The short version
You can search and read every page on CourseForFree without an account and without telling us who you are. We do not sell personal data. We run advertising, which uses cookies, and you can turn the personalised part of that off. If you make an account, you can export or delete everything in it at any time, and deletion means deletion.
The rest of this page is the detail behind those four sentences. This policy covers www.courseforfree.com and applies to everyone, everywhere — we do not run a weaker version of it for visitors in countries with weaker laws.
What we collect
In plain English
Signed out, we see anonymous usage patterns and nothing that identifies you. Signed in, we hold your email and the things you chose to save.
If you never sign in
- Usage analytics. Pages viewed, searches run, rough country, device type, and referring site. IP addresses are truncated before storage and we do not attempt to re-identify anyone from them.
- Technical logs. Standard server logs, kept briefly, used for debugging and for blocking abuse.
- Cookie preferences. Your choices about advertising cookies, stored so we do not ask again.
If you create an account
- Account basics. Email address and a hashed password, or the identifier from the provider if you sign in with Google or GitHub.
- Your library. Courses you save, mark as started, or mark as finished.
- Preferences. Subjects, level and language, used to order recommendations.
- Communication settings. Whether you want the newsletter and which emails you have opened, so we can stop sending to people who never read them.
What we never collect
We do not ask for your date of birth, phone number, physical address or payment details. We take no payments, so there is no card data here to lose. We do not buy personal data from brokers to enrich your profile.
Why we collect it
Each purpose, and the lawful basis under GDPR where it applies:
- To run the site — serving pages, remembering your session. Legitimate interests.
- To provide your account — saved courses, progress, preferences. Contract.
- To improve ranking — aggregated, de-identified data about which courses people open and finish. Legitimate interests.
- To send the newsletter — only if you asked for it. Consent.
- To show advertising — non-personalised by default in regions requiring consent, personalised only where you have agreed. Consent.
- To prevent abuse — rate limiting, spam and fraud detection. Legitimate interests.
How long we keep it
- Server logs — 30 days.
- Analytics — 14 months, aggregated.
- Account data — until you delete the account.
- After deletion — purged from live systems immediately and aged out of encrypted backups within 30 days.
- Newsletter — until you unsubscribe, plus a suppression record so we do not email you again by mistake.
Your rights and controls
In plain English
You can see it, take it, correct it or destroy it. Most of this is a button in your account; the rest is one email.
- Access — a copy of everything we hold about you.
- Portability — your library exported as machine-readable JSON.
- Correction — fix anything inaccurate.
- Deletion — erase the account and its data.
- Objection and restriction — object to processing based on legitimate interests.
- Withdraw consent — for email or advertising, at any time, without affecting what came before.
- Non-discrimination — exercising any of these changes nothing about what the site gives you.
Use your account settings, or email [email protected]. We verify identity first, then respond within 30 days. You may also complain to your local data protection authority, though we would rather you gave us the chance to fix it first.
Security
TLS everywhere, encryption at rest, hashed passwords, least-privilege access for the small number of staff who need it, and regular dependency patching. No system is perfect; if we suffer a breach affecting your data we will notify you and the relevant regulator within 72 hours of becoming aware.
Children
CourseForFree is not directed at children under 13 (or under 16 in the EEA and UK), and we do not knowingly collect their data. If you believe a child has created an account, tell us and we will delete it.
International transfers
We operate from the United States and our infrastructure is US-hosted. Where data is transferred out of the EEA, UK or Switzerland, we rely on the European Commission’s Standard Contractual Clauses together with the UK Addendum, and we assess each provider before using it.
Changes to this policy
When we make a material change we will post the revised policy here, update the date at the top, and — if you have an account — email you before it takes effect. We keep previous versions available on request, because a policy you cannot compare against its predecessor is not much of a promise.
Contact
Privacy questions and requests go to [email protected], or by post to CourseForFree, 1100 Congress Avenue, Suite 400, Austin, TX 78701, United States. A named person handles these, not a queue.