Privacy Policy
Last updated: 7 August 2026
Cyber Dojo is a mobile app for learning cybersecurity. This policy explains what personal data we collect, why we collect it, who we share it with, and what rights you have over it.
The data controller is Cyber Dojo, London, United Kingdom. You can reach us at hello@cyberdojo.app.
What we collect
| Data | Why | Legal basis (UK GDPR) |
|---|---|---|
| Email address | To create your account, sign you in, and let you recover access | Performance of a contract |
| Apple or Google account identifier, if you sign in that way | To identify your account without you needing a password | Performance of a contract |
| Your learning progress — which lessons you have completed, total XP, your daily streak | To show your progress and keep it in sync if you reinstall or change device | Performance of a contract |
| Your chosen learning path and the answers you gave during onboarding | To recommend a path and show you the right lessons | Performance of a contract |
| Your subscription status | To unlock paid content for subscribers | Performance of a contract |
| Whether you opted in to reminders, and your daily goal | To send the reminders you asked for | Consent, which you can withdraw at any time |
We do not collect: your name, your location, your contacts, your photos, your device identifiers for advertising, or anything from other apps. We do not use advertising or analytics trackers, and we do not build a profile of you for marketing.
We never see your payment details. Subscriptions are purchased through Apple. Apple handles the payment and tells us only whether a subscription is active. We do not receive or store your card details or your Apple ID.
Who processes your data
We use a small number of service providers. Each acts on our instructions and is bound by a data processing agreement.
| Provider | What they do | Where |
|---|---|---|
| Supabase | Stores your account and learning progress | European Union |
| RevenueCat | Manages subscription status | United States |
| Apple | Processes payments and, if you use it, Sign in with Apple | Global |
| Sign in with Google, if you use it | Global |
Where a provider is outside the UK or EU, transfers are covered by the UK International Data Transfer Addendum or Standard Contractual Clauses.
How long we keep it
We keep your account and progress for as long as your account exists. If you ask us to delete your account, we remove your data within 30 days, except where we are required to keep records for tax or legal reasons — for example, Apple's record of a purchase.
If you do not use your account for three years, we will delete it.
Your rights
Under UK GDPR you have the right to:
- Ask what data we hold about you, and get a copy
- Correct anything that is wrong
- Have your data deleted
- Object to how we use it, or ask us to restrict it
- Receive your data in a portable format
- Withdraw consent for reminders at any time, in your device settings
To exercise any of these, email hello@cyberdojo.app. We will respond within one month.
If you are unhappy with how we have handled your data, you can complain to the Information Commissioner's Office at ico.org.uk.
Children
Cyber Dojo is not intended for children under 13, and we do not knowingly collect data from them. If you believe a child has given us their data, email us and we will delete it.
Security
Your data is encrypted in transit and at rest. Access to the database is restricted so that you can only read and write your own records. We do not have a way to see your password — sign-in is handled by Supabase, Apple or Google.
No system is perfectly secure. If a breach affects your data, we will tell you and the Information Commissioner's Office as the law requires.
Changes to this policy
If we change this policy we will update the date at the top. If a change is significant, we will tell you in the app before it takes effect.