Privacy Policy

• Account details. Your email address and username. If you sign in with Google, we also receive the name and profile picture on your Google account. Passwords are handled by our sign-in provider, Clerk; we never see or store them.
• Your goals. Answers you give when you start, such as why you are here (for example a SOC job or Security+), which we use to suggest a route and tailor emails.
• What you submit. Queries, answers, verdicts and notes in lessons, cases, Adventures, drills and practice exams.
• Payments. When you subscribe, Clerk and Stripe process your payment. We receive your plan, its status and billing events, not your full card number.
• Security+ Accelerator. If you apply or enroll, the answers on your application and diagnostic, your study plan progress, and messages in the coaching chat.
• Messages to us. Anything you send to our support or privacy email addresses.

• Learning activity. Lessons, modules, cases and episodes you complete, drill and exam scores, streaks and badges.
• Product usage. Pages you visit and actions such as viewing pricing or starting a trial.
• How you found us. The site that referred you, the page you first landed on, campaign tags in the link (such as utm parameters) and ad click identifiers from Google or TikTok. We keep the first one with your account so we know which channels bring learners.
• Device and log data. IP address, browser and device type, and server logs that record requests to our services.

We and our providers use cookies, local storage and similar tools:

• Essential. Clerk uses cookies to keep you signed in. The site cannot work without them.
• Preferences. Local storage remembers small things like where you left off.
• Analytics. Google Analytics (loaded through Google Tag Manager) measures how the site is used.
• Advertising measurement. Google Ads conversion tags and the TikTok pixel tell those platforms when someone who clicked an ad signs up or subscribes, so we can measure and improve our ads.
• Email engagement. Drip, our email provider, can recognize visits from people on our email list, so it can tie email clicks and site activity to the right subscriber.

You can block or delete cookies in your browser settings; essential cookies are needed to sign in. You can also limit ad personalization in your Google ad settings and opt out of Google Analytics with Google's browser add-on.

• to provide EpicDetect: your account, progress, scores, badges and the leaderboard;
• to process subscriptions and the Accelerator, and handle billing questions;
• to send service email (such as account and billing messages) and marketing email (welcome emails, trial reminders and our newsletter), tailored to your goal and what you have done on the site;
• to measure which pages, emails and ads lead people to sign up and subscribe;
• to improve our content and features, and to fix problems;
• to keep the site secure and prevent abuse; and
• to meet legal obligations.

We share personal information only with the providers that help us run EpicDetect, and only what they need:

• Clerk: sign-in, account management and subscription billing (Clerk's privacy policy).
• Stripe: card payments (Stripe's privacy policy).
• Amazon Web Services: hosting, databases and storage for the site and your progress.
• Drip: our email provider. It receives your email address, name if you signed in with Google, plan, your purchases and their amounts, sign-up answers, how you found us, and learning events such as finishing a lesson or a drill, so the right emails reach the right people.
• Google: Analytics, Tag Manager and Ads conversion measurement; and Google sign-in, if you use it.
• TikTok: ad conversion measurement through the TikTok pixel. On Accelerator checkout we may also share your email address in hashed form so TikTok can match the purchase to an ad.

What other learners see. Your username and ranking can appear on the leaderboard, and badge pages you choose to share are public to anyone with the link.

We may also disclose information if the law requires it, to protect the rights and safety of our users or the public, or as part of a merger or sale of the business, in which case this policy would continue to apply to your information.

We do not sell your personal information, and we do not let advertisers use EpicDetect to target you.

Every marketing email has an unsubscribe link, and unsubscribing stops our newsletters and marketing series. We may still send emails about your account or a purchase.

We keep your account information and progress for as long as your account exists. If you ask us to delete your account, we delete your account data and remove you from our email list, except for records we must keep, such as payment and tax records. Server logs and backups are kept for a limited time and then deleted.

Wherever you live, you can ask us to show you the personal information we hold about you, correct it, delete it, or stop using it for marketing. Depending on where you live (for example in the EU, the UK or California), you may have further rights under the law, such as receiving a copy of your data in a portable form or objecting to certain processing. We will not treat you differently for using them.

To make a request, email support@epicdetect.io from the address on your account. We may need to confirm it is you before we act, and we will reply within the time the law requires. If you are in the EU or UK, you can also complain to your local data protection authority.

We use reasonable technical and organizational measures to protect your information, including encryption in transit and access controls on our systems. No service is perfectly secure; if a breach affects your personal information, we will tell you as the law requires.

EpicDetect is based in the United States, and our providers store and process data mainly in the United States. If you use EpicDetect from another country, your information will be transferred to and processed in the US.

EpicDetect is not for children under 13, and we do not knowingly collect their personal information. If you believe a child under 13 has given us information, contact us and we will delete it. Learners aged 13 to 17 need a parent or guardian's permission, as our Terms of Service explain.

We will update this policy when what we collect or who we share it with changes. We will change the date at the top, and for a significant change we will tell you by email or on the site.

Privacy questions, requests or anything else: support@epicdetect.io.