LEGALPRIVACY.

One Thousand Drones, LLC runs onethousanddrones.com and One Thousand Drones Academy at academy.onethousanddrones.com. This policy covers both sites. We are the controller for the personal data described here. Our registered address is 9905 S Pennsylvania Ave, Ste A, Oklahoma City, OK 73159, USA. To reach us about privacy, email privacy@onethousanddrones.com or use onethousanddrones.com/contact.

We collect only what a specific feature needs, and we name the legal basis for each use below.

Sign-in. To create and secure your account we use your email address. You sign in with a one-time magic link, or with Google or GitHub, in which case we receive your verified email and basic profile (name and avatar). Basis: performance of our agreement with you, and our legitimate interest in keeping accounts secure.

Learning content and progress. Your enrollments, lesson progress, exam results, certificates, and any files you upload are stored so the product works for you. Basis: performance of our agreement with you.

Payments. If you buy something, our payment processor collects your payment details directly. We receive a confirmation and the amount, never your full card number. Basis: performance of our agreement with you.

Analytics. We measure how the sites are used (pages viewed, features used, and whether a visit ends in a sign-up, a waitlist entry, or a purchase) so we can improve them. We use Google Analytics on both sites and PostHog in the Academy. Where the law in your country asks for consent first, which for us means the EU, the EEA, the UK, Switzerland, Brazil, Japan, South Korea, and Quebec, neither tool loads until you accept. We also ask when we cannot tell where you are. Basis: your consent. Everywhere else they run unless your browser sends a Global Privacy Control signal, which we treat as a no. Basis: our legitimate interest in understanding and improving the product. You can change your choice at any time from Cookie settings at the foot of the page.

Google Analytics runs with its advertising features off: Google signals and ad personalization are disabled, and it is not linked to any advertising account. Google uses your IP address to estimate your location, down to the city, and Analytics does not log or store the address itself.

Contact form. If you write to us through the briefing form on onethousanddrones.com, we receive your name, email address, organization, and message as an email and use them to reply. Basis: our legitimate interest in answering you.

Email you give us without an account. Some pages take an address on its own: a course waitlist, the Hex Cluster release notice, and the All-Access Pass waitlist. We store the address, when you gave it, and what you asked to hear about, and we use it for that one thing. Basis: your consent, which you can withdraw by writing to privacy@onethousanddrones.com.

Email. We send transactional email you asked for, such as sign-in links and receipts. We send course and marketing email only if you opt in, and you can unsubscribe from those at any time from the link in every message.

When you use a form on the site, such as signing in or requesting a field guide, we run Cloudflare Turnstile to tell real visitors apart from automated abuse. When the widget loads, before you submit the form, Turnstile receives your IP address, a TLS fingerprint, your browser's User-Agent, and the site identifier. In the managed mode we use, it sets no cookies. Cloudflare uses these signals to secure our site as our processor, and also acts as an independent controller to improve its own bot detection; that use is described in Cloudflare's Turnstile privacy policy.

We also run a rate limiter (Upstash Redis) that counts sign-in and form attempts, and how many new Hex Cluster downloads are prepared. The counters are keyed by a one-way HMAC hash of your email address and IP, so the store holds no readable list of addresses, and every counter expires on its own within minutes to a day.

The basis for both is our legitimate interest in preventing the email bombing and spam that would harm you and our ability to deliver real mail. Both are strictly necessary to run the service safely, so they are always on.

We do not sell your data. We share it only with the service providers that run the product on our behalf, each bound to use it only for that purpose:

• Cloudflarebot detection (Turnstile), file storage, and content delivery
• Upstashrate-limit counters
• Resendemail delivery
• Neonour application database
• Vercelhosting and delivery of the site
• Stripepayment processing
• PostHogproduct analytics (Academy)
• Googlewebsite analytics (Google Analytics, both sites)
• Google and GitHubsign-in, when you choose them

The abuse-prevention counters expire automatically, within minutes to a day. We keep your account and learning data for as long as your account is active, and for a reasonable period afterward to meet legal, accounting, and security obligations. You can ask us to delete your account at any time.

A Hex Cluster download you assemble is stored for up to 30 days, so the same download is not prepared twice. That includes the build name you give it, which appears in the file names and inside the files. It is deleted automatically after 30 days.

An address given without an account (section 2) is treated as belonging to whoever reads that mailbox, shared mailboxes included. It is deleted 7 days after signup if the confirmation link is never used, and 12 months after the one email it was confirmed for. Every such email carries a link that removes the address at once.

Our providers process data in the United States. Where your data is transferred from another region, we rely on the appropriate safeguards for that transfer, such as standard contractual clauses.

We protect your data with access controls and encryption in transit, and we work only with providers that do the same. No system is perfectly secure. If a breach affects your personal data, we will notify you and the relevant authorities as required by law.

We use a small number of essential cookies. In the Academy, one keeps you signed in and one remembers your light or dark theme. On both sites, one remembers your consent choice and one holds your country (and your state or province, where we have it) so the consent banner applies the right rules. That last one comes from your IP address and is no more precise than that. Turnstile, in the managed mode we use, sets no cookie.

When analytics is allowed, PostHog and Google Analytics set cookies to tell visits apart. Google's are named _ga and _ga_ followed by an ID, and last up to two years. After you create an account we also set a one-hour marker so the sign-up can be counted, and only if you have allowed analytics. We do not use advertising cookies.

We do not track you across other websites, and we do not sell your data. A Global Privacy Control signal from your browser turns analytics off. Do Not Track has nothing further to switch off, so we treat it as already honored.

One Thousand Drones Academy is meant for adults and older students. It is not directed at children under 13, or under 16 in the European Union. We do not knowingly collect personal data from children below those ages. If you believe a child has given us their data, email privacy@onethousanddrones.com and we will delete it.

Depending on where you live, you can ask to see the data we hold about you, correct it, delete it, export it, or object to a particular use. If you are in the European Union or United Kingdom, the GDPR (and UK GDPR) gives you these rights; if you are in California, the CCPA, as amended by the CPRA, does.

To make a request, email privacy@onethousanddrones.com or use onethousanddrones.com/contact. We will respond within the time the law allows.

We will update this page when our practices change, and we will move the effective date at the top. Significant changes will be called out on the site.

Questions about this policy or your data go to privacy@onethousanddrones.com or onethousanddrones.com/contact, or by mail to One Thousand Drones, LLC, 9905 S Pennsylvania Ave, Ste A, Oklahoma City, OK 73159, USA.