Who we are
Moxlearn (“we”, “us”) is run by [to be confirmed before launch], [to be confirmed before launch], in Ontario, Canada. This policy covers our website, the quiz, the learning app, the certificate check page and our team inquiry form.
For anything about your personal information, use the contact form and choose “privacy request”, or write to [to be confirmed before launch]. That contact is also our privacy contact: the person who answers for how we handle personal information.
We follow Canada’s federal privacy law, the Personal Information Protection and Electronic Documents Act (PIPEDA), and we aim to respect the privacy laws of the provinces and states where our learners live.
What we collect, why, and how long we keep it
This table lists everything we store about you, and who else handles it. If it is not on this list, we do not collect it.
| Information | Why we use it | Who else handles it | How long we keep it |
|---|---|---|---|
| Email, name (optional) and a hashed password, when you create an account. We store a salted one-way hash, never the password itself. | To run your account and sign you in. | Nobody else. | Until you delete your account or ask us to delete it. We do not delete it automatically yet. |
| Sign-in records (a random code, an expiry date) behind the cookie. | To keep you signed in. | Nobody else. | Each lasts 30 days, or until you sign out. Expired ones are not yet removed automatically. |
| Your progress: points, finished lessons, streak, the name on your profile, prompts you wrote in labs, your latest assignment answers, certificates, badges and settings. | To save your place and sync it between devices, and to issue certificates. | Nobody else. | Until you delete your account or ask us to delete it. We do not delete it automatically yet. |
| Practice prompts and AI answers you submit for an assignment, with the feedback, and who sent them. | To give you feedback, and so our team can check how the lessons work. | The text is processed by Anthropic to produce the answer and feedback (see “AI practice”). | Until you delete your account or ask us to delete it. We do not delete it automatically yet. |
| A count of your AI practice calls: time, type, whether it worked, and size. Not the text. | To enforce the daily limit and to see what the service costs. | Nobody else. | Until you delete your account or ask us to delete it. We do not delete it automatically yet. |
| Anonymous usage events: a random visit id that lasts only while the browser tab is open, the page or step, the time, phone, tablet or computer (from the screen width), the website that linked to us (its name only) and campaign tags, and plain facts such as time on a page, how far it was scrolled, which button was clicked (by its label), the last form field used before a form was left (its name, not what you typed), script errors and page speed. See “Anonymous analytics”. | To find what confuses people, breaks or loads slowly, and fix it. We look only at totals. There are no recordings and no view of a single visit. | Nobody else. | Deleted automatically after 90 days. |
| Membership record: plan, status, renewal date, and your Stripe customer and subscription numbers. Payment record: invoice number, amount, currency, date, and whether it was refunded. | To give you access, take payments, and honour cancellations and refunds. | Stripe takes your card details and payment. We never see your full card number. | Kept. Tax and accounting law may require us to keep payment records for several years, so a deletion request may not remove them. |
| Reminder settings, if you turn reminders on: time, time zone, email or browser, a browser push address, an unsubscribe code, and the date of the last reminder. | To send the daily reminder you asked for. | Reminder emails go through Resend. Browser notifications go through your browser maker’s push service. | Until you delete your account or ask us to delete it. We do not delete it automatically yet. |
| Certificate record: the name on the certificate, the certificate title, the date, a certificate number and a long random verification code. | So anyone you share the link with can check the certificate is real. | Public: see “What is public”. | Until you delete your account or ask us to delete it. We do not delete it automatically yet. |
| Team inquiry: name, email, company, team size, roles and message. | To reply about team access. | Nobody else. | Until you delete your account or ask us to delete it. We do not delete it automatically yet. |
| Your IP address and browser details, when your browser loads our pages. | To deliver the pages. Our own code does not log them or store them in our database. | Our hosting provider and Google (for fonts) handle requests as part of delivering pages. | We do not keep them ourselves. Our hosting provider may keep its own logs. |
How we use it
- To run Moxlearn: your account, progress, certificates and membership.
- To give feedback on your practice work.
- To take payments, handle refunds and meet tax and accounting rules.
- To send the reminders you asked for, and replies to messages you sent us.
- To understand how the lessons are used and to make them better, using our own anonymous counts.
- To keep the service safe: limiting how much one person can use the AI, and spotting abuse.
- To meet legal duties.
