EdVinci LogoEdVinciBack to home

Privacy Policy

Last updated: 18 August 2026

Draft. This describes what the platform actually stores today. It has not been reviewed by a lawyer, and it must be revisited whenever data collection changes — particularly before launch, and before any analytics or third-party tracking is added.

What we collect

Today, EdVinci stores only what is needed to run an account:

  • Your email address, stored in lowercase so that one address means one account.
  • A hash of your password — never the password itself. Passwords are hashed with Argon2id, which is designed to be expensive to crack even if the database is stolen.
  • Whether you have confirmed your email address, and when.
  • If you sign in with Google, GitHub, or LinkedIn: your name, profile picture URL, and that provider’s account identifier.
  • Session records, so that signing out actually ends a session and a stolen session can be revoked.

We do not currently run analytics, advertising, or third-party tracking scripts, and we do not sell personal data.

Cookies

EdVinci sets two cookies, both strictly functional:

  • A session cookie that keeps you signed in. It is HttpOnly, so page scripts cannot read it, and it is scoped so the browser only sends it to authentication endpoints.
  • A short-lived cookie used during social sign-in to verify that the sign-in request came from you. It expires within ten minutes.

There are no advertising or tracking cookies.

Where your data is stored

Account data is held in a managed PostgreSQL database hosted on Amazon Web Services infrastructure. Transactional email — address confirmation and password resets — is sent through Amazon Simple Email Service. Both providers process this data on our behalf.

How long we keep it

  • Account data is kept while your account exists.
  • Session records expire after seven days, and are invalidated immediately when you sign out or reset your password.
  • Password reset links expire after one hour; email confirmation links expire after 24 hours. Both can only be used once.

Your choices

You can change your password at any time through the reset flow, which also signs out every other active session. To request a copy of your data or ask for your account to be deleted, contact us at the address published on the EdVinci website.

Security

Passwords are hashed, session tokens are stored only as digests, and sign-in endpoints are rate limited. No system is perfectly secure, but we aim to keep a database compromise from becoming an account compromise.

Changes

If what we collect changes, this page changes with it, and the date at the top is updated.