Privacy
Index Ai Academy (“we”) is run by Luke McLaughlin in the United Kingdom, who is the data controller. Questions or requests: support@indexhalo.com.
What we collect
- Your account: name, email, username, a scrambled (hashed) password, and, if you give them, your job title and how you heard about us. We record whether you agreed to course emails.
- Your learning: lessons started and finished, every quiz answer you give (the option you chose or the text you typed, and whether it was right), the code you run and check in exercises and the result, the hints you open and the kind of automatic hint your code got, how long you spend on each part of a lesson and how far you read, the parts you ask to have explained more simply, your searches in the app, your placement test answers, the plan you build (your goal, starting point and hours a week), your review cards and study time. We use it to adapt the course to you and to find the parts of lessons that need improving.
- Your notes: the notes you write under lessons are saved with your progress. The academy's team can read them, to see what's unclear and improve the lessons.
- AI tutor questions: the questions you send to the tutor and the lesson you were on, to improve the lessons and the tutor.
- AI use: for each request to the AI model (the tutor, answer grading, practice questions, and lesson code that calls the model), its type, the lesson, how many tokens it used, its estimated cost and whether it worked, so we can keep the academy's AI spending within its budget.
- Account activity: when you signed up, signed in and were last active, security changes such as password resets, and the emails we sent you (their type and whether they were delivered, not their content).
- Your device and connection: when you sign up, sign in, and once a day when you use the site, we record your IP address, your approximate location worked out from it (country, region and city), and your browser, operating system and type of device. When you sign up or sign in we also record a security fingerprint of the device: a code calculated from what your browser reports about itself (such as screen size, time zone and language), so we can spot many accounts being made from one device. Nothing is stored on your device for this. If you allow usage analytics or session recording, the same fingerprint is also added to your daily visit and to your recordings, so returning devices can be told apart even after browser storage is cleared.
- Where you came from: the referring website and campaign tags (such as utm_source) of the link that first brought you here, so we know which channels work.
- Visitors without an account: your progress stays in your browser, and your browser gets a random visitor ID. Your learning activity (as above) and device and connection details are recorded under that ID. If you later create an account or sign in on the same browser, that history joins your account.
- The model you can teach on the home page: it trains in your browser, and text you paste for it stays there. We count that a model was trained, how long it took, its score and which kind of text it read, never the words themselves. If you keep the model, its numbers, its name, the lines it wrote and any text you gave it are saved with your account, so you can use them on your other devices.
- Your model's page, only if you share it: from Baby AI you can publish a page for the model you taught, at a link only you share. It shows the model's name, the kind of text it read (never text you pasted), how long it took, its score and the lines it wrote. It shows nothing about you, not your name, email or username. It isn't listed in search engines. Publishing again refreshes the page, you can take it down any time, and it's deleted with your account.
- Lesson feedback: your answer to “Was this lesson clear?” and any note you add.
- A welcome email, once: when you confirm your email, one message with the three ways to start.
- Course updates, only if you tick the box: if you ask for news about new lessons and course updates (at sign-up or in Account), we use your email, when you confirmed it and your progress to send three short emails in your first week, one, three and seven days after you confirm, each naming your next lesson, and occasional news after that. We record how many have gone out and when. Every one has a one-click link to stop them.
- Study reminders, only if you turn them on: we use your email, your last activity date and your progress to send at most one short email a week naming your next lesson. Every email has a one-click link to stop them.
- The weekly summary, only if you turn it on: we use your email and your study log and progress to send one short email on Mondays about your past week, your reviews and your next lesson. Every email has a one-click link to stop it.
- Certificates, only if you claim one: your name, the phase and the date, shown on a page at a link only you share. It isn't listed in search engines, and it's deleted with your account.
- Counts with no identifier: views of the public course, lesson and glossary pages, clicks on “Start this lesson”, and how long the app takes to load.
- Totals of every request to our server: like any web server, ours sees each request, including if you've said no thanks. We add it to daily totals: the page, the answer and how long it took, the referring site and page, campaign tags in the address and the name of an ad platform if its click ID is there, your country, language, browser, operating system and type of device, whether you're in another app's browser, and whether your browser asks not to be tracked. Outside the EEA, the UK and Switzerland, the totals also count your region, city and network. Your IP address is used for a moment to work out the location and network and isn't kept. Nothing in these totals identifies you or ties one request to another. The most recent few hundred requests, with the same facts and the time, also stay in the server's memory for a live view until its next restart.
