Skip to content
Platform

Privacy Policy

Every category of information we hold, who sees it on ACADA, every company that processes it, how long each thing is kept, what we never do, and how to download, correct or delete yours.

Last updated on October 26, 2026.

We collect what it takes to run an account, deliver courses, pay people and keep the site safe, and nothing for advertising. We do not sell your information, share it for ads, track you across other sites, or use anything you post to train AI. Your profile is public unless you are under 18; your notes are private to you; your messages go to the people in the conversation. What you do here is stored in the United States by Supabase and Vercel; payments go through Stripe or PayPal; email through Resend; errors to Sentry; the Assistant to Anthropic. You can download everything we hold on you from Settings, correct it, and delete your account, which deletes it. This page lists every category of information, every company that sees it, how long each thing is kept, and how to exercise your rights.

This summary is for orientation only. The sections below are the operative terms.

1. Who we are and what this covers

ACADA L.L.C., a Tennessee limited liability company (ACADA, we) runs acada.ac and is the controller of the personal information described here. This policy covers acada.ac, the emails we send, and the information we hold about members, visitors and people who contact us. It does not cover other companies' sites you reach through links here, or how an instructor uses information you give them directly outside ACADA. Cookies have their own policy, the Cookie Policy, which this one incorporates.

Personal information means anything that identifies you or could, alone or with other things we hold. Where this policy says we "keep" something, section 9 says for how long; where it says who "sees" something, section 5 covers people on ACADA and section 6 covers companies that work for us.

2. What we collect

Your account

Your email address, a password (stored only as a hash by Supabase, never readable by us), your name, a username, your date of birth, and, if you sign in with Google or GitHub, the name, email and avatar that provider sends. Your date of birth is used for what Age & Child Safety describes and is never shown to anyone but you and our staff. If you turn on two-factor authentication, a secret for it and backup codes, stored by us and deleted when you turn it off.

Your profile and what you post

Your profile fields (bio, country, links, avatar, banner, colours), and everything you put on ACADA: courses and their material, messages in rooms and direct messages, reviews, assignment submissions, quiz and questionnaire answers, discussion responses, corrections to lessons, press articles, and files you upload. Who sees each is in section 5.

Your learning

Which courses you are in and when, which lessons you started and finished, time spent, streaks, XP and level, skills and achievements, certificates earned, and the wishlist.

Your private tools

Notes, highlights, flashcards and whiteboards. Nobody but you sees them; the Intellectual Property policy says so, and section 5 repeats it.

Purchases and payouts

What you bought, when, at which price, refunds and their reasons, trials and discount codes used. For anyone we pay: a Stripe account reference, the country of that account, a PayPal email where PayPal is used, payout settings and history, and for instructors who pay the publishing fee, a Stripe customer reference with the card's brand and last four digits. We never hold a full card number, a bank account number or a tax identification number; Stripe and PayPal do, under their own terms.

Support, reports, notices and appeals

What you send through the contact form or feedback panel: name, email, the message, the ticket number and, where you sent it from a course's Billing tab, that course, plus the page you were on and your browser. Reports you make, appeals you file, and the record of any moderation action against you, with its reason. A copyright notice or counter-notice you send under Copyright & DMCA: your name, organisation, postal address, email, phone, the statements the law requires, and the address the notice came from. A claimant need not be a member; we hold their notice all the same.

Technical information

Each sign-in: the time, the IP address, the browser, a device name derived from it, and which sign-in session it began. Rate-limit records keyed to an IP address or account. Error reports, described under Sentry in section 6.

How you use the marketplace

Which course pages you open and which course cards you are shown, so that instructors can see how their course pages perform; and what you search for, so that we can show trending searches. Both are kept briefly, as section 9 says, and the search record is separated from your account after 90 days.

Referrals

If you open a course through an affiliate's link and agree to be remembered, or enter an affiliate's code at checkout: the code, the course, the time, and the IP address and browser of the click, kept 90 days to detect fraud. The Affiliate Agreement explains attribution.

Email

Your email preferences, a record of which emails we sent you and when, so that we do not send the same one twice, and for each course you are in, whether you chose to share your email address with its instructor, and since when.

The Assistant

When you use the ACADA Assistant, what you type, together with the text of the lesson you have open and your role on the page, is sent to Anthropic to produce the answer. We do not store the conversation; we count how many messages you send, for the limits in the Acceptable Use Policy.

The waitlist

If you joined the waitlist before registration opened: your email, your name if you gave it, what you said you were interested in, and whether you were invited and joined.

