Privacy
There are no accounts. The app doesn't ask for or keep your name, email address, IP address or browser details.
What's kept, and for how long
| What | What it contains | How long |
|---|---|---|
| Session cookie | The site sets one session cookie. It's used only to protect form submissions and limit how often they're sent, with no tracking. It holds random values, not who you are. | Until you close your browser |
| Your answers | The scenario and version, the response and approver you chose for each finding, your score and the time. Used for peer comparisons. Your answers are also added to monthly totals that aren't linked to your attempt; the stats page reads those totals, not the attempts. | 180 days, then deleted (the database removes expired records within a few days) |
| Peer totals | Counts of how many learners chose each response. Not linked to any one attempt. | Kept |
| Monthly stats totals | Per scenario and calendar month: how many learners chose each response and approver, and how many got each score. Not linked to any one attempt. | About 7 months, then deleted (the database removes expired records within a few days) |
| Public Learner stats page | Shows totals only, read from the monthly totals for about the last six months. A scenario shows nothing until it has at least 10 attempts in that window, and percentages are rounded to whole numbers. It never shows individual attempts, times or anything you typed. | Nothing extra kept; worked out from the monthly totals |
| Submission counter | How many times this browser session submitted answers in the current minute, stored against the random session ID. Used only to slow down repeated submissions. | Expires after 2 minutes; the database removes expired records within a few days. |
| Your rationale and note | Shown back to you once on the results page. Never stored or logged. | Not kept |
| Application logs (AWS CloudWatch) | Request IDs, pages requested, response codes and timings. The app doesn't log IP addresses. | 14 days |
| CDN access logs (AWS CloudFront) | Standard logging is turned off. | Not kept |
| Firewall samples (AWS WAF) | Sampled requests used to block abuse, including IP addresses. | Up to 3 hours, kept by AWS |
| Build logs (GitHub Actions) | Logs from building and deploying the site. No learner data. | GitHub's standard retention |