Privacy policy

ThinkFE has not launched yet. This policy describes the site exactly as it works today. Before sign-in or purchases open to the public, we will complete the sections marked as pending and update the date above.

Who we are

ThinkFE (thinkfe.dev) is a text-first course on frontend system design, run by an individual based in India. In this policy, “we” means ThinkFE. You can reach us about this policy and your data at [email protected].

The short version

• We collect only what we need to run your account: your email address, your learning progress, which courses you have access to, and a record of the devices that sign in to your account.
• We do not use advertising, analytics or tracking tools, and we do not sell or rent your data.
• We use two cookies, both only for signing in.
• You can see every device that signed in to your account on your Account and devices page.

When you browse without an account

You can read the curriculum and the free lesson without an account. The pages load no third-party scripts, fonts or trackers.

Your browser keeps two things on your device, and they are not sent to us while you are signed out:

• Theme choice (light, dark or system), in your browser’s local storage under “thinkfe-theme”, until you clear it.
• Review marks and your last visited lesson, in session storage, until you close the browser tab or window. If you sign in during that session, they are added to your account.

Like every website, the server that delivers ThinkFE receives your IP address and browser details with each request. ThinkFE runs on a server we rent from DigitalOcean; which country it is in is pending and will be stated here before launch. Our web server does not keep a log of visits. When you ask for a sign-in link, your IP address is also counted in the server's memory for 5 minutes, to limit how many links one connection can ask for; it is never written down. Application error logs, which do not record your IP address, are limited in size: the oldest entries are deleted automatically.

When you sign in

ThinkFE has no passwords. You enter your email address and we email you a link that signs you in. To do that we keep:

• Your email address, to identify your account and send sign-in links. We email you only sign-in links.
• A record of each sign-in link: your email address, the network it was requested from (shortened, as below), when it was requested, when it expires and when it was used. The link itself is stored only in a scrambled form (a hash) that cannot be turned back into a working link. These records are deleted 30 days after the link expires.
• A count of sign-in requests: for each link sent, the network it was requested from (shortened, as below) and when, without your email address. It limits how many links one network, and the whole site, can ask for, even after an account is deleted. These records are deleted within two hours.
• When you last signed in.

We send these emails through Resend, an email delivery service. To deliver one, Resend receives your email address and the email itself, including the sign-in link. Resend keeps its own delivery records under its privacy policy. The link in an email works once, for 15 minutes, so a copy kept by a mail service cannot be used to sign in later.

Your learning progress

While you are signed in, your account stores the lessons and activities you marked as reviewed, the lesson you visited last, and your latest answer to each practice question. We use this only to show your progress and mastery back to you. There are no points, rankings or leaderboards, and other learners never see your progress.

Course access

If you have access to a course, your account records which courses it covers (or all courses), when it starts and ends, whether it is active or was withdrawn, whether we granted it or it was bought, and an optional note by an administrator. We use this only to decide which lessons you can read. While you are signed in, the site also shows it to your browser, so lessons you can open are marked as open.

Devices and sessions

A ThinkFE account can be signed in on one device at a time: signing in on a new device signs out the previous one. This keeps your account secure and stops one account being shared, as each account is for one learner. For each sign-in we record:

• the browser and operating system, for example “Chrome on macOS”, and the browser’s identifying text (its “user agent”);
• the network you signed in from, shortened so it does not identify your exact connection (for example 203.0.113.0/24 instead of a full IP address);
• when the session started, when it was last active, and when and why it ended.

You can see this list on your Account and devices page. We use it to keep your account secure and to detect an account being shared. Session records are deleted 90 days after the session ends.

Cookies

We use two cookies, and both are strictly necessary: thinkfe-session (named __Host-thinkfe-session on the live site) keeps you signed in. It contains a random code, not your personal details. It cannot be read by scripts on the page, is sent only over secure connections, and lasts 30 days or until you sign out. thinkfe-sign-in (named __Host-thinkfe-sign-in on the live site) is set when you ask for a sign-in link and lasts 15 minutes, or until you sign in. It holds a random code, so we can warn you when a sign-in link is opened in a different browser from the one that asked for it. We use no advertising, analytics or third-party cookies, so there is no cookie banner.

Who can see your data

• ThinkFE’s administrators, to run and support the service.
• Service providers that host the site and deliver email for us, only to provide those services. Email is delivered by Resend (see “When you sign in” above). The site is hosted on a server we rent from DigitalOcean, which stores the data but does not use it for its own purposes. Encrypted copies of our database (backups) are kept in DigitalOcean’s object storage for seven days and then deleted; only we hold the key that can read them. Data you delete can remain in those copies until they expire.
• Authorities, only where the law requires it.

We do not sell or rent your personal data, and we do not share it for advertising.

How we protect it

• Account data is kept in a database that is not reachable from the internet; only ThinkFE’s own servers can use it.
• Sign-in links and session codes are stored only as hashes, so a copy of the database cannot be used to sign in.
• Sign-in links work once and expire after 15 minutes.

Payments

Purchases are not open yet, and we do not collect any payment details. This policy will describe how payments are handled before they open.

Your choices and rights

• See your devices, and sign out, at any time from your account.
• Access, correct or delete your data. On your Account page (signed in) you can download a copy of everything we store about you and delete your account; deleting removes your account, progress, sign-in history and course access at once. For a correction or any other request, email [email protected].
• Stop using ThinkFE. Without an account, nothing about you is stored by us beyond the server logs described above.

Changes to this policy

When we change this policy, we update the date at the top of this page. If a change affects how we use the data we already hold, we will tell signed-in learners before it takes effect.

Contact

Email [email protected] for questions about this policy, to use your rights, or to make a complaint about how we handle your data. We reply within 2 working days. See also the contact page.