LEGALPRIVACY.

One Thousand Drones, LLC runs One Thousand Drones Academy at academy.onethousanddrones.com. We are the controller for the personal data described here. Our registered address is 9905 S Pennsylvania Ave, Ste A, Oklahoma City, OK 73159, USA. To reach us about privacy, email privacy@onethousanddrones.com or use onethousanddrones.com/contact.

We collect only what a specific feature needs, and we name the legal basis for each use below.

Sign-in. To create and secure your account we use your email address. You sign in with a one-time magic link, or with Google or GitHub, in which case we receive your verified email and basic profile (name and avatar). Basis: performance of our agreement with you, and our legitimate interest in keeping accounts secure.

Learning content and progress. Your enrollments, lesson progress, exam results, certificates, and any files you upload are stored so the product works for you. Basis: performance of our agreement with you.

Payments. If you buy something, our payment processor collects your payment details directly. We receive a confirmation and the amount, never your full card number. Basis: performance of our agreement with you.

Product analytics. We record how the site is used (pages viewed, features used) to improve it. Basis: our legitimate interest in understanding and improving the product.

Email. We send transactional email you asked for, such as sign-in links and receipts. We send course and marketing email only if you opt in, and you can unsubscribe from those at any time from the link in every message.

When you use a form on the site, such as signing in or requesting a field guide, we run Cloudflare Turnstile to tell real visitors apart from automated abuse. When the widget loads, before you submit the form, Turnstile receives your IP address, a TLS fingerprint, your browser's User-Agent, and the site identifier. In the managed mode we use, it sets no cookies. Cloudflare uses these signals to secure our site as our processor, and also acts as an independent controller to improve its own bot detection; that use is described in Cloudflare's Turnstile privacy policy.

We also run a rate limiter (Upstash Redis) that counts sign-in and form attempts. The counters are keyed by a one-way HMAC hash of your email address and IP, so the store holds no readable list of addresses, and every counter expires on its own within minutes to a day.

The basis for both is our legitimate interest in preventing the email bombing and spam that would harm you and our ability to deliver real mail. Both are strictly necessary to run the service safely, so they are always on.

We do not sell your data. We share it only with the service providers that run the product on our behalf, each bound to use it only for that purpose:

• Cloudflarebot detection (Turnstile), file storage, and content delivery
• Upstashrate-limit counters
• Resendemail delivery
• Neonour application database
• Vercelhosting and delivery of the site
• Stripepayment processing
• PostHogproduct analytics
• Google and GitHubsign-in, when you choose them

The abuse-prevention counters expire automatically, within minutes to a day. We keep your account and learning data for as long as your account is active, and for a reasonable period afterward to meet legal, accounting, and security obligations. You can ask us to delete your account at any time.

Our providers process data in the United States. Where your data is transferred from another region, we rely on the appropriate safeguards for that transfer, such as standard contractual clauses.

We protect your data with access controls and encryption in transit, and we work only with providers that do the same. No system is perfectly secure. If a breach affects your personal data, we will notify you and the relevant authorities as required by law.

We use a small number of essential cookies: one to keep you signed in, and one to remember your light or dark theme. Turnstile, in the managed mode we use, sets no cookie. Our analytics may set a cookie to measure usage. We do not use advertising cookies.

We do not track you across other websites, and we do not sell your data, so a browser Do Not Track or Global Privacy Control signal has nothing to opt out of on our site. We treat it as already honored.

One Thousand Drones Academy is meant for adults and older students. It is not directed at children under 13, or under 16 in the European Union. We do not knowingly collect personal data from children below those ages. If you believe a child has given us their data, email privacy@onethousanddrones.com and we will delete it.

Depending on where you live, you can ask to see the data we hold about you, correct it, delete it, export it, or object to a particular use. If you are in the European Union or United Kingdom, the GDPR (and UK GDPR) gives you these rights; if you are in California, the CCPA, as amended by the CPRA, does.

To make a request, email privacy@onethousanddrones.com or use onethousanddrones.com/contact. We will respond within the time the law allows.

We will update this page when our practices change, and we will move the effective date at the top. Significant changes will be called out on the site.

Questions about this policy or your data go to privacy@onethousanddrones.com or onethousanddrones.com/contact, or by mail to One Thousand Drones, LLC, 9905 S Pennsylvania Ave, Ste A, Oklahoma City, OK 73159, USA.