Privacy Policy

Last updated: 21 July 2026

1. Who we are

SkyX Study ("we", "us", "the Service") is a self-study flashcard and quiz app for PPL (Private Pilot's Licence) ground school subjects. This policy explains what personal data we collect, why, and what rights you have over it. If you have any questions, contact us at [email protected].

2. Information we collect

We collect the minimum needed to run your account:

  • Account information: your name and email address, and either a securely hashed password or, if you sign in with Google, your Google account's name, email address, and account identifier.
  • Study activity: the quizzes and exams you complete, your scores, and when you completed them, so we can show you your own progress.
  • Technical data: we set two small, essential cookies (access_token and refresh_token) purely to keep you signed in. They're httpOnly, meaning client-side scripts can't read them, and we don't use any advertising or analytics tracking cookies.

3. How we use your information

  • To create and secure your account, and keep you signed in.
  • To record and show you your own quiz and exam history and progress.
  • To protect the Service from spam and automated abuse (see reCAPTCHA below).
  • If you're an administrator, to let you manage lesson content.

We do not sell your data, and we do not use it for advertising.

4. Third-party services

We rely on a small number of third parties to run the Service:

  • Google Sign-In - if you choose to sign in with Google, Google shares your name, email address, and account identifier with us. See Google's Privacy Policy.
  • Google reCAPTCHA - our sign-in and sign-up forms use reCAPTCHA to block automated bots. reCAPTCHA may collect hardware and software information (such as device and application data) and send it to Google. See Google's Privacy Policy and Terms of Service.

5. Data retention

We keep your account and study activity for as long as your account is active. If you'd like your account and associated data deleted, email us and we'll action it within a reasonable time.

6. Data security

Passwords are never stored in plain text - they're hashed with bcrypt. Sign-in sessions use short-lived signed tokens kept in httpOnly cookies rather than exposed to page scripts. No method of transmission or storage is 100% secure, but we take reasonable, industry-standard steps to protect your data.

7. Your rights

You can view and update your name and email at any time from your account settings. You may also ask us to export, correct, or delete your personal data by contacting us at the address above.

8. Children's privacy

The Service is not directed at children under 13, and we do not knowingly collect personal data from them.

9. Changes to this policy

We may update this policy from time to time. If we make material changes, we'll update the "Last updated" date above.