Privacy Policy

Overview

IT Lunchroom provides free everyday technology lessons and an optional workspace LMS. This policy explains what we collect, how we use it, and the choices you have. You can use the public lessons without an account.

What we collect

Account information: if you sign in, our authentication provider stores your email address and basic identity.

Contact and consent: if you opt in to updates, we record your marketing consent with the date and source, so we can honor your choice and prove it was yours.

Email domain: we use the domain of your email address (the part after the @) to tailor which updates are relevant — for example, team-focused information for work addresses.

Certificates: when you finish a lesson you can create a certificate. It is private until you choose to share it; a shared certificate has a public page showing your name, the lesson, and the date — never your email. You can make a shared certificate private again at any time.

Learning progress: completed lessons, draft notes you write, policy acknowledgements, the tools you select, and placement answers. By default this is saved only in your browser. If you sign in and sync is enabled, it is also saved to your private account record.

We do not request or need sensitive or regulated personal data. Please do not enter it into free-text notes.

How we use it

We use this data to provide the lessons, save and resume your progress, and—for organizations—produce completion and evidence records. With your permission, we also send occasional emails about new lessons and security tips; you can withdraw that consent at any time. We do not sell your data or use it for advertising.

Marketing communications

Marketing emails are strictly optional and opt-in. We verify your email address when you create your account, so checking the opt-in box is all it takes — we never add you without that explicit choice.

Every marketing email has a one-click unsubscribe, and unsubscribing does not affect essential emails about your account.

We aim to email only occasionally, and only with genuinely useful content.

Service providers

We rely on Clerk for authentication (including account-verification emails), Supabase for private progress and contact storage, Cloudflare for hosting and delivery, Google Analytics for aggregate, anonymous usage measurement, and—for optional opt-in update emails—SendGrid. Each processes data only to provide their part of the service.

Your choices and rights

Use without an account: the public lessons work with browser-only storage.

Export: go to My tools and choose Export my data to download a copy of your progress.

Delete: go to My tools and choose Delete my data to remove your saved progress from this browser and, if signed in, from your account.

Account deletion: you can delete your account from your account settings, which removes your identity record.

Email preferences: unsubscribe from any marketing email with one click; this withdraws your consent, and essential account emails are unaffected.

Questions or requests: contact privacy@itlunchroom.com.

Regional privacy rights

European Economic Area, UK, and Switzerland (GDPR/UK GDPR): we process account and progress data to provide the service you asked for (performance of a contract), marketing only with your consent, and analytics only with your consent — analytics cookies are off by default in these regions until you accept them in the cookie notice. You have the right to access, correct, export, delete, restrict, or object to processing of your data, and to lodge a complaint with your local supervisory authority.

California (CCPA/CPRA): we do not sell your personal information and do not share it for cross-context behavioral advertising. You have the right to know what we collect (listed above), to delete it (see Your choices and rights), and to not be discriminated against for exercising these rights.

To exercise any of these rights, use the self-serve tools above or contact privacy@itlunchroom.com.

Cookies and local storage

We use your browser's local storage to keep your progress. When you sign in, our authentication provider sets cookies needed to keep you signed in. We also use Google Analytics, which sets cookies to measure aggregate, anonymous usage of the site; you can accept or decline these in the cookie notice, and in the EEA, UK, and Switzerland they are off unless you accept. We do not use third-party advertising cookies.

Data retention

Browser-stored progress remains until you clear it or use Delete my data. Account-stored progress remains until you delete it or your account.

Marketing-consent records are kept while your account is active and for a reasonable period afterward to honor unsubscribe requests.

Changes

We may update this policy; the date above reflects the latest version.