How ITForMe collects, uses, shares, retains, and protects account and learning data.
ITForMe collects the account details needed for OAuth sign-in and the learning records you choose to create. It does not store your provider password or OAuth access tokens, sell personal information, or use Discord profile data for advertising, employment, or eligibility decisions.
ITForMe is operated by ZRG Studios ("ZRG Studios," "we," "us," or "our"). This policy applies to the hosted ITForMe website, account system, quizzes, performance-based questions, career roadmaps, progress tools, and community correction features.
External websites and services linked from ITForMe have their own privacy practices. This policy does not control those services.
We collect information you provide, information returned by a sign-in provider after you authorize it, and limited technical information produced when you use the service.
ITForMe supports Discord, GitHub, and Google sign-in. The provider shows the information requested before you approve access. ITForMe never receives your provider password.
ITForMe does not retain OAuth access or refresh tokens. Basic provider profile snapshots and the stable provider identifier are retained so the same external identity returns to the correct internal account. Accounts are never merged merely because email addresses match.
Discord profile information is used only for authentication, account security, account display, and support. It is not used to profile Discord relationships or to make employment, housing, insurance, credit, or other eligibility decisions.
ITForMe uses essential cookies for sessions, CSRF protection, OAuth state, and an anonymous learning workspace. These cookies are needed for sign-in security and to keep one browser's progress separate from another's.
The hosted ITForMe application does not use third-party advertising cookies. Infrastructure providers may use necessary security or routing cookies under their own policies.
We do not sell personal information and do not share it for targeted advertising.
The hosted application cannot browse or monitor a directory on your computer. Local-vault connection features are limited to the local application you run on your own device.
If you upload a Markdown/YAML progress export to the hosted service, ITForMe parses the recognized progress records into your workspace. The uploaded file is not used as a public content source. Downloaded exports are controlled by you after they leave ITForMe.
If you upload an IT-only private Markdown study deck, ITForMe stores the parsed prompts, answers, and deck metadata in your hosted workspace so you can practice and schedule reviews. Unclassified decks are rejected. Accepted records can be included in access-controlled service backups under the normal retention cycle. They are not published, used for community statistics, or represented as ITForMe-reviewed answers.
Account identity and learning records are retained while needed to provide your account and progress history. Security events, moderation records, server logs, and backup copies may be retained longer when needed for fraud prevention, incident response, legal compliance, and reliable recovery.
If you disconnect one of several sign-in providers, ITForMe removes the linked identity snapshot for that provider. Disconnecting a provider does not delete the ITForMe account or its learning records.
A signed-in learner may delete an account through the Account page after a fresh sign-in from a currently connected provider. Live identity, learning, private-deck, answer, evidence, schedule, streak, MFA, and session data is removed. Correction proposal text and rationale may remain without an author under the community moderation license; votes are removed. Retained security events are stripped of their account, provider-subject digest, and metadata.
Minimal order, refund, dispute, and provider-event records may remain after account deletion without the ITForMe account link when needed to complete a refund or dispute, reconcile a payment, meet accounting or tax obligations, prevent duplicate fulfillment, or comply with law. Card details remain with Stripe. The exact commercial retention schedule and legal basis must be reviewed before ITForMe accepts payment.
A UUID-only deletion receipt is created in the same database transaction as live account deletion, so both changes commit or roll back together. The receipt is not stored in an independent restore journal; restoring an older database backup may temporarily restore account data that existed at that backup time. Ordinary backup copies expire through the documented backup rotation unless longer retention is legally required, and privacy requests involving restored data are handled through the documented response process.
Anonymous work may remain associated with its random browser workspace until it is claimed, deleted through an available control, or removed during maintenance. Clearing cookies removes the browser's ability to find that anonymous workspace but does not itself send a verified deletion request.
ITForMe uses HTTPS in production, OAuth with state and PKCE, host-only secure session cookies, tenant-scoped workspaces, access controls, protected secrets, encrypted MFA secrets, restricted administrative access, backups, and security logging. OAuth provider tokens are not configured for storage.
No Internet service can guarantee absolute security. Protect your provider accounts and recovery methods, sign out on shared devices, and contact us if you suspect unauthorized access.
ITForMe is not directed to children under 13. You must also meet any higher minimum age required in your country to consent to online services and data processing. If we learn that ineligible child data was collected, we will take reasonable steps to delete it.
ITForMe is operated from the United States. If you use it from another country, information may be processed in the United States and in locations where the selected OAuth or infrastructure providers operate, subject to applicable safeguards and law.
We may update this policy when the service, providers, or legal requirements change. The page will show the new effective date. Material changes may also be announced in the application before they take effect when practical.
Use the Account page for a complete archive or self-service deletion. For other privacy questions, inaccessible-account requests, or corrections that cannot be completed in the service, email the privacy contact below. Include the OAuth provider used for the account, but never send a password, OAuth token, MFA secret, or recovery code.
