Privacy Policy

1. The Short Version

We collect the minimum amount of data needed to run the platform. We don't sell your data, we don't share it with advertisers, and we don't do anything sketchy with it. We use it to make the platform work and to send you things you've actually opted into.

2. What We Collect

When you use The Lazy Developer, we may collect:

• Account info: Your email address when you sign up. That's the main one.
• Progress data: Which modules and sections you've completed, so we can track your learning journey.
• Technical data: Basic stuff like browser type, device info, and IP address — standard web analytics.
• Communication preferences: Whether you want to hear from us about new content, paid products, or account changes, and when and how you agreed to hear about paid products.

3. How We Use It

• To create and manage your account
• To track your course progress
• To send you a weekly email with tips, new lessons and new guides. This is on when you sign up and every email has an unsubscribe link, or you can switch it off in your account settings
• To tell you about paid products, like toolkits and courses, but only if you've said yes: on the sign-up form, in your account settings, or through the link in one of our emails. We keep a record of when and how you agreed, and you can change your mind at any time
• To understand how the platform is being used so we can improve it
• To keep the platform secure and prevent abuse

We don't use your data for targeted advertising. We don't build profiles to sell to third parties. We're an educational platform, not a data broker.

4. Third-Party Services

We use a few trusted services to run the platform:

• Supabase: Authentication and database hosting
• Stripe: Donation payment processing (we never see your card details)
• Brevo: Email delivery for account emails, the weekly tips email and, if you've agreed to them, emails about paid products
• Google Analytics: Usage analytics to understand traffic patterns. We run it analytics-only, with IP anonymisation on and Google's advertising and personalisation signals switched off. It only loads if you accept analytics cookies.
• Vercel Analytics: Privacy-friendly, cookieless page and performance analytics. It only loads if you accept analytics cookies.
• PostHog: Product analytics, so we can see which pages and lessons people use, where they get stuck and what breaks. In your browser it records pages visited, clicks, recordings of how you move through the site (with anything you type hidden), error reports and, if you're signed in, your account ID (never your email). Error reports have email addresses and login tokens stripped out, and login tokens are also stripped from page addresses before anything is sent. This browser side only loads if you accept analytics cookies. Separately, our server sends PostHog events about your account (signing up, completing lessons, earning certificates, starting modules, donations and purchases), keyed by your account ID and never your email. Those don't depend on the cookie choice, because the banner only controls analytics in your browser. We do this under legitimate interest, to understand how the course is used, and you can object by contacting us. Deleting your account deletes your data in PostHog too. PostHog runs on its EU cloud.
• hCaptcha: Bot protection on sign-up and password reset forms

Each of these services has their own privacy policy. They only receive the data necessary to perform their function. Our fonts are self-hosted, so loading a page doesn't send your details to a font provider.

5. Cookies & Consent

Essential cookies keep you logged in and protect against CSRF attacks. These are always on because the platform can't work without them.

Analytics cookies are optional. When you first visit, a banner asks whether you want them. Analytics in your browser only loads after you choose "Accept". Choose "Reject" and nothing tracking-related runs in your browser, no analytics cookies are set, and no requests go from your browser to analytics providers. Our server still records account events (see PostHog above), because those don't use cookies or your device. You can change your mind at any time with the "Cookie preferences" link at the bottom of every page. Switching analytics off stops it straight away and deletes its cookies. We never use cookies for advertising, because we don't do ads.

6. Where Your Data Goes

Some of our providers process data outside the UK/EEA, mainly in the United States (Stripe, Google Analytics, Vercel, and hCaptcha). Where that happens, the transfer relies on recognised safeguards such as the EU-US Data Privacy Framework and Standard Contractual Clauses. Supabase, Brevo and PostHog process data within the EU. We only send each provider the data it needs to do its job.

7. Your Rights

You have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Delete your account and associated data yourself, any time, from the Danger Zone in your account's Security settings
• Update your communication preferences at any time via your account settings
• Export your data

Deleting your account is instant and permanent: it removes your profile, progress, certificates, bookmarks, and preferences. For anything else, or if you don't have an account, reach out via our contact page. We'll respond as quickly as we can.

8. Data Security

We take security seriously (there's literally a whole module about it in the course). Your data is encrypted in transit, passwords are hashed, and we follow industry best practices. That said, no system is 100% bulletproof — if we ever discover a breach, we'll notify affected users promptly.

9. Changes

We may update this policy from time to time. If we make significant changes, we'll post a notice on the platform. The "Last Updated" date at the top tells you when it was last revised.

10. Contact

Privacy questions or concerns? Get in touch via our contact page.