Last updated: DATE · Applies to: the Structional Learn website at structional.org
1. The short version
- Today you need no account, and we collect no personal data on our servers. Your progress and settings stay in your own browser. The only exception is what you choose to send us through the contact form (once it's switched on).
- When accounts launch, they will be optional. We will collect only what an account needs: your email, a display name, your progress and your year of birth.
- No ads. No ad trackers. We don't sell data. We don't build profiles of you for marketing.
- Accounts are for people aged 16 and over. Anyone can use the lessons without an account.
- You can see, download or delete your data at any time.
2. Who we are
Structional Learn is a free interactive website for learning structural and civil engineering. It is made by the team behind the Structional YouTube channel.
Controller: OWNER / COMPANY NAME, ADDRESS, COMPANY CODE
Contact for anything privacy-related: hello@structional.org
We have not appointed a Data Protection Officer, because the law does not require one for a service of our size and kind. Write to the email above and the owner will reply.
3. What we collect today (no accounts)
On our servers: nothing that identifies you. No account, no tracking ID, no advertising or analytics cookies.
In your browser: the site saves a few items in your browser's local storage, so it can remember your work between visits. They stay on your device. We can't see them, and the site never sends them to us.
| Key | What it holds |
|---|---|
structional.settings.v1 | Your unit system (SI or US) |
structional.progress.v2 | Which tasks you've solved, when, and which you got right first time |
structional.progress.v1 | Older progress format. The site reads it once and copies it into v2 |
structional.placement.v1 | Your latest placement test result: level, score, topics to revisit, date |
structional.checkpoints.v1 | Your checkpoint results: best score, passed or tested out, number of tries, date |
structional.sandbox.v2 | Your last Sandbox drawing (one for SI, one for US units) |
structional.sandbox.settings.v1 | Sandbox preferences: snapping, grid size, angle lock, display options |
structional.tools.v1 | Where the floating tool windows sit, and whether they're docked |
structional.consent.v1 | Only if we use optional analytics: your yes or no, and when you chose |
structional.sync.v1 | Only when you're signed in: which progress has already been sent to your account |
None of these hold your name, email or any ID. You can delete them at any time by clearing this site's data in your browser settings. That also resets your progress.
Technical data our host handles. When your browser asks for a page, our hosting and network provider (Cloudflare) necessarily receives your IP address and basic request data (browser type, page asked for, time). It uses this data to deliver pages and block attacks. See sections 6 and 8.
Fonts. Our fonts are served from our own site. Your browser doesn't connect to Google or any other font service.
Visitor statistics. We use (or will use) Cloudflare Web Analytics. It counts visits in aggregate (pages viewed, where visitors came from, country, device type) without cookies, without storing anything on your device and without identifying you.
Links to YouTube and Instagram. Links to our channel and our Instagram open in a new tab. From then on, Google's or Meta's privacy policy applies. We don't embed YouTube players or Instagram posts today.
4. What we will collect when accounts launch
Accounts are optional. Lessons keep working without one.
| Data | Why |
|---|---|
| Email address | To sign you in (one-time code or Google) and to send service messages, such as sign-in codes and important changes |
| Google account basics (if you choose Google sign-in): name, email, Google ID, profile picture link | To create and sign in to your account. We never see your Google password |
| Display name | Shown on your account page, and on certificates later |
| Year of birth | To check you are 16 or over. We ask for your date of birth on the sign-up screen, then keep only the year |
| Settings: unit system, optional country and role (student, engineer, teacher, other) | To show the right units now, and the right design codes later |
| Learning progress: tasks attempted and solved, first-try results, placement and checkpoint results, times | To sync your progress across devices and show your points and history |
| Feedback you send: thumbs up/down, comments, mistake reports, with the lesson and its version | To fix mistakes and improve lessons. You can also send feedback without an account; it then carries only a random ID, not your identity |
| Contact form messages (with or without an account): topic, your message, and if you give them your name, email and company or school, plus the page you came from | To answer you. Your IP address is used briefly to stop spam floods and is not stored with the message |
| Technical and security logs: IP address, device and browser, sign-in times, errors | To keep the service secure, stop abuse and fix bugs |
When you first sign in, the site uploads the progress already saved in your browser, so you don't lose it.
