Privacy
What we keep, and why
Written to be read, not just ticked.
Data processed
| What | Why |
|---|---|
| Username, role | To authenticate you and know what you're allowed to do. |
| Course progress | So you can't skip steps and so a pass can be granted. |
| Answers to checks, declared confidence, time | For your report and the professor's aggregated report. |
| Learning signals (pace, re-reads, interruptions) | For the learning companion. Behavioural only — no camera, no biometric data. |
| Number of window exits | An academic-integrity hint, visible to the professor. |
| IP address, temporarily | Only for login rate-limiting. Deleted automatically within 24 hours. |
What we do NOT do
- We don't ask for an e-mail, real name or contact details.
- We don't use tracking or analytics cookies. The only cookie is the session cookie.
- The learning companion uses no camera and no biometric data — it observes how you interact with the material, not you.
- We don't transmit data outside this server — except the page-translation widget, see below.
Page translation (third party)
The "Translate" control at the top of the page uses Google Translate. If you use it, the visible page text and your IP address are sent to Google so the translation can be produced. If you don't use it, nothing is sent. The course content itself is already provided bilingually (Romanian / English) and does not need this.
For the institution to decide: whether to keep this widget
enabled. It brings a third-party processor into the data flow. It can be turned off in one
line of configuration, leaving the platform fully self-contained. A privacy-preserving
alternative is the browser's own built-in translation (Chrome, Edge), which the institution
can recommend instead.
Your rights
You can download your data or delete your account anytime, yourself, from My account. Passwords are stored as a cryptographic fingerprint (PBKDF2-SHA256, 200,000 iterations) — not even the administrator can read them.
For the institution to complete: the data controller, the legal basis for
processing, the retention period for results, the data protection officer's contact and, if
applicable, the impact assessment. The platform implements the technical measures; the legal
qualification is set by the institution.