your account, so we know it's you. We answer within 30 days. We keep purchase records for as long as tax law asks, even after deleting the rest.

Refund checks. When you click Request a refund, the site checks the rule by itself, with no person involved. If you think it got it wrong, email us and a person will look.

EU and UK. You can also ask us to limit or stop using your data, object to how we use it, give you your data to take elsewhere, and withdraw your consent at any time. You can complain to your data protection authority. In the UK, that's the ICO.

Australia. If you're unhappy with how we handled a privacy question, you can complain to the OAIC.

United States. We don't sell your information or share it for advertising.

The site only runs over HTTPS. Sign-in codes and network addresses are stored scrambled. Only we can reach the server and the database. No system is perfectly safe: if a breach is likely to harm you, we'll tell you, and the authorities the law names.

Learnford isn't for children under 13, and they can't make an account. If you think a child under 13 has given us their information, email [email protected] and we'll delete it.

When this policy changes, the date at the top changes too. If a change matters, we'll tell you by email or on the site before it applies.

Learnford is run by Dhaka Co (ABN 89 224 504 274), in Victoria, Australia. Email [email protected].