Later, with your permission only, we may measure how people move through lessons with PostHog (EU servers): an anonymous ID, pages visited (without the part of the address after "?"), lesson and checkpoint started or finished. We'll ask once, with a small "Allow analytics / No thanks" bar. Saying no changes nothing else and removes the ID. We don't link it to your account and don't record your screen.
To find and fix errors, we may use Sentry to receive error reports (what broke, on which page, browser type). Emails, addresses after "?", cookies and account details are removed before a report is sent.
We don't collect special categories of data (health, religion and so on), and please don't put them in feedback.
5. Why we use it (legal bases, GDPR Art. 6)
| Purpose | Legal basis |
|---|---|
| Running your account, syncing progress, sign-in emails | Contract (Art. 6(1)(b)): it's the service you asked for |
| Checking your age | Legal obligation (Art. 6(1)(c)) and contract: we may only offer accounts to people old enough |
| Feedback and mistake reports | Legitimate interest (Art. 6(1)(f)): keeping lessons correct and useful |
| Answering contact messages | Legitimate interest (Art. 6(1)(f)), or steps you asked for before a contract (Art. 6(1)(b)) for companies |
| Security logs, abuse prevention, error tracking | Legitimate interest (Art. 6(1)(f)): a safe, working service |
| Aggregate visitor statistics (no personal data stored) | Legitimate interest (Art. 6(1)(f)): knowing which pages help people |
| Optional product analytics (later) | Consent (Art. 6(1)(a)): you can withdraw it at any time |
| Payment and tax records (when paid plans launch) | Legal obligation (Art. 6(1)(c)): accounting law |
| Company tests | We act for the company. See section 11 |
Where we rely on legitimate interest, we've weighed it against your rights, and you can object (section 9).
6. Who helps us (processors)
We use a few trusted providers. Each one acts only on our instructions, under a data processing agreement.
| Provider | What they do | Where data is stored |
|---|---|---|
| Supabase Inc. | Database and sign-in (accounts, progress, feedback) | EU (Frankfurt, Germany) |
| Cloudflare, Inc. | Hosting, content delivery, security, aggregate visitor statistics | Global network. Requests are handled at the data centre nearest to you |
| Google (only if you choose Google sign-in) | Confirms your identity to us | Google's own systems. Google acts under its own privacy policy |
| Resend, Inc. [confirm] | Sends sign-in codes and service emails, and forwards contact-form messages to us | REGION: confirm |
| Functional Software, Inc. (Sentry) (if used) | Error reports, with personal data stripped | REGION: EU or US, confirm the chosen data region |
| PostHog Inc. (only if you allow analytics) | Anonymous product analytics | EU (Frankfurt) |
| MERCHANT OF RECORD, e.g. Paddle (when paid plans launch) | Sells and bills paid plans | REGION. It is the seller and acts as an independent controller for payments |
We'll keep this list up to date and say here when it changes. We don't sell or rent personal data, and we don't share it with advertisers.
We may disclose data if the law requires it, for example a valid court order.
7. Data outside the EU
We keep our database in the EU. Some providers are US companies, or run global networks, and may process data outside the EEA, for example for support or security. When that happens we rely on:
- the EU–US Data Privacy Framework, where the provider is certified, or
- the European Commission's Standard Contractual Clauses, plus extra safeguards where needed.
Ask us at hello@structional.org for a copy of the relevant safeguards.
8. How long we keep it
| Data | Kept for |
|---|---|
| Browser local storage | Until you clear it. It's on your device, not ours |
| Account and progress | While you have an account. Deleted within 30 days of you deleting the account |
| Inactive accounts | After 24 months without a sign-in, we email you. If you don't sign in within 30 days, we delete the account |
| Feedback | Until the lesson issue is handled, at most 3 years. If you delete your account, we delete your comments or strip anything that identifies you |
| Contact messages | Until answered and handled, at most 2 years |
| Security and server logs | 30 days, unless needed to investigate an incident |
| Backups | Overwritten in rolling cycles of up to X days |
| Payment records | As long as accounting law requires (in Lithuania, generally 10 years) |
| Company test results | As agreed with the company. See section 11 |
9. Your rights
Under the GDPR you can:
- Access your data and get a copy.