3. Where it comes from

  • You, when you sign up, fill in your profile, post, buy, teach, write to us, or use a feature.
  • Your use of the site, recorded by our software: sign-ins, progress, page views, searches, rate limits, errors.
  • Google or GitHub, when you sign in with them: name, email, avatar.
  • Stripe, about your payments and payout account: whether a charge succeeded, a refund or chargeback, the state of a payout account and whether Stripe has verified the person behind it, as the Verification Policy describes. Never the card or bank details themselves.
  • Other members: an affiliate's link that brought you to a course, a report someone made about you, a copyright notice naming your material.

4. Why we use it, and the legal basis

For each purpose, this is the ground on which we rely where a law asks for one, as the GDPR and the UK GDPR do.

  • To provide the service you asked for (performance of a contract): running your account, delivering courses, recording progress, issuing certificates, hosting what you post, sending the emails an account needs (receipts, security alerts, course notices), paying instructors, collaborators and affiliates, and handling refunds.
  • To keep ACADA safe and working (our legitimate interests, and yours): sign-in alerts, two-factor authentication, rate limits, fraud detection as Fraud & Scams describes, moderation and appeals, error reports, backups.
  • To improve courses and the marketplace (legitimate interests): showing instructors how their course pages perform, trending searches, and the aggregate figures in instructor and affiliate dashboards.
  • To meet legal duties (legal obligation): tax and accounting records, responding to copyright notices, reports the law requires under Prohibited Content, valid legal process, and the age rules in Age & Child Safety.
  • To send product updates (consent): only if you turned that email on in Settings; it is off by default, and you can turn it off at any time.
  • To answer you (legitimate interests, or the contract): support requests, feedback, and questions about your rights.

We do not use your information for advertising, we do not build profiles of you for anyone, and we do not make decisions about your account by automated means: a person reviews every report, notice, appeal and closure, as the Account Enforcement & Appeals and AI Content policies say.

5. Who sees it on ACADA

  • Everyone, including visitors without an account: your public profile (name, username, avatar, banner, bio, links, country flag, and your level while you are on the leaderboards), your portfolio with what you chose to show (certificates, skills, achievements, courses, pinned submissions), reviews you wrote, press articles you published, courses you created with your name on them, and a certificate's verification page. If you are under 18, your profile starts private and you stay off leaderboards and recommendations, as Age & Child Safety sets out. You can hide portfolio sections, set your profile to followers only or private, and take yourself off the leaderboards in Settings. A followers-only portfolio shows only to the followers you approved. Your followers, the people you follow and the two counts show on your portfolio to whoever can see it. A follow is listed only where both people show their side, and a list leaves out anyone whose profile is not public. You can hide either list and the counts, and keep yourself out of people search and suggestions.
  • Signed-in members: the leaderboards, with your name, username, avatar, XP, level and rank, unless your profile is private or you have turned them off.
  • Members of a room you are in: your messages there, your name and avatar, and your room role. A direct message goes only to the person you sent it to. You get message requests only if you turn them on. Each waits for you to accept, decline or block it, and a decline is not shown to the sender. The sender of a message sees whether the people it reached have read it, as Seen or a count. Whoever posts an announcement sees how many of its audience have. Turn read receipts off in Settings under Privacy and you are counted in none of them. People in a conversation also see when you are typing. The people who run a room, and either person in a direct message, can set its messages to be deleted after a set time.
  • The instructor of a course you are in, and their collaborators: your name, username and avatar, when you enrolled, your progress, your submissions and quiz results, your reviews, and whether you completed. Never your date of birth or payment details. Your email address only if you chose to share it: a box at enrolment, off unless you tick it, which shares the address on your account with that course's instructor alone, for that course alone. You can turn it off at any time in Settings under Privacy, and the address disappears from the instructor's view at once; it also disappears when you leave the course, are refunded, or your access ends. The Instructor Agreement limits what an instructor may do with it. Other students in the course can see your submissions, as Academic Integrity says. Everyone in the course, the instructor included, can see a correction you send to one of its lessons, with your name on it; how you voted on a correction is not shown to them, only the totals.
  • An affiliate whose link or code you used: nothing that identifies you. They are shown the course, the kind of charge, and what it earned them. Not your name, your profile, your email, or anything else you bought.
  • Someone whose material you name in a copyright notice or counter-notice: the notice in full, including your name, address and email, because the law requires it.
  • Our staff: what a task needs, and no more. Actions staff take on an account are recorded on the moderation ledger with the person who took them. Staff never see your password, your card number or your two-factor secret.
  • Nobody: your notes, highlights, flashcards and whiteboards; your date of birth beyond you and staff; your sign-in history beyond you and staff.

