Privacy
The Analyst’s Path · last updated 23 September 2026
You can start the course without an account, and until you sign in your work is kept in your own browser. When you sign in, with an email and password or with Google, you can sync your progress to our server so that it follows you to any device. We do not sell anything about you, and this build ships with no tracking. If site analytics are ever switched on, they are cookieless and aggregate: no cookie is set, no identifier is stored, and nothing they collect is tied to a person.
Before you sign in
Your learning stays in your browser. Modules, answers, review cards, journal entries, simulator portfolios, all of it is stored there (IndexedDB and local storage). We cannot see it, and clearing your browser data deletes it permanently. Export a backup from Account → Your data if you care about it. Once you sign in, syncing copies the progress in that browser to your account.
Our server does still see the ordinary things any web server sees when you load the page: an IP address, a browser user-agent, the file requested. These appear in short-lived operational logs used to keep the service running and to stop abuse.
When you have an account
| What | Why |
|---|---|
| Email address | To identify the account, confirm the address is yours, reset a password, and send receipts. |
| Display name | Shown on the leaderboard, if you use it. Any name you like. |
| Password, if you use one | Stored only as a bcrypt hash (cost 12). We cannot read it, recover it, or tell you what it is. |
| Your Google sign-in, if you use it | Google’s id for your Google account, the email address Google reports and whether Google has verified it, and your name as Google holds it. The id and email create your account and sign you in; the name becomes your display name. The section below has the detail. |
| Signed-in devices | For each sign-in, a coarse browser family such as “Chrome on Windows” and when it was last used, so you can see your devices and sign one out. No IP address is stored with it. |
| Your synced learning records | Progress, review schedule, journal, portfolio, reading position, preferences, so a second device sees the same state. Stored as opaque JSON per record. |
| Leaderboard row | Skill XP, accuracy, calibration and modules completed. Computed on our server from your own records, the app cannot submit a score for you. Never portfolio profit. |
| Subscription and receipts | Only if a paid plan is offered and you buy it: which payment provider, the period paid for, amounts and invoice numbers. Required by tax law and by both payment providers. |
| Audit log | Security-relevant events: sign-ins, password changes, payment webhooks, admin actions. This is how a compromise gets noticed. |
If you sign in with Google
We ask Google for the basic sign-in permissions only (openid, email
and profile). From Google we receive your Google account id, your email address,
whether Google has verified that address, and your name. The id and the email address are
used to create your account and sign you in. Your name becomes your display name, which other
signed-in learners see on the leaderboard if you sync; write to us to change it. The access
token Google issues is used once, to fetch those details, and is not stored.
We never receive your Google password, and signing in gives us no access to your Gmail, Drive, contacts, calendar or anything else in your Google account. We do not share what Google sends us, sell it, or use it for advertising. You can remove this app’s access from your Google account’s security settings at any time; your account here stays, and you can set a password for it from Account, or ask us to delete it.
What we never collect
- Card numbers. They never touch our server. Razorpay (India) and Lemon Squeezy (elsewhere) take the payment on their own pages; we receive a signed message saying it succeeded, plus the last four digits at most.
- Real portfolio or brokerage data. The simulator is not connected to any brokerage and has no way to be.
- Your own AI provider keys. If you supply your own AI provider key, it stays in your browser and talks to that provider directly. It is never sent to us and never synced.
- Behavioural advertising data. See below.
- Analytics. This build ships no analytics SDK, no session recorder and no heatmap. If a privacy-preserving, cookieless analytics measure is ever enabled, it counts page views in aggregate only, it sets no cookie, stores no identifier, and ties nothing to a person.
Ads
Advertising is what pays for every module being free. You see one short advert before opening a module, never before the first module you open: skippable after five seconds, at most one every twenty minutes and at most twelve in a day, and a banner on four index screens: The Path, the Dashboard, the Library list and the Practice home.
There are never adverts inside a lesson, inside the Reader, or anywhere near a graded exercise, a mastery gate, a case lab or a review. That is a rule enforced in the code, not a preference.
What is serving right now
Our own adverts, and nothing else. They are static images served from this domain and chosen locally by your browser. No third-party ad tag, no tracking pixel, no ad network, and nothing about you sent anywhere. We do not know which advert you saw, your browser does.
What will serve once Google AdSense is approved
We have built the integration and we intend to switch it on. When we do, this is exactly what changes, worth reading now rather than being surprised later:
- What loads. One script from
pagead2.googlesyndication.com, on those four index screens only. The advert itself renders inside a Google frame fromgoogleads.g.doubleclick.netortpc.googlesyndication.com. - What Google can see. Your IP address, your browser’s user-agent, the address of the page the advert sits on, and a cookie or local-storage identifier it sets in your browser for frequency capping and fraud detection.
- What Google cannot see, ever. Your email, your name, your account id, your progress, your answers, your scores, your journal, your simulator portfolio, your notes, or anything else you have typed into this product. None of it is passed to the ad script and none of it is reachable by it, the advert lives in a cross-origin frame that cannot read this page.