- Correct data that's wrong.
- Delete your account and data ("right to be forgotten").
- Download your data in a common format (portability).
- Restrict how we use your data while a question is sorted out.
- Object to uses based on legitimate interest, such as feedback analysis.
- Withdraw consent at any time, where we asked for it. This doesn't undo earlier, lawful use.
Once accounts launch, you can export or delete your data yourself on the account page. Or write to hello@structional.org. We reply within one month. We may ask you to confirm your identity first. It's free, unless requests are clearly excessive.
Today, we hold no personal data about you, so there's nothing for us to send or delete. To remove your local progress, clear this site's data in your browser.
Complaints. Please tell us first, and we'll try to fix it. You can also complain to a data protection authority, in your own EU country or in Lithuania, where we are based:
State Data Protection Inspectorate (Valstybinė duomenų apsaugos inspekcija, VDAI)
L. Sapiegos g. 17, LT-10312 Vilnius, Lithuania · ada@ada.lt · WEBSITE: check current address, e.g. vdai.lrv.lt / ada.lrv.lt
10. Children
- Anyone can use the lessons, with no account and no personal data collected.
- Accounts are for people aged 16 and over. Sign-up asks for your date of birth. If you're under 16, we don't create an account, and we don't keep the date you entered. The lessons still work for you, with progress saved in your browser.
- Under 13: we don't knowingly collect any personal data, beyond what our host needs to deliver pages (section 3).
- If we learn that someone under 16 has an account, we delete it. Parents and guardians can contact us at hello@structional.org.
- Schools may get teacher-managed accounts later. We will update this policy before that happens.
11. Company trainings and qualification tests
Companies will be able to send tests to job candidates and staff, and assign trainings to them.
- The company is the controller. It decides who takes a test and what happens with the result. Structional is the processor. We run the test for the company, under a data processing agreement, and use the data only to provide the service.
- Before a test starts, the candidate sees who will get the result, what is recorded and for how long, and a link to the company's own privacy notice. The candidate must agree before starting.
- What is recorded: name and email (the email is confirmed with a one-time code), answers, score per skill, a suggested level, and integrity notes: time per question, leaving the test window, pasting, and the link being open on two devices at once. No camera, no microphone, no CV.
- No automated decisions. Scoring is rule-based (right or wrong, within set tolerances). We don't use AI to judge candidates. We only suggest a level, and a person at the company makes every decision. Integrity notes never fail anyone automatically.
- Signed-in learners who take a company test decide on the start screen whether to share their profile name and email.
- Retention: as agreed with the company, by default 12 months after the test for candidates who weren't hired. After that we delete the results.
- Your rights: contact the company first. If you contact us, we'll pass your request to the company and help it answer.
12. Cookies and local storage
- Today we set no cookies. The site uses browser local storage only for the items in section 3. These are strictly necessary for features you use (settings, progress, Sandbox), so they don't need a consent banner.
- When accounts launch, signing in stores a session token in your browser to keep you signed in. This is also strictly necessary.
- Cloudflare may set short-lived security cookies to tell people from bots. They're used only for protection.
- No advertising cookies, no third-party tracking pixels, no session recording.
- If we add optional product analytics, it will run only after you say yes. You can change your mind at any time under "Your analytics choice" at the end of this page.
13. Security
We use encrypted connections (HTTPS). We keep the database in the EU, with access rules so each person can read only their own data. We give staff access only where it's needed, and if you choose a password, it is stored only as a salted hash by our sign-in provider (we never see it). No system is perfectly secure. If a breach puts your data at risk, we'll tell you and the authority as the law requires.
14. Changes to this policy
We'll update this page when the service changes, for example when accounts launch, and change the date at the top. If you have an account and the change is important, we'll email you before it takes effect.
15. Contact
OWNER / COMPANY NAME, ADDRESS, COMPANY CODE
Email: hello@structional.org