Privacy Policy

What we collect

We hold what you type into one of our forms, plus the small amount your browser sends when it loads a page. Nothing is bought in from anywhere else.

If you join the waitlist

Your email address, your name, your WhatsApp number, and your answers to two questions: where you are right now (working in tech, working outside tech, job hunting or studying) and how much you already know. One entry per email address. Sign up twice with the same address and the second attempt is rejected rather than stored.

If you write to us on the contact page

Your name, your email address and whatever you put in the message box. The WhatsApp number on that form is optional and the page submits fine without it.

If you make an account

Your name and your email address. If you set a password we store a hash of it rather than the password itself, so nobody here can read it or tell you what it is. If you sign in with Google instead, Google tells us your name, your email address and your Google account id. That is everything we ask them for. We cannot see your Gmail, your Drive or your contacts.

The questions we ask after you sign up

Six answers: where you are in your career, what you want out of this, how much you already know, how fast you want to move, how many minutes a day you plan to spend, and what time of day you learn. They decide which path we put in front of you. There is one set of answers per account, so filling the questionnaire in again replaces the old answers instead of piling up next to them.

If you turn on two-factor authentication or a passkey

Two-factor authentication means we store your secret key and your recovery codes, both encrypted. A passkey means we store a public credential, the name you gave the device and the date it was last used. Your fingerprint or your face never reaches us. That check happens on your own device, and the device only tells us whether it passed.

What your browser sends on its own

While you are signed in we keep a session row holding a random session id, your account id, your ip address, your browser's user agent string and the time you were last active. Sessions expire after about two hours of sitting idle.

Cookies

Two of them, and neither one follows you anywhere. The first holds your session so you stay signed in as you move between pages. The second carries a token that proves a form submission came from our own site rather than someone else's. No advertising cookies, and nothing that reports back to another company.

What we do not do

There is no Google Analytics on this site. No Facebook pixel, no session recorder, no heatmaps, no tag manager. The fonts load from our own build rather than from a font service, so opening a page here does not tell any outside company that you were here. You can check that yourself in the page source.

We do not sell your details, rent them out or pass them to advertisers. We asked for your WhatsApp number so we can reach you about the course, and that is the only thing it gets used for.

Who else touches your data

Very few:

• Google, but only if you choose to sign in with Google. Doing that tells them you signed in here, the same as it would on any other site with a Google button.
• The company hosting our servers and database, because your data sits on machines we rent from them. They do not read it.
• An email provider, once we start sending email. For now the only message you should expect from us is the one saying we have opened.

If you join the WhatsApp group we link to after you sign up, that group is WhatsApp's product and their rules apply once you are inside it. Joining is optional and nothing in there is tied to your account here.

How long we keep things

Waitlist entries stay until we open and for a short while after, since the launch email is the entire reason for the list. Contact messages stay so we still have the thread if you write again. Account data stays as long as the account does. Session rows clear themselves as they expire.

Getting your data deleted

If you have an account, open Settings, go to Profile and use Delete account. It happens straight away, and it takes your onboarding answers and any passkeys with it.

The waitlist and the contact form sit apart from accounts, so deleting an account does not clear those. Email mail@projectshift.app from the address you signed up with and we will take the entry out. Use the same address if you want to know what we hold on you, or if something we have is wrong and you want it fixed.

Children

This is built for working adults and students, not for children. If you are under 13, please do not sign up.

Changes to this page

When we change this page we change the date at the top. If a change actually matters, for example if we start using something that collects data we were not collecting before, we will email account holders about it rather than quietly edit the page and hope nobody notices.