Overview
Learn to Cloud is a free, open-source educational platform that helps you learn cloud computing through structured, hands-on exercises. We are committed to protecting your privacy and being transparent about the data we collect and how we use it.
Data We Collect
During sign-in, we read your GitHub profile and save these fields:
- GitHub user ID — used as your account identifier
- Username — used for presentation and links, not as your durable account identifier
- Display name — used to greet you on your dashboard; if absent, we use your username
- Avatar URL — shown in the navigation bar
We do not save other fields from the profile response or request your GitHub password.
We collect browser page views, request outcomes, performance timings, and client-side errors to diagnose reliability issues. We do not set a GitHub account identity in browser telemetry. Normal URL paths and error details are included; query values are removed from URL fields.
Server diagnostics record actions, outcomes, timing, and errors. Attempt IDs let authorized maintainers look up submission details in the database without copying them into routine logs. We do not deliberately log credentials or submission payloads, and database query parameters are hidden. Ordinary error diagnostics may include public GitHub profile values.
GitHub OAuth Scope
We request the read:user
OAuth scope to read your profile. We do not request repository or organization scopes for sign-in.
Your GitHub access token is used during sign-in and is not saved in our database or session cookies.
Data You Submit
Verification submissions include URLs, lab tokens, and reflection text. We store submitted values, learning progress, verification outcomes, and feedback alongside your account. Verification can also fetch repository files and send selected evidence to automated grading.
How We Use Your Data
Your data is used solely to:
- Identify your account and maintain your session
- Track your learning progress across phases
- Verify completion of hands-on exercises
- Compute aggregate community statistics and display graduates' public usernames and avatars
- Diagnose server and client-side errors and performance issues
What We Do Not Do
- We do not sell or rent your personal information; service providers below process data to operate the platform
- We do not use your data for advertising, recruiting, or marketing purposes
- We do not send unsolicited emails
- We do not store your GitHub access token
Cookies
We use two HTTP-only cookies for different purposes. A short-lived signed cookie preserves GitHub sign-in state for up to 10 minutes. A separate authentication cookie contains an opaque random credential, not your profile or user ID. On the server, we store only its digest, account link, creation and activity times, and absolute expiry. We do not store IP addresses or device details with sessions. We do not use tracking cookies, analytics cookies, or any third-party cookies. Browser telemetry is configured without cookies or browser storage.
Data Retention & Deletion
Your account-linked database records are retained while your account exists. Deleting your account from the Account page removes your profile, progress, submissions, feedback, and sessions from the active application database. This cannot be undone through the app.
Sessions stop working after 7 days without authenticated activity or 30 days after sign-in. Signing out deletes that browser's session; Sign out everywhere deletes all current sessions. Account deletion also deletes all sessions. Expired records are removed in small batches during later successful sign-ins, so physical removal has no guaranteed deadline. Expired records cannot authenticate while waiting for cleanup.
Account deletion does not erase database backups, existing diagnostic logs, or data retained by grading services. Those records have separate retention settings. Already-running verification work is not cancelled, and data on GitHub or your own deployments is not deleted.
Third-Party Services
We use the following external services for sign-in, verification, and platform diagnostics:
- GitHub API — to sign you in and verify repositories and profiles you submit
- Microsoft Foundry / Azure OpenAI — to grade selected code, reflection text, and related metadata; service storage and abuse monitoring follow Microsoft's data-handling terms
- Azure Application Insights — to collect server and browser diagnostics
Open Source
This application is open source. You can review the full source code to verify our data practices at github.com/learntocloud/learn-to-cloud-app.
Changes to This Policy
We may update this policy from time to time. Changes will be reflected on this page with an updated date. Continued use of the platform after changes constitutes acceptance of the revised policy.
Contact
If you have questions about this privacy policy, please open an issue on our GitHub repository or start a discussion in our GitHub Discussions.