6. Who we share it with

These companies process information for us, under contracts that restrict them to our instructions. All are in the United States unless said otherwise, and each publishes its own privacy terms.

Supabase

Our database, sign-in service and file storage, hosted on Amazon Web Services in Northern California (the us-west-1 region). Everything in section 2 that we store, we store here. Supabase keeps daily backups for 7 days.

Vercel

Hosts the website and runs its code. Sees every request: your IP address, browser, and the page you asked for, in short-lived logs. Vercel also tells our code the approximate location of a sign-in (city, region, country) from the IP address, which we put in the new-device alert email; no other company receives your IP for this.

Stripe

Takes every payment that is not through PayPal, and makes every payout that is not through PayPal. Stripe receives what a payment needs: your email, the amount, the course, and your card or other payment method, which you give to Stripe directly on its pages and we never see. Where we must collect tax, Stripe also works out the tax from the billing country you give at checkout, or, for a PayPal purchase, from the country your connection appears to come from. For anyone we pay, Stripe holds the identity and bank details it collects for a payout account, and tells us the account's state. Stripe is a controller of that information under its own privacy policy.

PayPal

Takes a payment when you choose to pay with PayPal, and makes payouts to affiliates, instructors and collaborators outside the United States who chose it. For a payment, PayPal receives the amount, the course or bundle, and any tax; you sign in on PayPal's own pages, and we receive back the result and PayPal's reference for the payment, never your PayPal sign-in. For a payout, PayPal receives the amount and the PayPal email you gave us. PayPal is a controller of what it holds under its own privacy policy.

Exchange rates

The approximate local price shown beside a US-dollar price uses a daily exchange-rate table our server fetches from a public feed once a day. Nothing about you is sent to fetch it; the currency shown follows the country your connection appears to come from, or the one you pick in Settings.

Resend

Sends our email. Receives your email address, your name and the content of each message, and keeps a log of delivery.

Sentry

Receives a report when something breaks in the app: the error, the page, your browser and operating system, and for some errors a recording of what was on screen with all text and typed input masked. For a sample of page loads it also receives how long the page and its requests took. Reports carry an anonymous session identifier and not your name or email, and tokens and email addresses are removed from web addresses before anything is sent. Kept by Sentry for 90 days.

Anthropic

Runs the ACADA Assistant. Receives what section 2 describes: your message, the lesson text, your role and page; not your name, email or account identifier. Anthropic's commercial terms allow it to keep what passes through its API for up to 30 days for abuse monitoring and forbid it from training models on it.

Google and GitHub

Only if you sign in with them, and then only what sign-in needs. Google Translate loads only when you choose a language from the menu, as the Cookie Policy describes.

Everyone else

We share information outside that list only: when you direct it, such as sharing a certificate link or posting publicly; with the National Center for Missing & Exploited Children or law enforcement as Prohibited Content sets out; under valid legal process, as section 7 says; and if ACADA is sold or merged, to the new owner under this policy, with notice to you before it happens.

7. What we never do

  • Sell your information, or share it with anyone for advertising, in any sense the law gives those words, including California's. We have never done so.
  • Track you across other sites. No advertising cookies, no tracking pixels, no analytics services. A Do Not Track or Global Privacy Control signal from your browser asks us to stop something we never started.
  • Train AI on what you post, or let anyone else, as the Intellectual Property policy promises.
  • Decide about your account by machine. Rate limits and fraud signals flag things; a person decides.
  • Give your information to authorities without process. We disclose under a valid subpoena, warrant or court order, and we tell you, unless the law forbids it or telling you would put someone in danger. We do not volunteer information about members.

8. Where your information lives

ACADA is a United States company and the companies in section 6 process information in the United States. If you use ACADA from the European Union, the United Kingdom or elsewhere, your information is transferred to the United States to provide the service you asked for. For members in the EU and the UK, that transfer is necessary to perform our contract with you, and each processor in section 6 that receives your information does so under Standard Contractual Clauses or the EU–US Data Privacy Framework, which their own terms describe. United States law may give authorities access to information that your own country's law would not; that is a consequence of using a service based here.

9. How long we keep it

These periods are applied by our software every day. Deleted information can persist in Supabase's backups for up to 7 days after deletion.