- Error reports: when one of this site's pages hits an error, your browser sends the error message, the page's address without any query string, and the browser's name and version. Emails are removed. We keep the most recent few hundred.
- Visits: on our own server we count the pages you open, how long they're in view, how far you scroll, which features you use, and where the visit came from (including the referring page, campaign tags, an ad platform's name and any app you're browsing inside). We also count the site of a link you follow out, the type of a file you download, and that you copied text, started a form, printed a page or clicked one thing repeatedly: never the words you copied or what you typed. Your IP address is used once, to work out your approximate location and network, and isn't kept with these records. If you've said yes, or you're outside the EEA, the UK and Switzerland, we also keep a random ID in your browser so we can tell return visits apart, along with your city, browser version, screen and window size, time zone and local time, pixel density, touch or mouse, connection speed, memory and processor cores as your browser reports them, light or dark and reduced-motion settings, and how the page was opened; if you're signed in, those visits are tied to your account. In the EEA, the UK and Switzerland, until you say yes, each page load counts on its own with no ID. If you say no thanks, nothing is sent. You can change this any time in Settings.
- Google Analytics: Google Analytics also measures visits and pages. In the EEA, the UK and Switzerland it keeps no cookie or identifier until you allow it; elsewhere it measures from your first page unless you say no. “No thanks” turns it off entirely.
- Speed: how quickly each page loaded and responded in your browser, with the page's section and whether you were on a phone, tablet or computer. Nothing identifies you, and nothing is sent if you've said no thanks.
- Session recordings, only if you turn them on: a recording of how you use the app: what's on the screen, scrolling, mouse movements, clicks and the keys you type (including in the code editor, quiz answers, the tutor chat, notes and search), with their timing. Password fields are never recorded, and the account forms (email, password, recovery codes, deleting your account) are left out entirely. The sign-in pages are never recorded. We use recordings to see where lessons and pages confuse people. They're stored on our own server and not shared with anyone. You can switch recording off, and delete your recordings, in Settings.
Why, and the legal basis
- To run your account and the course, including adapting it to what you know (contract).
- To keep accounts secure (for example the device fingerprint and IP address at sign-in) and to improve the course from how people use it: quiz answers, code, notes, tutor questions, time and location (legitimate interests). You can object; see Your rights.
- Analytics, visit records with an ID, session recordings, the device fingerprint on visits and recordings, and course emails (consent, which you can withdraw at any time). Outside the EEA, the UK and Switzerland, and for counts with no ID, visit records and speed reports rest on our legitimate interest in improving the course; you can object by saying no thanks.
Who processes it
- Railway hosts the site and stores the database.
- Spaceship (Spacemail) sends account emails such as verification and password resets.
- Anthropic processes messages you send to the AI tutor and code you run that calls the model, to produce a reply.
- Google Analytics: with your consent in the EEA, the UK and Switzerland, and elsewhere unless you say no.
- Locations are looked up in a copy of DB-IP's database kept on our own server, so your IP address isn't sent to anyone for this. IP geolocation by DB-IP.
We don't sell your data or use it for advertising.
How long we keep it
- Your account, learning activity, notes, code and tutor questions: until you delete your account.
- AI use records: 13 months. When you delete your account they're unlinked from you and kept only as totals for the monthly budget.
- Full IP addresses and browser details: 90 days, after which only the approximate location is kept.
- Visit records: 14 months, and they're deleted with your account. Speed reports: 30 days.
- Request counts: to limit how much one address can send, the server counts requests against your IP address in memory. These counts are never written to disk and are gone when the server restarts, and those for the practice API within a few minutes of your last request.
- Session recordings: 30 days, and at most 5 GB in all (the oldest are deleted first). Deleting them in Settings, or deleting your account, removes them straight away.
- Activity of visitors who never create an account: 12 months. Device fingerprints not linked to an account: 90 days.
- Deleting your account removes your account, progress, notes and all the activity above from the live database straight away. Daily backup copies of the database are kept for up to 8 weeks, so deleted data disappears from those as the copies are replaced; backups are used only to recover from faults. Records of administrator actions (an audit log) keep the account ID.
Your rights
You can download all your data (including your learning activity, notes, code, sign-in history and the emails we sent) and delete your account from Account in the app. You can also ask us to access, correct, restrict or erase your data, or object to how we use it, by emailing support@indexhalo.com. You can complain to the UK Information Commissioner's Office (ico.org.uk).