Secure By Design · Privacy

Privacy policy

Effective 18 October 2026 · Applies to securebydesigninc.com and the Secure By Design app for iPhone, iPad, and Android

Secure By Design Team LLC (“Secure By Design”, “we”) runs this website and app to teach cybersecurity. You can learn without an account. We collect only what we need to run accounts, keep your progress, and send emails you ask for. We don’t sell personal information, show ads, or track you across other sites and apps.

What we collect

When you browse or use the app without an account

Course notes, checks, knowledge-check answers, and progress in the interactive guides and the app stay on your device unless you sign in. When you sign in, the website saves them to your account so they follow you to another browser or device.
Our hosting provider receives the technical information every website request carries, such as your IP address and browser type, to deliver pages and protect the service. We use IP addresses briefly to limit repeated sign-in attempts and form submissions.

When you create or use an account

Email address, to identify your account, send one-time sign-in codes, and help you recover access.
Password, if you set one, stored only as a salted scrypt hash. We can’t read it.
Apple, Google, or Microsoft sign-in, if you choose it: the account identifier that service gives us and the email address it shares. We never receive your password for that service. With Apple’s Hide My Email, we receive a private relay address. For Sign in with Apple we also keep the token Apple issues, so we can revoke our access when you remove Apple sign-in or delete your account.
Passkeys, if you add one: its public key and identifier, the kind of device you added it from, and when it was last used. Your fingerprint, face, or device PIN never leaves your device.
Learning records: course and lesson progress, saved materials, your interactive guide notes, checks, and knowledge-check answers (when you sign in on the website), daily learning activity in the app (such as streak days and completed reviews), and the learning-path choices you make.
ATO Package Builder, if you use it: the practice systems you record there and their history, such as system descriptions, role names you enter, control statements, assessment results, evidence descriptions and excerpts, and POA&M items. They are private to your account. Enter practice or fictional details, not real organizations’ sensitive information.
Community record: when you sign in or verify your email, we record that you joined the free Community, with your email, the date, and where you joined.
Sessions: a sign-in cookie on the website (up to 30 days) and a sign-in token in the app (up to 12 hours).

When you ask us to email you or send us a form

Resource emails: your email, optional name, when you confirmed, and when you unsubscribed. We send them only after you confirm.
Optional getting-started emails from the app, only if you agree, with a record of that agreement.
Forms: the career goals, community contribution, and resource sign-up forms are closed for now. We keep the name, email, and answers people sent before they closed, to read and reply to.

When you choose to support Secure By Design

Support is optional. Stripe’s secure checkout collects your payment details, email address, and billing information; your card number never reaches our website.
If you ask to be listed on the supporter wall, we store the display name you chose, whether your support is monthly, and the Stripe reference for your payment. The name appears publicly on our homepage.
If you ask for a Supporter badge, that choice is saved with your payment in Stripe.
So we can see how support is going, each completed payment, renewal, cancellation, and refund is also counted in PostHog as an anonymous event: the amount, whether it is one-time or monthly, and whether you chose a wall listing or badge. It never includes your name, email, card, or Stripe details, and it is sent by our server even if your browser blocks analytics.

Optional app analytics

The app can share learning analytics only if you turn on Share learning analytics; it is off by default. When on, it sends app opens, lesson and resource actions, whether answers were correct, and feedback-board and booking-page opens, with a random device ID and your platform. It never sends your name, email, answer text, or screen recordings.

Website analytics

The website uses Cloudflare Web Analytics to count page views and measure how quickly pages load. It also uses PostHog to see how the website is used:

the pages you open, how long you stay, and how far you scroll;
the links and buttons you click, including links to our YouTube, TikTok, Instagram, LinkedIn, and Discord pages and to the app;
the files you download and the site that referred you;
your browser and device type;
your approximate location (country, region, and city), which Cloudflare works out from your IP address.

Neither service uses cookies or local storage, follows you across sites, or is linked to your account. Web addresses are sent without their query strings, apart from campaign tags such as utm_source. PostHog counts visitors with an anonymous code that changes every day and doesn’t store your IP address. We don’t record your screen or what you type.

Account, sign-in, and app sign-in pages aren’t measured by PostHog. PostHog doesn’t run at all if your browser sends a Global Privacy Control or Do Not Track signal.

