Privacy

Groundwork is a personal project built and run by Rodney Lunt, not a registered business. This page describes what the app actually stores, in plain terms.

What's collected

If you sign in with email and password: a username, an email address, and an argon2id password hash (never the password itself). If you sign in with GitHub or Google: a username and avatar URL from that provider, nothing else is pulled from your account there.

While you use the app: which modules you've started or completed, and the text of the hands-on task submissions you write, so your progress can be shown back to you and checked. If your organisation has an admin, they can see your per-module progress and your submission text for modules assigned to your cohort, this is disclosed before you sign up through a cohort code.

If you use the request-access form: the name, email, and message you type in. There's no mailing list and nothing is sent anywhere else, it's read directly by the operator.

Where it's stored

Everything above lives in a SQLite database on the server this app runs on. There's no third-party analytics, advertising, or tracking script on this site, nothing here is sold or shared with anyone else. The site sits behind Cloudflare's network (for TLS and basic bot protection), which processes ordinary connection metadata (like your IP address) the way any reverse proxy does, but Groundwork itself doesn't send your data to Cloudflare beyond that.

Sessions and cookies

Signing in sets one session cookie, marked HTTP-only and same-site, so it isn't readable by page scripts and isn't sent cross-site. The session itself is stored server-side in the same SQLite database, not in the cookie.

Deleting your data

There's no self-service account deletion yet. Use the request-access form, or reach the operator through the GitHub profile linked in the footer, and ask for your account to be removed.

Changes

This is a small, actively-developed project. If what's collected or how it's stored changes materially, this page will be updated to match, this isn't a page that's kept accurate by a separate legal process.