Privacy Policy
Effective date: 2 July 2026
ThreatDrill ("we", "us") is a cybersecurity learning and threat-intelligence app. This policy explains what we collect, why, and the choices you have. We keep it short and honest.
The short version
- You can use ThreatDrill without an account — your progress stays on your device.
- If you sign in, we store your email and learning progress so it can sync across your devices.
- We do not sell your data, and we don't use it for advertising or tracking.
- You can export your data and permanently delete your account and all synced data at any time, from inside the app (Profile → Account).
What we collect
Account information (only if you sign in)
- Your email address, used solely to send a one-time sign-in code and to identify your account.
Learning data
- Your progress: lessons completed, knowledge-check results, streaks, earned badges, saved threats, your chosen role, and a display name if you set one.
- When you're signed in, this is synced to our backend so you can pick up on another device. When you're not signed in, it stays only on your device.
We do NOT collect your location, contacts, photos, precise device identifiers for tracking, or payment information.
How we use your data
- To provide the app's core features (save and sync your learning progress).
- To authenticate you (the one-time email code).
- Nothing else. No advertising, no profiling, no sale of data.
Where your data is stored
- On your device, using local storage (the app is offline-first).
- In our backend, if you sign in — hosted on Supabase. Data is protected in transit (TLS) and by per-user access controls (row-level security) so only you can read your rows.
Third parties
- Supabase — backend database, authentication, and email delivery for your sign-in code. Supabase processes this data on our behalf.
- CISA Known Exploited Vulnerabilities feed — the app shows live public threat data fetched through our own proxy. No personal data is sent when fetching threat data.
We do not share your personal data with anyone else.
Your rights and choices
- Use without an account — core features work locally with no email required; cross-device sync and Premium access require signing in.
- Export your data — Profile → Account → Export my data produces a copy of your synced data.
- Delete your account — Profile → Account → Delete account permanently removes your account and all synced data from our backend, and clears it from your device. This cannot be undone.
Data retention
We keep your synced data until you delete your account, at which point it is removed.
Children
ThreatDrill is not directed to children under 13 (or under 16 in the EEA/UK). We do not knowingly collect data from children.
Security
We protect data in transit with TLS and restrict access to your rows with per-user database policies. No system is perfectly secure, but we follow reasonable, current practices.
A note on badges
ThreatDrill badges and certificates recognize completion of in-app training only. They are not professional certifications and imply no accreditation by, or affiliation with, any third party.
Changes to this policy
We may update this policy; we'll revise the effective date above and, for material changes, note it in the app.
Contact
Questions or requests: joey19154@gmail.com