Privacy

Practising as a guest

You do not need an account. A draft of your answers is kept in your browser's session storage and a list of exercises you completed in its local storage, so that the page remembers your work. This stays on your device.

If you create an account

We store your name, email address, a hashed password (or your Google account identifier), your sign-in sessions, and your learning progress: which exercises you attempted, whether each attempt was correct, and when. We do not store the formulas you type. You can delete your account and all of this data from Account settings at any time. Analytics events are covered under Analytics and Data requests below.

Cookies

A single sign-in cookie is used when you are signed in. It is necessary for the account to work and is removed when you sign out.

Analytics

Analytics is off unless you choose Allow analytics. If you do, we use Amplitude, whose servers we have set to the United States, to learn which exercises are opened, started, checked and completed, and which hints and worked examples are used. Each event names the exercise, its level and topic, the result of a check (correct, incorrect or invalid) and the kind of feedback shown, and whether you are signed in. Events never contain the formulas or values you type, your answers, your name or your email address. Amplitude stores a random identifier in your browser's local storage (not in a cookie) to tell visits from the same browser apart. If you are signed in, events also carry an internal account number that is not your name or email, which lets us connect your earlier visits on this browser to your account. We ask Amplitude not to work out your location from your IP address, but your IP address still reaches Amplitude with each request, as it does with any website you visit. We do not use analytics for advertising or sell this data. Analytics events are subject to a 12-month retention period, measured from when Amplitude receives them, and Amplitude is configured to delete older events. You can change your mind at any time with Cookie settings in the footer: choosing again and declining stops collection and deletes the identifier and any unsent events from your browser. Events already received stay in our Amplitude project until their 12-month period ends, including after you delete your account; they are then linked only to an internal number that no longer matches any account.

Email

We email you only to confirm your address and to reset your password. These automated messages come from a no-reply address; if you reply, your reply goes to our support address.

Sign-in sessions

When you sign in we create a session record so that the site can keep you signed in. It holds a random session token, the dates the session was created and expires, a description of your browser and device taken from the user-agent your browser sends, and your IP address when our hosting network passes it on to us.

We use it to keep you signed in, to show you which browsers are signed in (a browser and system description only; the IP address is not shown on the site) and to protect your account. A session lasts up to 30 days and is extended while you use the site.

A session record is deleted when you sign out, when you sign that browser out from Account settings, when your password is reset, or when you delete your account. A session that expires without being used again is not removed automatically, so its record can remain after it has expired.

Your analytics choice

We remember whether you accepted or declined analytics by saving your choice in your browser's local storage on your device, so that we do not ask you again on every page. This preference is not sent to us and holds no personal information. If you allow analytics, the identifier described under Analytics is kept in local storage too. Choosing Cookie settings in the footer clears your choice and asks again.

Data requests

You can ask for access to the personal information we hold about you, ask us to correct it, or ask us to delete it. This includes analytics events, as explained below.

Send your request to the address below. If you have an account, write from the email address on the account so that we can confirm the request is yours. If we cannot confirm who you are, we will tell you what else we need, and we will not release or delete anything for someone we cannot verify.

We will give you our response within 30 days of receiving your request. An acknowledgement that we received it is not our response. Requests are handled by the Founder & Privacy Officer of ExcelDrills, the person responsible for the protection of personal information, at the address below.

If you only practised as a guest, your progress stays in your own browser and we keep no account or progress record about you on our servers.

Analytics events from visits where you were not signed in are linked only to a random identifier stored in your browser, so we cannot find them from your name or email address and we may not be able to identify them. Withdrawing consent with Cookie settings in the footer removes that identifier from your browser. Events from visits while you were signed in are linked to an internal account number: if you plan to delete your account, ask us to delete your analytics events first, because afterwards we may not be able to tell which events were yours.

Deleting your account does not automatically delete analytics events that were already collected.

Email support@exceldrills.com