Privacy Policy

Overview

Subnetica ("we", "us") is a computer-networking learning platform providing lessons, graded quizzes, hands-on virtual labs, progress and review features, learning paths, and subscriptions. This policy explains what information we collect when you use the site, why we collect it, and the choices you have.

Information we collect

When you create an account, we collect:

• Username, display name, and email address
• Password - stored as a salted hash, never in plain text and never accessible to us
• Date of birth - used only to verify you meet our minimum age requirement (13). The date itself is checked at registration and never stored; we retain the resulting eligibility status and verification timestamp needed to operate the account, not your birthday

When you use the learning system, we store progress and review activity, quiz attempts and results, lab completions and timing/progression information, XP, levels, streaks, achievements, and learning-path status. A live lab stores its template, randomized configuration, and operational state while it runs. The live instance and configuration are removed when it ends; durable lab history keeps completion and timing aggregates, including a command count, but not raw console commands. When you subscribe to a paid plan, payment is handled by Stripe (see below) - we do not store full card details. Subnetica may retain subscription status, selected plan and billing interval, billing metadata, and transaction or invoice references needed to operate billing.

Public profiles and leaderboards

Profile and leaderboard visibility are private by default and can be changed independently in Settings. If you explicitly choose public visibility, the relevant public profile or leaderboard view may show your chosen username/display name, bio, rating, ranking, and aggregate lab statistics supported by that view. We do not make either view public merely because you create an account.

How we use it

• To create and secure your account, and to keep you signed in
• To run the labs you launch and grade your progress against them
• To process subscriptions, invoices, and promo codes
• To send account-related email (verification, billing receipts)
• To send practice reminders, if you turn them on. All three start switched off on every new account - we don't send them unless you ask us to. You can change them in Settings at any time, and every reminder carries a link that turns off that kind of email
• To detect abuse and enforce rate limits
• To understand aggregate site and product usage, improve learning flows, measure acquisition and subscription conversion, and evaluate content and campaigns

We do not sell your information, and we do not run ads.

Analytics

We use a self-hosted instance of Umami on Subnetica-controlled infrastructure to understand aggregate website usage and improve acquisition, learning flows, and conversions. No Google Analytics or advertising network receives this data, and we do not create cross-site advertising profiles.

The standard tracker does not use analytics cookies. It may send the page viewed and title, referrer, browser, operating system, device type, screen dimensions, browser language, approximate country, an anonymous session value, and controlled product interaction events such as a CTA, signup, lesson, quiz, lab, review, or checkout action. Search parameters and URL hashes are excluded.

The analytics request necessarily reaches our server with network information such as an IP address and user agent so Umami can process the request and derive its anonymous session value. Umami documents that this session value is generated from the IP address, user agent, and website ID. Subnetica does not use identify(), distinct IDs, fingerprinting, session replay, recorders, or heatmaps, and does not deliberately send names, emails, usernames, account IDs, Stripe IDs, lab commands, quiz answers, or free-form text.

Self-hosted Umami retains analytics records indefinitely unless an operator deletes them. Analytics records are not linked to a Subnetica account, so account export and deletion tools cannot locate an individual analytics session.

Third-party services

We rely on a small number of third parties to run Subnetica, and only share what each one needs to do its job:

• Stripe - payment processing, subscription billing, and invoices. Stripe has its own privacy policy.
• Amazon SES - delivering verification and account emails.
• Self-hosted Umami - analytics software running in Subnetica-controlled AWS/k3s infrastructure; analytics data is not sent to Umami Cloud.

Cookies and local storage

Your session is a token stored in your browser's local storage, sent with each request - signing out or clearing your browser's site data removes it. We set exactly one cookie, subnetica_age_block, only if you fail the minimum-age check when creating an account - it's a client-side speed bump that briefly (24 hours) blocks another registration attempt from that browser, isn't used for tracking or analytics, and expires on its own. We don't use any other application cookies. The Umami analytics script is loaded asynchronously and uses its standard cookieless tracker; it does not set analytics cookies. We do not use advertising scripts or third-party advertising trackers.

Data retention

We keep your account data for as long as your account is active. Live lab instances and their configurations are deleted once a lab ends, while progress, completion, review, progression, and billing history remain account data until deletion or a stated legal retention requirement. Deleting your account (available from Settings) permanently removes your profile and account-linked learning and lab history, and immediately cancels any subscription. We retain billing/invoice records and related references where required for accounting, tax, fraud prevention, or dispute handling. Analytics is separate and is not account-linked, so account deletion does not identify or remove analytics records.

Your rights

Wherever you are, you can do all of this yourself from Settings - no request needed:

• Access & portability - download a copy of the account data exposed by Settings (profile, billing history, progress, and lab history) as a JSON file
• Rectification - edit your display name and bio directly; contact us for anything else on your account
• Erasure - permanently delete your account and everything tied to it (subject to the billing-record retention above)

If you're in the EU/UK, GDPR additionally gives you the right to restrict processing and to object to it; if you're a California resident, the CCPA gives you the right to know what we collect, request deletion, correct inaccuracies, and not be discriminated against for exercising any of these rights. We do not sell your personal information; we share limited information with the service providers listed above only when needed to operate Subnetica. Contact us for anything these self-service tools in Settings don't cover.

Children's privacy

Subnetica is not intended for anyone under 13, and we don't knowingly collect information from children under 13.

Security

We use industry-standard measures - encryption in transit, hashed passwords, and scoped access to production systems - to protect your information. No system is perfectly secure, but we take reasonable steps to keep yours safe.

Changes to this policy

If we make material changes to this policy, we'll update the date at the top of this page and, where appropriate, notify you directly.

Contact

Questions about this policy or your data? Reach us at privacy@subnetica.xyz.