Academy portal privacy

What we store

• Email — your account identifier and login.
• Password hash (argon2id) — the password itself is never stored and is irreversible.
• Public wallet address — to verify your educational on-chain steps (address only; NEVER private keys or seed phrases).
• Course progress, quiz results, and your own notes.
• Confirmed transaction hashes — so a given tx can't be counted twice.
• A session cookie (to keep you signed in) and an append-only event log (audit: register / login / verification).

Why

Only to run the course: authentication, progress tracking, verifying your educational on-chain steps, and issuing your certificate. No advertising, no third-party trackers, no selling of data.

Non-custodial

The Academy holds none of your funds and none of your keys. Practice happens on your own wallet with an educational limit of ≤ $150; you sign every action yourself.

Deleting your account

Request deletion and we fully erase your account and all linked rows (email, wallet address, progress, notes, quizzes, AND your audit events). Technically an admin cascade command does this:

python3 -m spa_core.academy.manage delete-user --email <[email protected]>

The event log is normally append-only (immutable) for audit honesty; account deletion is the one sanctioned exception where your events are erased too.