- Adverts are never personalised. Every request we make is flagged non-personalised, for everybody, in every country. Adverts are chosen from the page they sit on, not from a profile of you.
That last one is deliberate and it costs us money. India’s Digital Personal Data Protection Act prohibits targeted advertising directed at anyone under 18, and this product does not ask your age, so we cannot know that any particular reader is an adult, and we treat everyone as though they might not be. Personalised advertising would only ever be possible for someone signed in who had explicitly turned it on themselves. There is no such setting today, and nothing is personalised for anyone.
Cookies, in full
We set no cookies of our own. Not one, your sign-in is a token held in your browser’s own storage rather than a cookie, which is also why this site has no CSRF surface. The complete list of what is stored in your browser is:
| Name | Kind | What it is for |
|---|---|---|
ap.* (local storage, IndexedDB) | Ours, first-party | Your progress, review cards, journal, preferences and sign-in token. Never sent to an advertiser. |
ap.ads.consent | Ours, first-party | One boolean and a date: whether you agreed to advertising cookies, and when. Nothing else. |
| Google advertising cookies | Third-party: only once AdSense is live, and only with consent where consent is required | Frequency capping, click measurement and invalid-traffic detection. Set by Google and readable only by Google. |
If you are in the EEA, the UK or Switzerland
Nothing is requested from any ad network until you have been asked and have said yes. If you say no, or close the notice without answering, no ad-network script is ever added to the page and you see our own adverts instead. You can change your mind: clearing this site’s data in your browser removes the stored answer and you will be asked again.
Removing them
There is no paid plan today. If an ad-free plan is offered later (₹100 a month is the plan), subscribing will remove the adverts and change nothing about what data we hold, and a subscriber’s browser will make no ad requests at all: the script is never loaded, not merely hidden.
Who else sees anything
- Google, if you choose to sign in with Google (see above), and, once AdSense is live, for adverts (see the ads section).
- Resend, which delivers the emails we send you: address confirmation, password resets and receipts. It receives your email address and the message.
- Our hosting providers, which run the machines the app and database sit on, and our domain’s DNS and email forwarding.
- Razorpay and Lemon Squeezy, only if a paid plan is offered and you buy it: payment processing. They receive your email and payment details because they have to. Lemon Squeezy is the merchant of record outside India, so for those sales they are the seller and hold the tax record. No payment provider is live today.
- Nobody else. We do not sell, rent or trade personal data, and we have no advertising or data-broker relationships.
- We would disclose data if a court with jurisdiction over us ordered it, and we would tell you unless legally barred from doing so.
How long we keep it
- Account and synced records: until you delete the account.
- Receipts and payment records: eight years, because Indian tax law requires it.
- Audit log: two years.
- Password reset tokens: 30 minutes, and only ever as a hash.
- Email confirmation links: 24 hours, single use, and only ever as a hash.
- Sign-in sessions: 30 days from sign-in, unless you sign out sooner.
- Deleted sync records leave a tombstone (the fact that a record was deleted, and when) so the deletion survives syncing to your other devices. It holds no content.
Your choices
- Export everything: Account → Your data → Export. A JSON file you own, no request needed.
- Delete your account and its server-side data, email us and we will do it, keeping only the payment records tax law requires us to keep.
- Correct anything, name and email are editable; write to us for anything else.
- Leave the leaderboard, it is opt-in by using sync; ask and we will remove your row.
- Sign out a device: Account → Sign-in & devices lists every browser signed in to your account; sign any one of them out, or all of them at once.
If you are in the EU or UK, these are your GDPR rights to access, rectification, erasure, portability and objection; the lawful bases we rely on are contract (running your account) and legitimate interest (keeping the service secure). If you are in India, this is how we meet the Digital Personal Data Protection Act’s access, correction and erasure duties. Either way, one email is the whole process.
Security
Passwords are bcrypt-hashed at cost 12. Sessions are signed tokens that can be revoked instantly, and changing your password revokes every one of them. Password-reset links are single-use, expire in 30 minutes, and are stored only as a hash, so a leaked database cannot be turned into an account takeover. Payment webhooks are verified by signature over the exact bytes received and cannot be replayed. Google sign-in uses PKCE and a single-use state value, and your session token is never put in a URL. We do not claim to be unbreakable; we do claim to have taken these specific measures, and you can read them in the source.
Children
This is not aimed at children and we do not knowingly hold data from anyone under 16. If you believe a child has made an account, tell us and we will remove it.
We also do not ask anyone’s age, which means we cannot rule out that a reader is a student under 18. Rather than guess, we assume it: advertising is non-personalised for every reader, everywhere, which is what India’s Digital Personal Data Protection Act requires for children and what we apply to everybody. No behavioural profile is built for anyone, at any age, in any country.
Changes
If this policy changes in a way that affects you, we will say so in the app and email account holders before it takes effect. The date at the top is always current.
Contact
Write to the address on the contact page about anything on this page. There is no form and no ticket queue, and we answer.