Privacy policy
foyl Learn (app.foyl.io, operated by foyl - "we") is a cybersecurity learning platform, offered from the United States. This policy explains what we collect when you create an account, why, and what rights you have. Short version: we never store your email address or any real-world identity - sign-in is GitHub-only, the only name we keep is a display name you choose yourself, we sell nothing, and we run no third-party trackers.
Browsing as a guest: you can explore parts of the platform without an account. In guest mode we create no account and store nothing about you on our servers; progress is buffered in your browser only when you enable saved learning activity, and can migrate to your account on sign-in while that permission remains enabled. See the cookie policy for details.
Your collection choices
Optional page analytics and learning recording start off. Reject cookies stops both, including progress, answers, exam attempts, report submissions and Shift recording. You can enable saved learning activity independently of analytics in Privacy choices. Shifts require saved activity to run. Rejection clears unsent learning buffers and practice caches on this browser; it does not erase previously saved account work or recall requests already sent. Essential sign-in, security and requested account operations continue.
What we collect
| Data | Source | Why we need it |
|---|---|---|
| GitHub account ID (an opaque number) | GitHub, when you sign in | The only thing that identifies your login |
| Display name | You, chosen on first login (not taken from GitHub) | Showing you your account, and naming you to instructors and classmates |
| Avatar (optional) | Your public GitHub avatar image | Showing you your account |
| Class display name (optional - e.g. "Aidan H.") | You, on your progress page | Identifying you to your instructor and classmates inside classes you join - it appears nowhere else |
| Account type (student / instructor) | Your choice at sign-up | Tailoring the platform to how you use it |
| Learning progress (status, scores, checkpoints, practice-exam domains, scored answers/retries, report-builder work products, and foyl Shift reasoning trails) | Your activity on the platform | Progress tracking, feedback, and identifying concepts to revisit |
| foyl Shift activity (alert decisions, evidence selections, notes, response actions, linked console-record visits, case flow, and scores) | Your activity while working a shift | Running the timed exercise, preserving your reasoning trail, scoring your work, and supporting instructor review when the shift is assigned through a class |
| Class membership (if you join an instructor's class with an invite code) | Your choice | Letting your instructor see your progress |
| Sign-in events and session timestamps | Your activity | Security and abuse prevention |
We never store your email address. Sign-in is GitHub-only; we ask GitHub for your account id, public username, and avatar - and we never request or read your email. There are no passwords either. The only name we keep is the display name you type yourself; we do not copy your real name from GitHub.
What we deliberately do not store: email addresses, raw IP addresses, and browser user-agents are never written to sessions, tokens, or audit logs. The one exception for IPs is abuse prevention: to rate-limit requests we keep a salted hash of your IP (never the raw address) inside transient counters that are automatically purged within 24 hours - it is never linked to your account and never used for analytics. Optional site analytics are aggregate daily counters per page with no link to any account, recorded only when page counts are enabled in Privacy choices.
Instructor visibility: if you join a class, that class's instructor can see your display name, your optional class display name, your progress, checkpoints, certificates, and work on class-assigned shifts, including status, attempts, reasoning activity, and scores. They never see an email, because we hold none. Your class display name may also be visible to classmates in the same class, and is never shown outside your classes. Leave the class (or ask the instructor to remove you) to stop sharing; your progress itself stays yours. You can clear your class display name at any time on your progress page.
Age requirement
foyl Learn is built for college-level students, career changers, and working professionals. You must be at least 16 years old to create an account (see the terms of service). The platform is not directed at children, is not offered for K-12 use, and we do not knowingly process data of anyone under 16 - if we learn of such an account we will delete it. Instructors may not direct learners under 16 to create accounts.
Service providers
- Cloudflare - hosting and database infrastructure.
- GitHub - sign-in ("Continue with GitHub"); GitHub's own privacy policy governs what GitHub does. If your account has an avatar, the image is loaded straight from GitHub's image server (avatars.githubusercontent.com) when your account menu or account page shows it, so GitHub may see your IP address in that request.
- Google Fonts - typefaces are loaded from Google's CDN; Google may see your IP in that request.
No analytics providers, no advertising networks, no data brokers. The foyl.io home page and The Brief are covered by the foyl site privacy notice.
Retention
- Account and progress data: kept while your account exists.
- Sessions: expire after 30 days of inactivity and are then deleted.
- GitHub sign-in state tokens: single-use and expire after 10 minutes.
- Security audit events: kept up to 12 months, then purged.
- Solo foyl Shift run state: kept for 24 hours for student accounts and 7 days for instructor accounts.
- Class-assigned foyl Shift run state: kept for 180 days so instructors can review the reasoning trail.
- foyl Shift result summaries: kept while your account exists. These contain the score and rubric dimensions, not the full reasoning trail.
Your rights
Wherever you live, every account gets the same rights: access, export, correction, and deletion. We do this because it is the right way to treat learner data, not because a particular law compels it. Both core rights are self-service on the privacy & data page: Export my data downloads everything as JSON (profile, progress, checkpoints, exam attempts, scored responses, report work products, foyl Shift runs and results, classes, activity); Delete my account permanently erases progress, checkpoints, exam attempts, scored responses, report work products, foyl Shift runs and results, class memberships, and sessions, and anonymizes your profile and activity log. For anything else, contact support@foyl.io.
Cookies
Covered in the cookie policy. All cookies are strictly necessary; there are no advertising or analytics cookies.
Changes
Material changes to this policy will be flagged on the sign-in page and the consent banner will re-prompt.