Privacy notice

In short

• You can learn on Git Training without an account. Your progress then stays in your browser and never reaches us.
• With an account, we keep your email address (and your GitHub id and name if you sign in with GitHub), your progress, your settings and your Certificates, so your progress follows you. You can download it all, or delete it, at any time.
• To improve the course, we record anonymous Usage Events on our own server. They never include what you type and are never linked to you or your account. Global Privacy Control, Do Not Track or the “Don't send anonymous usage data” setting turns them all off. We delete them after 13 months.
• The only cookies are for signing in: the session cookie, and a short-lived one while you sign in with GitHub. There are no ads, no third-party trackers and no cookie banner.
• We keep 30 days of backups, so a deleted account normally takes up to 37 days to leave them.
• Questions? Email info@just-software.nl.

Who we are

Git Training is run by JusT Software, Bredaseweg 8, 4844 CL Terheijden, The Netherlands (“we”). We are the controller of your personal data: we decide what is collected and why. For anything about your data, email info@just-software.nl.

Without an account

Your Guest Progress (the Challenges you’ve completed, your Badges and Streak, the Hints you’ve revealed, the Challenges you’re in the middle of, and your settings) is kept in your browser’s storage, on your device. It isn’t sent to us.

When you sign up or sign in, your browser sends it to us once, to add it to your account. Signing out clears it from the browser.

What we store when you have an account, and why

We store these so you can pick up where you left off, on any device, and share your Certificates. The legal basis is providing the service you signed up for.

• Your account: your email address. If you sign in with GitHub, also your GitHub account id, your name and the address of your GitHub profile picture, as GitHub gives them to us, and the token GitHub issues when you sign in, stored encrypted. We never use that token to contact GitHub.
• Your sign-in sessions: a random session token, when it expires, and the IP address and browser that started it. A session ends when you sign out, or 30 days after you last used the site.
• Sign-in links: when you ask for a sign-in link by email, we keep your email address and a scrambled (hashed) copy of the link until it is used, or for at most 16 minutes if it isn’t: the link stops working after 15 minutes, and we delete both within a minute after that. If the site is down then, we delete them as soon as it is back.
• Your progress: which Challenges and Tracks you’ve completed and when, your best command count for each Challenge, when you first finished one at or under Par, the days on which you completed a Challenge (for your Streak) and the Badges you’ve earned. Your XP, Level and Streak are worked out from these, not stored.
• Your settings: Story, celebrations, animation speed, “Announce graph changes”, “Don't send anonymous usage data” and your timezone.
• Your Certificates: the name you put on each one, its Track, the date, the skills it lists and, on the Curriculum Certificate, your Level Title. Anyone with a Certificate’s link can see it. You can rename or revoke it at any time. If a Certificate page is reported and its name is abusive or isn’t the holder’s, we may revoke it: its page then stops working, and you can issue the Certificate again.

We never store the commands you type in the Terminal.

Emails you send us

If you write to us about privacy, accessibility or a Certificate, we keep your email address and what you wrote, to answer you. The legal basis is our legitimate interest in answering your message. We keep them until your question is settled, and at most 12 months after the last email between us.

Anonymous usage data

To learn where the course is hard and what to improve, the site sends anonymous Usage Events to Umami, an analytics tool we run on our own server, at this site’s own address. Nobody else receives them.

What is recorded

• Each page you view: its address without anything after a “?” or “#”, and the address of the page that linked you here, trimmed the same way. A Certificate page is recorded as /cert, without its id.
• What you do in the course, named by its Lesson, Challenge or Track: starting a Lesson; starting a Challenge, restarting it, and completing it (with the number of commands you used and whether you finished at or under Par); revealing a Hint (which one, by its position); opening a Walkthrough; starting a Checkpoint; passing a Test-out; typing a git command the Terminal doesn’t support (only the command’s name and a flag’s name, never what you typed after them); issuing a Certificate (which Track it is for); sharing a Certificate (whether you copied its link, shared it on LinkedIn or saved its picture, never which Certificate); viewing a Certificate page; and adding your Guest Progress to your account.
• Your browser, operating system, device type, screen size and language, as your browser reports them.
• Your approximate location (country, region and city), looked up from your IP address. Your IP address itself is never stored.

