Version 1 · effective 5 November 2026
Privacy Notice
Draft, pending legal review.
This notice covers this website, academyos.io, and the AcademyOS app atapp.academyos.io, with its sign-in service at auth.academyos.io. AcademyOS is in early access: only invited people can create an account. It is meant for adults; if you are under 18, please don’t sign up.
This website
The website has no accounts. To join the waitlist you email us, or, once the app is running, enter your email address in the form. The sign-in service stores it with the consent text you agreed to and when, and when you were invited, so we can tell you when you can sign up. Ask us and we remove it.
Cloudflare serves the website and, like any web host, receives your IP address and browser details to deliver pages and block attacks. Its fonts come from Google Fonts, so your browser also asks Google for them, which gives Google your IP address and browser details.
We count page views on the website with PostHog, in its EU cloud. It runs in a cookieless mode: it sets no cookies and stores nothing in your browser. From your IP address and browser details it computes an identifier that changes every day, so a visit is counted once per day; the address itself is not kept. We see totals such as page views, the pages read and the sites that sent visitors, not who you are, and it does not follow you across other sites. If your browser sends Do Not Track or Global Privacy Control, it does not load at all.
What the app keeps
- Your account: your name, email address and picture from Google or GitHub, whichever you sign in with, which of those accounts is linked, and when you last signed in. We use them only to sign you in: AcademyOS does not read your repositories, contacts or anything else in them.
- Your profile: anything you add, such as a headline, a short bio, links to your website, LinkedIn, GitHub or X, your language and time zone. It is private unless you choose to make it public.
- Your academies: which academies you belong to and your role in each, and the invitations you send or receive, including the invited person’s email address.
- Your learning: the courses you are enrolled in, how far you are in each lesson and when you started and finished it, your quiz answers, scores and attempts, and the certificates you earn.
- What you publish: courses, files and images you upload, such as a logo or an attachment.
- Server logs: each request to the app, with your IP address, the page asked for and the result, to run the service and keep accounts safe.
How we use it
To run AcademyOS: to sign you in, run the academies you belong to, show your progress to you and to the people who teach or manage your academy, issue certificates, and keep the service secure.
And to improve it: we may measure how the website and app are used, such as which features people use and where they get stuck, to decide what to build and fix. We look at this in aggregate, not to judge or target any one person. We don’t sell your data or show advertising.
The academy you learn in can see your name, enrollment, progress, quiz results and certificates, so its teachers can help you. An academy decides what it does with its own courses and members.
Certificates are public by design, so that anyone you show one to can check it: anyone with a certificate’s link or ID can see it, with your name, the course, the academy and the date. A public academy’s list of certified learners names only people whose profile is public, and counts the others without naming them.
Narrated lessons are read aloud by your browser’s own voices. AcademyOS sends nothing for this, but some browsers use voices that run on their maker’s servers, such as Chrome’s Google voices, under the browser’s own privacy policy.
Who else handles it
| Service | What it does with your data |
|---|---|
| Amazon Web Services | Hosts the app and its database, in Oregon, United States. |
| Cloudflare | Delivers the website and app, and blocks attacks; sees your IP address. |
| Google or GitHub | Signs you in, under their own privacy policies, when you choose them. |
An analytics service we use is listed here, with what it receives and where. We don’t share your data with anyone else, unless the law requires it.
Cookies
The cookies AcademyOS needs to work, all set by AcademyOS itself and readable only by it:
| Where | Cookie | Why |
|---|---|---|
| The app | __Host-sf_rp_session | Keeps you signed in, for up to 12 hours. |
| The app | __Host-sf_rp_state | Completes a sign-in safely, then expires. |
| The sign-in service | __Host-sf_login | Your sign-in at the sign-in service. |
| The sign-in service | __Host-sf_oauth_state, __Host-sf_oauth_client_state | Complete a sign-in with Google or GitHub safely, then expire. |
| The sign-in service | __Host-sf_signup_code | Holds your invite code while you sign up. |
| The sign-in service | __Host-sf_verify_email | Used while you confirm an email address. |
The lesson player also remembers your playback choices, such as narration on or off, in your browser’s storage; they stay on your device.
Analytics. Any cookie an analytics service sets is listed here, with the service itself underWho else handles it. We prefer tools that work without cookies. Where the law requires it, such as in the EU and the UK, we ask for your consent before setting an analytics cookie, and you can change your mind at any time. We never use advertising cookies.
How long we keep it
Your account, profile, learning records and certificates are kept while you have an account; nothing is deleted automatically. When you ask us to delete your account, we delete them within 30 days, including your certificates, which then stop being verifiable. A revoked certificate is kept, marked revoked, so a check shows it is no longer valid. Backups of the database and the server are kept for up to 7 days and then overwritten, so deleted data leaves them within a week after that. Server logs are kept only as long as needed to run and secure the service. Waitlist addresses are deleted when you ask us to remove them.
Your choices
- See and change your profile in the app at any time, and choose whether it is public.
- Stop AcademyOS’s access to your Google or GitHub sign-in in that account’s security settings.
- Ask for a copy of your data, a correction, or the deletion of your account, which the app doesn’t do by itself yet, by emailinghello@academyos.io. Where data protection law, such as the GDPR, gives you more rights, you can use them the same way, and complain to your data protection authority.
Changes
Each version of this notice is numbered and dated. Before a change that affects what we keep or who handles it, we publish the new version here and tell account holders.
Contact
Questions about privacy: hello@academyos.io.