Privacy policy

Last updated: July 25, 2026

The short version

RouteSwitchU is operated by Brent Leekley, a Colorado sole proprietor doing business as RouteSwitchU. We collect the information needed to provide accounts, course access, progress syncing, support, and optional announcements. We do not sell personal information, use it for targeted advertising, or store payment-card details. You can export or close your account from the account page.

Information we collect

• Account information: your username, optional display username, optional contact email, account timestamps, and account status.
• Authentication information: one-way password and recovery-code verifiers, hashed session identifiers, and short-lived signed access claims. We do not store your plaintext password or recovery code.
• Course information: entitlements, the minimum purchase reference needed to support access or a refund, course progress, and transitional protected-download records while that legacy delivery path is retired.
• Security information: account security events, bounded abuse-attempt records, timestamps, and keyed hashes derived from network addresses and account identifiers. These help us prevent misuse without retaining a raw address in the application database.
• Subscriber and support information: an email address, consent choice, signup source, and time when you join a course or announcement list, plus whatever you choose to include when contacting support.

How we use it

We use this information to create and secure accounts, maintain sign-in sessions, authorize course and lab access, sync progress, fulfill purchases when commerce is enabled, respond to support requests, prevent abuse, recover from service failures, and meet accounting or legal obligations. Email possession is not used as proof that someone owns a RouteSwitchU account.

Browser storage and cookies

Browser storage keeps reading preferences, free-course enrollment state, local progress, browser-lab completion markers, and editable lab drafts on your device. Lab source is not uploaded by default. If you are signed in, supported lesson-completion progress is sent to our account service so it can follow you between devices.

We use necessary, first-party cookies to maintain a signed-in session and authorize paid content. They are Secure, HttpOnly, SameSite cookies and are not advertising cookies. We do not currently use behavioral advertising or third-party analytics cookies.

Service providers

Vercel hosts the website and server-side functions and may process request and operational log information. Neon hosts the production PostgreSQL database. Course software assets are served from RouteSwitchU's own site rather than executed from a third-party content-delivery network. These providers process information to provide their services to us.

If paid checkout is enabled, Stripe will process payment and billing information on Stripe-hosted surfaces under Stripe's own privacy terms. RouteSwitchU will receive only the minimum transaction reference and status needed to grant and support access. Payment-card details must not enter RouteSwitchU's database or logs.

We do not sell or rent personal information. We disclose information when needed to operate these services, when you direct us to, or when required to protect rights, safety, and legal obligations.

Retention and deletion

• Unentitled accounts may be deleted after 30 days without a successful login or purchase.
• Expired sessions are removed daily, and routine abuse records are removed after 24 hours.
• Security events are normally kept for 365 days unless needed for an active incident.
• Progress and account profile data are removed when an account is closed.
• Closing an account does not clear drafts, completion markers, or preferences stored by this site in a browser. You control that copy through the browser's site-data controls.
• A minimal entitlement or purchase reference may remain while support, refund, accounting, or legal obligations apply.
• Encrypted production backups are designed to retain 30 daily recovery points. A deletion can therefore remain in a rotating backup until that recovery point expires. A restored backup must have later deletion requests reapplied before normal service resumes.

Incident evidence may be isolated and kept longer when necessary to investigate and meet legal obligations. We limit it to what the investigation requires.

Your choices

Signed-in customers can download an account-data export, sign out every device, or close their account from the account page. These sensitive actions require the current password. The export excludes passwords, recovery codes, hashes, session tokens, internal abuse records, other customers' information, and browser-local lab drafts that the account service does not possess.

To correct account information, request help with a subscriber record, or ask a privacy question, contact hello@routeswitchu.com. We may need to verify a request before acting. An email, receipt, or claimed identity by itself is not enough to recover an account.

Children

RouteSwitchU is intended for professional and adult learners and is not directed to children under 13. Please contact us if you believe a child provided account information.

Security and changes

We use technical and operational safeguards designed for the information we maintain, but no internet service can guarantee absolute security. We may update this policy when the product, providers, or legal requirements change. The current version and update date will remain on this page.

Contact

Privacy and data requests: hello@routeswitchu.com.