Privacy Policy

StackMonsters ("we", "us") is a company based in Ontario, Canada. We run www.stackmonsters.com, a game-style course for learning Kubernetes. This policy explains what personal data we collect when you use the site, why we collect it, who we share it with, and the choices you have. The short version: we collect what we need to run your account, track your progress and take payment. We don't sell your data and we don't run third-party advertising.

What we collect

Account information

When you create an account we collect your email address. If you sign in with GitHub or Google, we receive the basic profile those services share (name, email address and avatar URL). During onboarding you choose a handle and may set a display name.

Learning progress

As you play we store your progress: lessons and labs completed, quiz scores, hints used, time spent on labs, XP, level, streaks, boss-fight results, captured monsters and earned titles. This is the core of the product, and it's what your dashboard, leaderboard position and certificate are built from.

Lab activity

Free labs run a simulator entirely in your browser. Labs on a real cluster run on a temporary virtual machine we provision for your session; to grade your work and let you reconnect, we process the commands you send to that machine and inspect the state of the cluster. Lab machines are deleted when your session ends. Please don't type personal information or secrets into a lab terminal.

Payment information

Payments are handled by Stripe. We never see or store your full card number. We receive and keep a record of the purchase: the Stripe customer ID, what you bought, the amount, and the payment status.

Usage and device data

We use product analytics (PostHog) to understand how people use the site, for example which pages are visited, where learners get stuck, and which features are used. This includes data like your IP address, browser and device type, pages viewed, and in-app events. We don't use session recording or replay. We also collect error reports and server logs so we can find and fix bugs.

When you contact us

If you email us, we keep the message and your email address so we can reply.

Playing without an account

Chapter 1 can be played without signing up. In that case your progress is stored only in your browser's local storage, not on our servers. If you later create an account, that progress is imported into it and cleared from your browser. Analytics (described above) may still apply while you play as a guest.

How we use your data

• To create and secure your account and sign you in.
• To run the course: save progress, grade labs, award XP, and issue certificates.
• To process payments and grant access to what you've bought.
• To send service emails, such as sign-in links, receipts and important account notices.
• To understand usage, fix bugs, prevent abuse (for example, crypto-mining on lab machines) and improve the course.
• To comply with legal obligations, such as tax and accounting record-keeping.

Where the GDPR or similar laws apply, our legal bases are: performing our contract with you (running your account and the course), our legitimate interests (security, abuse prevention, analytics and product improvement), legal obligations (financial records), and your consent where we ask for it.

What's public

Your handle, display name, avatar, level, XP, rank, streak, titles, captured monsters and boss victories may appear on your public profile page, on leaderboards, and on share cards you choose to post. Your email address and payment details are never shown publicly.

Who we share it with

We don't sell or rent your personal data. We share it only with service providers that help us run the site:

• Supabase: database and authentication.
• Vercel: website hosting.
• Stripe: payment processing.
• PostHog: product analytics, error tracking and logs.
• Resend: sending account and service emails.
• Hetzner: servers that run real-cluster lab sessions.
• GitHub and Google: only if you choose to sign in with them.

These providers process data on our behalf and under their own security and privacy commitments. We may also disclose data if required by law, to protect our rights or the safety of others, or as part of a merger or sale of the business, in which case this policy will continue to apply to your data.

International transfers

We and our providers may process data in Canada, the United States, the European Union and other countries, where it may be accessible to authorities under local law. Where data is transferred out of the EEA or UK, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses.

Cookies and local storage

We use a small number of cookies and browser storage entries:

• Essential: authentication cookies that keep you signed in.
• Preferences: your theme choice, and in-progress lab state so a refresh doesn't lose your work.
• Guest progress: Chapter 1 progress if you play without an account.
• Analytics: PostHog identifiers used to measure usage.

We don't use advertising or cross-site tracking cookies. You can clear cookies and site data in your browser at any time.

How long we keep it

We keep your account and progress data for as long as your account exists. You can delete your account at any time from Settings. This immediately deletes your profile, progress and purchase records from our database. Copies may persist in backups until they roll over on a fixed schedule. Our payment processor keeps its own payment records as long as tax and accounting law requires.

Your rights

Depending on where you live, you may have the right to access, correct, export or delete your personal data, to object to or restrict certain processing, and to withdraw consent. To exercise any of these, email hello@stackmonsters.com from the address on your account. We'll respond within 30 days. If you're not satisfied with our response, you can complain to the Office of the Privacy Commissioner of Canada. If you're in the EEA or UK, you can also complain to your local data protection authority.

California residents: we don't sell or share personal information for cross-context behavioral advertising, and we don't use sensitive personal information beyond what's needed to provide the service.

Security

We use encryption in transit, access controls and per-user database row-level security to protect your data. Lab machines are isolated and have no public IP addresses. No system is perfectly secure, but if we become aware of a breach affecting your data we'll notify you as required by law.

Children

StackMonsters is not directed at children under 16, and we don't knowingly collect personal data from them. If you believe a child has given us personal data, contact us and we'll delete it.

Changes to this policy

If we make material changes we'll update the date at the top and, where appropriate, notify you by email or in the app before they take effect. Also see our Terms of Service.

Contact

Questions about privacy? Email hello@stackmonsters.com.