How we use it

To run your account, keep your progress and saved materials in step between the website and the app, and show your learning.
To send sign-in codes, account messages, and the emails you asked for.
To read and answer what you send us.
To keep the service secure and stop abuse.
To see which pages are visited, what people click and download, which of our channels bring visitors, and how quickly pages load, from the website’s analytics.
With analytics turned on, to see which lessons help and where learners get stuck.

Who helps us run the service

We share information only with these providers, to run the service, or when the law requires it.

Cloudflare hosts the website, its database, and the app’s connection to your account. It provides the website’s page counts (Cloudflare Web Analytics) and the approximate location used in website analytics.
Apple, Google, and Microsoft confirm who you are when you choose to sign in with them, under their own privacy policies.
Resend delivers our emails.
Stripe processes support payments, sends receipts, and lets monthly supporters change or cancel, under its own privacy policy.
PostHog (United States) receives the website’s analytics, which use no cookies and aren’t linked to your account. It also receives app analytics, only if you turn them on. It anonymizes your IP address.
YouTube plays course videos in privacy-enhanced mode. The player loads from YouTube only when you open a course that has a published video.
Radware provides the live threat map on our homepage and in the app. The map loads from Radware when you open the homepage (as its Live Threat Map section comes into view) or open the map in the app; Radware then receives the technical information every web request carries, such as your IP address and browser type, and may set its own cookies and use its own analytics, under its own privacy policy.
Google Calendar hosts our booking page. It opens on Google’s site only if you choose Book a call, and the details you enter there go to Google and to us, under Google’s privacy policy.
SMS Reminder texts a reminder before a call you book, to the phone number you give when booking, under its own privacy policy.
UserJot hosts our public idea board. It opens in your browser only if you choose to visit it, and posts there are public.
Apple and Google distribute the app under their own privacy policies.

How long we keep it

Account information, sign-in methods, and learning records: while your account exists. Deleting your account in My Account or the app removes them immediately; email requests are completed within 30 days.
Sign-in codes, sessions, and rate-limit records expire automatically.
Supporter wall names: until you ask us to remove yours. Stripe keeps payment records as financial law requires.
Email lists: until you unsubscribe. We keep a minimal record of an unsubscribe so we don’t email you again.
Form submissions: until we have handled them and no longer need them, or until you ask us to delete them.

Your choices

Use the website and the app without an account.
Clear your saved progress, add or remove sign-in methods, or delete your account from My Account at any time.
Unsubscribe with the link in any email.
Turn on Global Privacy Control or Do Not Track in your browser to stop the website’s PostHog analytics. Cloudflare’s page counts still run; they don’t identify you.
Turn app analytics on or off in the app, under My Account. Turning it off stops future events and removes the analytics ID from your device.
Ask us for a copy of your information, to correct it, or to delete it, by emailing support@securebydesigninc.com.

Delete your Secure By Design account

This applies to accounts used on securebydesigninc.com and in the Secure By Design app. Deletion is immediate and can’t be undone.

On the website: sign in, open My Account, choose Delete my account, and type DELETE to confirm.
In the app: open My Account, choose Delete your account, and confirm.
By email: if you can’t sign in, email support@securebydesigninc.com from the address on your account with the subject “Delete my Secure By Design account”. We may reply to confirm the request comes from you, and we complete it within 30 days.

Deleting your account removes your account, password, sign-in methods and passkeys, sessions, learning progress, saved materials, learning activity, learning-path choices, ATO Package Builder systems, Community record, and email preferences.

We keep only what the law requires, plus the minimal unsubscribe record that stops further emails. Progress stored only on your device is removed when you sign out of the app and delete it, or clear your browser’s site data.

Children

Secure By Design is made for adults and older teens learning cybersecurity. It isn’t directed to children under 13, and we don’t knowingly collect their information. If you believe a child has given us information, contact us and we will delete it.

Security

Connections use HTTPS, passwords are hashed, and only Secure By Design can open account and form records. No system is perfectly secure, so please use a password you don’t use anywhere else.

Changes

If we change this policy, we will update the effective date above. For significant changes we will tell account holders by email or in the app.

Contact

Secure By Design Team LLC · support@securebydesigninc.com