We do not sell personal information. We do not share it for advertising, and we do not build advertising profiles. Our team members see learner details only as far as their work needs, such as reviewing practice submissions, handling refunds and answering your messages.
Anonymous analytics
We want to improve Moxlearn, not to watch what any one person does. So our own analytics are built to know nothing about who you are.
- What we count: pages and quiz steps viewed, time on each page, how far down it was scrolled, which buttons and links were clicked (by their label), clicks that did nothing, forms sent or left (and the name of the last field used, never what was typed), script error messages (with emails and numbers removed), page speed, phone, tablet or computer, and the website or campaign that brought the visit.
- What we never collect here: what you type, your quiz answers, your name or email, your account, your IP address, your full browser details, mouse movements or screen recordings.
- How it is tied together: only by a random visit id kept in your browser tab’s session storage. It is new for every tab and every browser session, and is gone when you close the tab. It is not the id the app uses for AI practice, and it is never linked to an account.
- How we look at it: as totals only. Our admin screen hides any row with fewer than 5 visits, and has no view of a single visit.
- How long: the raw events are deleted automatically after 90 days.
- Your choice: if your browser sends Global Privacy Control, we send nothing. You can also turn analytics off with “Analytics choices” at the foot of our public pages, or in Settings in the learning app. Your choice is kept in your browser (key skilldawn:analytics), and turning it off stops sending at once.
We do not record sessions, and no outside analytics or advertising company receives any of this.
AI practice
The practice console and the assignment feedback are powered by Claude, an AI model made by Anthropic. When you press run, or ask for feedback, our server sends this to Anthropic’s service:
- To run a prompt: the prompt you wrote (up to 4,000 characters).
- To review an assignment: the assignment text and grading criteria, the prompt you wrote and the AI answer it produced.
We do not send your name, email or account details with it. Anthropic acts as a service provider that processes this text for us to give you an answer, under its own terms and privacy policy. Please read them to see how Anthropic handles API data. Because the text goes to a company outside Canada, do not type passwords, health or financial details, client secrets, or private details about other people.
AI answers can be wrong, and the feedback is guidance, not a verdict. An AI check can mark an assignment as passed, and a passed assignment counts toward your progress. If you would rather not use the AI check, you can check the criteria yourself. We do not use this AI to make decisions about your job, credit, housing or health.
There is a daily limit of 40 AI practice calls per learner. We record the count, not the text, in the usage log. The text of an assignment submission is stored with your submission, as the table above says.
Who helps us handle your information
These companies handle information for us, only to do the job described. They handle it to provide their service, under their own terms.
| Company | Job | What it gets |
|---|---|---|
| Anthropic | AI answers and feedback in the practice console. | The practice text described above. |
| Stripe | Payment page, subscriptions, receipts, refunds and the customer portal. | Your email, your account id, your card and payment details, and your plan. |
| Resend | Sends reminder emails, if you chose email reminders. | Your email address and the reminder text. |
| Your browser maker’s push service (for example Apple, Google or Mozilla) | Delivers browser reminders, if you chose them. | A push address and the reminder text. |
| Google Fonts | Serves our typefaces. | Your IP address and browser details. |
| Our hosting provider | Runs the website and database. | Everything we store. |
We may also share information if the law requires it, to protect people’s safety, or as part of a sale or merger of the business (the new owner would have to honour this policy).
What is public
- Certificate check page. Anyone who has your certificate’s verification link can see the certificate title, the name on it, the date and the number. Nothing else, and not your email. The link is long and random, and the page asks search engines not to list it. Share the link only with people you want to see it.
If you delete your account, the check page stops showing your name and the certificate details, and says instead that the record was removed at the holder’s request.
Once something has been public, we cannot take back copies that other people or search engines made.
Email and notifications
We send reminder emails only if you turn them on. They are off by default. Each reminder says who sent it, includes our postal address, and has a one-click link to turn reminders off. Turning them off stops them straight away. Browser reminders stop when you turn them off in the app or block notifications in your browser.
We do not run a newsletter or a marketing list. If you send a team inquiry, you tick a box to agree that we may email you about team access, and we use your address for that reply. Stripe may email you receipts and renewal notices about your membership. Under Canada’s anti-spam law (CASL), you can withdraw consent to any of these at any time.