  • Your account and everything in it: for as long as your account exists. When you delete your account, or we do, it is deleted 14 days later, or 30 where students hold access to your courses, as Account & Identity sets out: your profile, date of birth, learning records, certificates, reviews, submissions, messages, notes, flashcards, whiteboards, articles, payout settings, affiliate data, preferences, notifications and sign-in history all go with it.
  • Financial records (what was paid, refunded, charged back, and paid out): 7 years, for tax and dispute purposes. When your account is deleted, the link to you is removed and the amounts and dates remain.
  • The moderation ledger (warnings, restrictions, closures, strikes, with reasons): 3 years, and it survives account deletion, as Fraud & Scams and Account Enforcement & Appeals say.
  • Copyright notices and counter-notices: 3 years after the notice is resolved; a notice under a court case is kept until the case ends. Snapshots of removed material go after 90 days, and material reported to the authorities is kept 12 months, as Copyright & DMCA and Prohibited Content say.
  • Reports you make or that are made about you: 24 months after they are resolved.
  • Support requests and feedback: 24 months after they are resolved, or 36 months if they never are; the IP address is dropped after 90 days. They are kept even if you delete your account, as our correspondence.
  • Sign-in history (IP, device): 12 months. Settings shows your last 10 sign-ins, and your data export has all of it.
  • Course page views and card impressions: 12 months. Searches: separated from your account after 90 days, deleted after 12 months.
  • Referral click details (IP, browser): 90 days. The attribution itself is per course and lasts as long as the enrolment it paid for.
  • Email send records: 12 months. Rate-limit records: 24 hours.
  • Waitlist entries: 12 months after registration opens, or 12 months after you joined, whichever comes first; or on request.
  • Error reports: 90 days, at Sentry. Assistant messages: not stored by us; up to 30 days at Anthropic.
  • Your certificate's verification page: for as long as your account exists.

10. Your rights and choices

Every member has these, wherever they live. The laws of the European Union and the United Kingdom (the GDPR and UK GDPR) and of California (the CCPA) give them legal force for their residents; we honour them for everyone.

  • See and download everything we hold on you: Settings, under Account, "Export your data", as a JSON file, at any time.
  • Correct your profile, name, email and preferences in Settings; anything else, by writing to us.
  • Delete your account, in Settings under Account, with the timings in section 9. Deleting is permanent.
  • Choose what is public: hide portfolio sections, set your profile to followers only or private, hide a certificate, leave a room. In Settings under Privacy, choose who can follow you, who can message you and whether others can send you message requests. Choose whether others see that you read their messages and whether you appear in people search, and block anyone.
  • Turn emails off in Settings: product updates, and each kind of course email. Security and legal emails, and receipts, cannot be turned off while you have an account.
  • Object to a use based on our legitimate interests, or ask us to restrict a use, by writing to us; we will stop unless we have a compelling reason we can explain.
  • Withdraw consent where we rely on it (product updates) by turning it off; earlier sending stays lawful.
  • Not be treated differently for exercising any of these.
  • Complain to a supervisory authority: in the EU, the authority of the country you live in; in the UK, the Information Commissioner's Office; in California, the Attorney General. We would rather hear from you first.

How to ask. Use Settings for anything it offers. For the rest, write to privacy@acada.ac from the email address on your account, or while signed in through the contact form. We answer within 30 days, and we confirm who you are by that address; we do not act on a request about an account from an address that is not its own. California residents may use an authorised agent, who must show your written permission.

California notice. The categories we collect are those in section 2; the sources, section 3; the purposes, section 4; the recipients, section 6. We do not sell or share personal information and have not in the preceding 12 months, so there is no opt-out to offer; we do not use or disclose sensitive personal information for anything but providing the service; and we keep information for the periods in section 9.

11. Security and breaches

Traffic to and from acada.ac is encrypted in transit, and Supabase encrypts what it stores at rest. Access to the database is governed row by row so that a request from your account can reach only what your account may see; staff access goes through the admin tools and is limited to the task. Passwords are hashed by Supabase and cannot be read by anyone; we offer two-factor authentication and alert you by email when your account is used from a new device. No system is perfectly secure. If a breach affects your information, we tell you by email without undue delay, with what happened and what to do, and we notify the authorities within 72 hours where the GDPR requires it.

12. Children

You must be 13 or older to use ACADA, and a sign-up with a date of birth under 13 is refused and nothing from it is kept. If we learn that an account belongs to someone under 13, we delete it. Accounts of members under 18 carry the protections in Age & Child Safety, and a parent or guardian can write to privacy@acada.ac about their child's account, including to ask that it be deleted.

13. Changes to this policy

When we change this policy, we change the date shown at the top. If a change lets us collect something new, use information for a new purpose, share it with a new company, or keep it longer, we post a notice in the app and email you at least 14 days before it takes effect, and we do not apply the change to information collected before then without your agreement. Corrections and clarifications take effect when posted.

14. Contact

For anything about your information or this policy, write to ACADA L.L.C. at privacy@acada.ac. For a copyright notice: copyright@acada.ac. For everything else: support@acada.ac.

15. Related policies