Privacy policy

Last updated: August 4, 2026

The short version

This site is operated by RouteSwitchU, a Colorado sole proprietorship. We collect the information needed to provide accounts, course access, progress syncing, and support. We do not require an email address for a course account. We do not sell personal information, use it for targeted advertising, or store payment-card details. You can export or close your account from the account page.

Information we collect

  • Account information: your username, optional display username, optional contact email, account timestamps, and account status.
  • Authentication information: one-way password and recovery-code verifiers, hashed session identifiers, and short-lived signed access claims. We do not store your plaintext password or recovery code.
  • Course information: entitlements, the minimum purchase reference needed to support access or a refund, course progress, and transitional protected-download records while that legacy delivery path is retired.
  • Security information: account security events, bounded abuse-attempt records, timestamps, and keyed hashes derived from network addresses and account identifiers. These help us prevent misuse without retaining a raw address in the application database.
  • Historical subscriber and support information: preserved subscriber records can include an email address, consent choice, signup source, and signup time. New course accounts do not use this list. Support information is whatever you choose to include when contacting support.

How we use it

We use this information to create and secure accounts, maintain sign-in sessions, authorize course and lab access, sync progress, fulfill purchases when commerce is enabled, respond to support requests, prevent abuse, recover from service failures, and meet accounting or legal obligations. Email possession is not used as proof that someone owns a RouteSwitchU account.

Browser storage and cookies

Browser storage keeps reading preferences, local progress, browser-lab completion markers, and editable lab drafts on your device. Lab source is not uploaded by default. If you are signed in, supported lesson-completion progress is sent to our account service so it can follow you between devices.

We use necessary, first-party cookies to maintain a signed-in session and authorize free or paid lesson access. They are Secure, HttpOnly, SameSite cookies and are not advertising cookies. We do not currently use behavioral advertising or third-party analytics cookies.

Service providers

Vercel hosts the website and server-side functions and may process request and operational log information. Neon hosts the production PostgreSQL database. Course software assets are served from RouteSwitchU's own site rather than executed from a third-party content-delivery network. These providers process information to provide their services to us.

If paid checkout is enabled, Stripe will process payment and billing information on Stripe-hosted surfaces under Stripe's own privacy terms. RouteSwitchU will receive only the minimum transaction reference and status needed to grant and support access. Payment-card details must not enter RouteSwitchU's database or logs.

We do not sell or rent personal information. We disclose information when needed to operate these services, when you direct us to, or when required to protect rights, safety, and legal obligations.

Retention and deletion

  • Unentitled accounts may be deleted after 30 days without a successful login or purchase.
  • Expired sessions are removed daily, and routine abuse records are removed after 24 hours.
  • Security events are normally kept for 365 days unless needed for an active incident.
  • Progress and account profile data are removed when an account is closed.
  • Closing an account does not clear drafts, completion markers, or preferences stored by this site in a browser. You control that copy through the browser's site-data controls.
  • A minimal entitlement or purchase reference may remain while support, refund, accounting, or legal obligations apply.
  • Historical subscriber records are separate from course accounts and are deleted on a verified request, except for a minimal suppression record when needed to honor an opt-out.
  • Encrypted production backups are designed to retain 30 daily recovery points. A deletion can therefore remain in a rotating backup until that recovery point expires. A restored backup must have later deletion requests reapplied before normal service resumes.

Incident evidence may be isolated and kept longer when necessary to investigate and meet legal obligations. We limit it to what the investigation requires.

Your choices

Signed-in customers can download an account-data export, sign out every device, or close their account from the account page. These sensitive actions require the current password. The export excludes passwords, recovery codes, hashes, session tokens, internal abuse records, other customers' information, and browser-local lab drafts that the account service does not possess.

To correct account information, request help with a historical subscriber record, or ask a privacy question, contact hello@routeswitchu.com. We may need to verify a request before acting. An email, receipt, or claimed identity by itself is not enough to recover an account.

Children

RouteSwitchU is intended for professional and adult learners and is not directed to children under 13. Please contact us if you believe a child provided account information.

Security and changes

We use technical and operational safeguards designed for the information we maintain, but no internet service can guarantee absolute security. We may update this policy when the product, providers, or legal requirements change. The current version and update date will remain on this page.

Contact

Privacy and data requests: hello@routeswitchu.com.