How long we keep information
Today, nothing is deleted automatically, apart from anonymous usage events (after 90 days) and sign-in codes when you sign out. We keep your information while your account is open, and after that until you delete your account or ask us to delete it. We have not yet set fixed time limits. We will set them, publish them here, and then delete information when its time is up.
Some records may need to be kept after you ask for deletion, such as payment records that tax and accounting law make us keep. When you delete your account, these payment records stay, no longer linked to your Moxlearn account, and the app tells you so before you confirm.
Your rights and choices
You can ask us to show you what we hold about you, correct it, give you a copy, or delete it, and you can withdraw consent you gave. In the learning app, under You, “Download my data” gives you a copy of everything stored about your account in one file (JSON, a structured, commonly used format), and “Delete account” deletes your account. For anything else, or if you cannot sign in, ask us through the contact form (choose “privacy request”) or at [to be confirmed before launch]. We will check it is really you, then deal with your request as quickly as we reasonably can, and within the time the law gives us.
- Turn reminders off at any time in the app, or with the link in a reminder email.
- Turn anonymous analytics off with “Analytics choices” at the foot of our public pages, or in Settings in the learning app. If your browser sends Global Privacy Control, we already send nothing.
- Sign out any time, and clear your browser’s site data to remove what we keep on your device.
- Cancel your membership in your profile. See the subscription terms.
- If you are unhappy with an answer, tell us, and you can complain to a privacy regulator (below).
Canada: the ten privacy principles
PIPEDA rests on ten principles. Here is how we try to follow each.
- Accountability. We named a privacy contact (above) who answers for how we handle personal information.
- Identifying purposes. We tell you why we collect each thing, in the table above.
- Consent. We ask before we use your information in a way you would not expect, such as sending reminders. You can withdraw consent.
- Limiting collection. We collect what the service needs. Quiz answers stay in your browser.
- Limiting use, sharing and keeping. We use information for the purposes above. Retention limits are being set (see “How long we keep information”).
- Accuracy. You can edit your name and profile, and ask us to fix other records.
- Safeguards. Passwords are stored as salted hashes, the sign-in cookie cannot be read by page scripts, and only our admin can see learner records. No system is perfectly secure, and we cannot promise it. If a breach creates a real risk of significant harm to you, we will tell you and the regulator as the law requires.
- Openness. This page is our policy, and we will keep it up to date.
- Individual access. You can ask to see and correct your information.
- Challenging compliance. You can complain to us, and then to the regulator.
Quebec residents
Quebec’s privacy law (Law 25) gives you extra rights. If you live in Quebec, you may ask us for access to your information, to have it corrected, to receive it in a structured, commonly used format, to stop us using it, and to withdraw consent. Ask through the contact above.
The person in charge of protecting personal information at Moxlearn can be reached at [to be confirmed before launch]. We do not use your information to build advertising profiles or to track you across other sites. Your information is processed by service providers in other countries, listed above, including outside Quebec and Canada. AI assignment feedback is produced automatically, as the AI section explains, and you can check the criteria yourself instead.
US residents
Many US states, including California, Virginia, Colorado and others, give residents the right to know what personal information a business holds, to correct or delete it, to get a copy, and to opt out of the sale of personal information, of targeted advertising and of profiling. Whether a given state law applies to us depends on our size, and we may be below the thresholds. We handle requests from US residents the same way as from Canadians: use the contact above.
We do not sell personal information, we do not share it for cross-context behavioural advertising, and we do not use it for targeted advertising. We will not treat you worse for using your rights.
Where information is processed
Anthropic, Stripe, Resend and Google are based in the United States and may process information there and in other countries. Our own hosting location may be outside Canada too. Information held in another country can be accessed by courts and authorities there under that country’s laws. We pick providers that offer written terms on how they treat data, but we cannot promise it never leaves your own country.
Children
Moxlearn is for adults who are learning for work. You must be at least 18 to create an account. We do not knowingly collect information from children. If you think a child has given us information, tell us through the contact above and we will delete it.
Complaints
Please contact us first, so we can try to fix it. You can also complain to a regulator:
- Canada: Office of the Privacy Commissioner of Canada.
- Quebec: Commission d'accès à l'information du Québec.
- US: your state attorney general, or the Federal Trade Commission.
Changes to this policy
When we change this policy in a way that matters, we will change the date at the top and tell signed-in learners before the change applies to them.