Privacy Policy

Working draft of 31 October 2026. Like our Terms, this has not yet been reviewed by counsel. It replaces the draft of 30 October 2026 and adds Microsoft Clarity, described in sections 3 to 5.

1. The short version

We collect what it takes to run your account, your courses, your simulations and your payments. We also measure visits and the results of our ads with Google Analytics and the Meta Pixel, and see how pages are used with Microsoft Clarity. You can turn all of that off at any time in the cookie banner. We do not sell or rent data to anyone, and we never will.

2. What we collect

  • Your account. Your email address, your name and your password. The password is stored as a secure hash by our authentication provider; nobody at Pixel Academy can read it. If you sign in with Google, Google shares your name, email address and profile picture with us. We also note the language you signed up in, so our emails reach you in it.
  • Your profile, if you fill it in. First and last name, a photo, a short bio, a website and a LinkedIn link. Your photo is stored so that anyone with its link can open it.
  • Your learning. Which lessons you finish - when you press "Mark as finished", or when a lesson video plays to the end.
  • Your simulations. Your Time Machine runs: the settings you chose, your trades, your answers to the questions during a flight, the results and, on plans that keep them, the reasons you pick for a trade.
  • Your payments. The plan you bought, its price, and the payment record our payment provider sends us: amount, currency, network, status and transaction references. Payments are made in crypto through NOWPayments; we never see or store card details.
  • Invites and challenges. Your personal invite code, who signed up through it, and the challenge links you create. A challenge page shows the moment and your result, not your name.
  • The OTC knowledge test. Whether you passed it, so you do not have to take it again on another device.
  • The waitlist. If you join it, your email address, the language of the page you joined from and which form you used.
  • Messages. What you write to us by email.
  • Technical data. Our hosting provider keeps standard logs (IP address, page requested, time) to run and secure the site. Sign-up, log-in and waitlist forms are guarded by Cloudflare Turnstile, which checks that you are a person.

3. Cookies and storage in your browser

Only what the site needs to work:

  • Sign-in cookies that keep you logged in.
  • Your language choice (pa-lang).
  • An invite or challenge you arrived through (pa_ref for 30 days, pa_challenge for 7 days), so it still counts if you sign up later.
  • Cloudflare Turnstile's own cookie during the bot check.
  • Small settings kept in your browser only: light or dark theme, folded menus, and a passed OTC test on that device.
  • Your cookie choice (pa_consent), and for ten minutes after you sign up or log in a short note (pa_evt) that lets the next page report it.
  • Measurement cookies, unless you turn them off: Google Analytics (_ga, _ga_* and FPID) to count visits and see which pages and courses people use, and the Meta Pixel (_fbp, _fbc) to measure and improve our ads on Facebook and Instagram.
  • Microsoft Clarity (_clck, _clsk), unless you turn measurement off: recordings of how a page is used (clicks, scrolling, where people stop) and heatmaps, to fix pages that confuse people. All text on the page and everything you type is masked before it leaves your browser, so Clarity never sees your name, email, answers or payment details.

Measurement is on by default. Choose "No thanks" in the cookie banner and it stops: no Google Analytics, Meta or Clarity cookies are used, nothing is recorded, and nothing about you is sent to Google or Meta from our servers either. To change your choice later, clear this site's cookies and the banner comes back.

4. What we deliberately do not do

  • No reading of what you write: Clarity records with all text masked, and never records keystrokes.
  • Your email never reaches Google or Meta in readable form: when a sign-up or a payment is reported to them, only a one-way hash of it is sent, so they can match it to an account they already know and nothing more.
  • No selling, renting, or trading of your data - not now, not ever.
  • No marketing emails you did not ask for. Your account gets account emails (confirming your address, resetting a password, changing your email); the waitlist gets news about the platform.

5. Who touches the data

A small set of service providers runs the platform for us, and each processes data only to provide that service:

  • Supabase - our database, accounts and file storage, and the emails about your account.
  • Cloudflare - hosting and its logs, the course videos, and the bot check.
  • NOWPayments - crypto payments. When you pay, you do it on their checkout page, and their privacy policy applies there.
  • Google - sign-in with Google if you choose it, and Google Analytics and Google Tag Manager to measure visits, unless you turn measurement off.
  • Meta - the Meta Pixel and the Conversions API, to measure and improve our ads on Facebook and Instagram, unless you turn measurement off. What we send: the pages you visit, a sign-up, the start of a payment and a completed payment, with hashed identifiers.
  • Stape - runs our own measurement server (on a pixelacademy.io address) that passes these measurements to Google and Meta.
  • Microsoft - Clarity, for masked page recordings and heatmaps, unless you turn measurement off.
  • YouTube or Vimeo - only for a lesson whose video is hosted there; their player and their policy apply to it.

These providers may process data in other countries. Inside Pixel Academy, our team can see accounts and payments through an admin panel, to answer support questions and to check payments - for nothing else.

If you share a challenge link on Telegram, WhatsApp, Facebook, X or LinkedIn, the link goes wherever you send it, under that service's rules.

6. How long we keep it

Your account data stays while your account exists. When you ask us to delete your account, we delete it together with your profile photo, your learning progress, your simulations, your invites and your challenges. Payment records are kept for as long as accounting and tax rules require, without a link to the deleted account. Waitlist emails stay until you ask us to remove them. Server logs are kept by our hosting provider for its standard, limited period.

7. Your rights

Write to us and we will tell you what we hold about you, send you a copy, correct it, or delete it - including removing you from the waitlist, any time, no questions asked. Account deletion is done by a real person on request; there is no button for it yet.

8. Changes

When the platform starts collecting something new, this page changes first, with a new date at the top - the same way our Terms handle it.

9. Contact

Anything about your data: info@pixelacademy.io. A real person reads it and can actually do the deleting.