Privacy

Privacy

Written by reading the application's own schema and source rather than from a policy template. Where this page makes a claim, it is a claim about code that exists.

What signing in gives Chiron

Chiron uses LinkedIn as its identity provider, requesting three OpenID Connect scopes: openid, profile, email. From that it receives and stores:

• a stable subject identifier from the provider,
• your name,
• your email address,
• your profile picture URL.

That is the whole of what comes from LinkedIn. Chiron cannot read your connections, your feed, or your messages, and it never posts anything.

What the application stores about you

Stored	What it holds
Account	Your identifier, name, email, picture URL, role, when the account was made, and when you last signed in
Linked identities	Which provider and subject identifier are attached to your account, so a second sign-in method resolves to one person
Practice sessions	Domain, mode, length, number correct, elapsed time, start and finish
Individual answers	Which question, which option you chose, whether it was right, how long you took, when
Concept state	Per concept: an estimate of whether you know it, how much evidence there is, how many distinct days you have shown it, and when
Exam date	An optional target date per domain
Support reports	Your message, which page you were on, and your account id if you were signed in

The purpose of the per-answer and per-concept records is the product itself: questions you keep missing come back around, and concepts you have established stop being drilled.

What is not collected

Verified by searching the source for each:

• No IP addresses. Not stored, not logged.
• No analytics or telemetry. No Google Analytics, no Plausible, no PostHog, no Sentry, no beacons of any kind.
• No advertising or tracking pixels.
• No third-party scripts. The application loads its own code and nothing else.
• No cross-site tracking. The only cookie is the session cookie described below.

The session cookie

One cookie. It holds a signed token identifying you, and it is set with:

• HttpOnly — page scripts cannot read it, so a scripting flaw cannot steal it.
• Secure — sent over HTTPS only.
• SameSite=Lax — not sent on cross-site requests.
• A 24-hour lifetime. After that you sign in again.

The token carries your identifier, provider subject, name, email, picture URL, tenant, role, tier, and issue/expiry times. Signing out clears it immediately.

What gets written to the server log

Three things, and it is worth being specific because "we log for security" is usually where policies go vague:

1. A refused administrative request logs the identity strings the caller presented. This exists so a legitimate reviewer locked out by a configuration mistake can be diagnosed, and it means an attempt on an administrative route records the attempting identity.
2. A filed support report logs its identifier, the page, and whether the reporter was signed in. The message body is deliberately not logged — it is written to the database and read from there.
3. A failed background update of concept state logs the error message.

Logs are operational output on the hosting platform, not a product surface.

Where the data lives

On Cloudflare's platform: a database for accounts and progress, object storage for the question banks and lesson text, and the application itself running at the network edge. Cloudflare is the only third party that necessarily sees traffic, in its role as host.

Anonymous use

Signing in is required to practise. Chiron does not run an anonymous tier — progress is recorded against a person, and there is no way to record progress for someone who has not said who they are.

Three things do not require an account: the public pages, the sign-in exchange itself, and the support form. The support form is deliberately open, because the person most likely to need help is the person the sign-in turned away.

What this page does not do

It is not a contract, and it is not legal advice. It is an accurate description of what the software does as built. If you need a formal data-processing agreement or a deletion process with a defined turnaround, those do not exist yet, and you should assume so rather than infer them from this page.