What is never recorded

Anything you type (commands, file names, messages), who you are, your account or your Guest Progress. Each browser tab makes up a random id when it opens and keeps it in memory only: it is never written to your device, never linked to your account or your Guest Progress, and it is gone when you close the tab. So we can follow one visit, never one person.

Why, and for how long

The legal basis is our legitimate interest in improving the course, which these anonymous records serve without identifying you. We delete them 13 months after they are recorded.

Turning it off

Any one of these stops every Usage Event, page views included, from being sent:

• Global Privacy Control (GPC), turned on in your browser;
• Do Not Track (DNT), turned on in your browser;
• the “Don't send anonymous usage data” setting on the settings page. It is kept with your account’s settings, or in your browser if you have no account.

Because Usage Events can’t be linked to you, we can’t find, show you or delete yours. Turning them off stops any more being recorded.

Cookies and your browser’s storage

We set only two cookies, both for signing in. The sign-in session cookie is set when you sign in and removed when you sign out. If you sign in with GitHub, a state cookie is also set while you do: it holds a random code that lets us check that GitHub’s answer is for the sign-in you started, and it lasts at most 5 minutes. Both are strictly necessary to sign you in and keep you signed in, so they need no consent, and there is no cookie banner. We set no analytics, advertising or third-party cookies.

The site also keeps your Guest Progress, your settings, the Challenges you’re in the middle of, your revealed Hints, the commands you typed in the Sandbox, which Story Scenes you’ve seen and any progress not yet saved to your account in your browser’s storage, so they survive a reload. They stay on your device until you sign out or clear the site’s data.

Who else handles your data

These companies handle data for us, for these purposes only:

• Mailgun sends the sign-in link emails. It receives your email address and the email. We use Mailgun’s EU region, so your address is processed in the EU and isn’t transferred outside it, and its open and click tracking is switched off.
• GitHub, only if you choose to sign in with GitHub. GitHub confirms who you are and gives us your GitHub account id, name, email address and profile picture address.
• Hetzner stores our database backups, in its object storage in the EU.

Umami runs on our own servers, so it is not one of them. Our servers, the database and its backups are all in the EU. We don’t sell your data or share it with anyone else.

Backups

We back the database up to Hetzner continuously, with a full copy every week, and keep 30 days of backups: enough to restore the database to any moment in the last 30 days after a failure. The backups hold everything in the database, accounts and Usage Events included.

Each weekly copy is kept until the one after it is 30 days old, so something deleted from the database, such as a deleted account, leaves the backups within 37 days. If a weekly copy fails, the one before it is kept until a new one succeeds, which can add a few days.

If we ever have to restore the database from a backup, we delete again every account we can find that was deleted after the moment we restored to. A failure that destroys the database can also lose its last few minutes, and an account deleted in those minutes would then come back without our knowing. If you deleted your account just before the site went down, email info@just-software.nl and we will delete it again.

How long we keep your data

• Your account, progress and settings: until you delete your account.
• Your Certificates: until you revoke them, we revoke them after a report, or you delete your account.
• Sign-in sessions: until you sign out. A session you never sign out of stops working 30 days after you last used the site, and we delete it within a minute after that, or as soon as the site is back if it is down then.
• Sign-in links: until they are used, and at most 16 minutes while the site is up.
• Guest Progress: in your browser, until you sign up, sign out or clear the site’s data.
• Emails you send us: until your question is settled, and at most 12 months after the last email between us.
• Usage Events: 13 months.
• Backups: 30 days of history. Anything deleted normally leaves them within 37 days (see Backups).

Your rights

• Download my data, on your account page, gives you all your account’s data as a JSON file: your account (name, email, linked GitHub account and sign-in sessions), progress, settings and Certificates.
• Delete my account, on your account page, deletes your account and everything linked to it at once, and signs you out on every device. See Backups for how long it takes to leave them.
• You can rename or revoke any of your Certificates at any time.
• You also have the right to a copy of everything we hold about you, to have it corrected or deleted, and to restrict or object to how we use it. Email info@just-software.nl for any of these, or for anything else.
• If you think we have handled your data wrongly, you can complain to a data protection authority, such as the one where you live.

Changes to this notice

When we change this notice, we change the date at the top of it.