Skip to main content

Privacy notice

This notice explains what this website collects, where it is kept and why. It describes the site as currently built.

Before public launch, the operator will add a contact for privacy requests, the name of the email delivery provider, where the site is hosted, and how long backups are kept. Until then, those details are not stated here.

Who runs this site

  • The Golden Symbol for Trade and Investment, Sultanate of Oman.

Using the site without an account

  • There are no analytics, advertising or tracking scripts, and fonts are served from this site, not from a third party.
  • Learn QA progress, Bug Arena Practice progress and API Workspace collections are saved in your browser's local storage only. They are not sent to us. You can clear them from the pages themselves or through your browser.
  • Learn QA practice labs: the SQL lab runs entirely in your browser. The API lab sends the requests you build to this site’s training API, which returns fixed synthetic data and stores nothing; like other endpoints, it counts requests per IP address in short-lived memory to limit abuse.
  • Release Compare processes images in your browser; they are never uploaded.
  • API Workspace sends the requests you write directly from your browser to the address you choose; they don't pass through this site's servers.
  • Webhook Inspector keeps an inbox and the requests sent to it in server memory only, for up to 60 minutes and at most 50 requests, then deletes them. Anyone who sends to your inbox address decides what those requests contain.
  • The contact and project forms are previews in this build: what you type is checked in your browser and not sent or stored.
  • Like any website, the server receives your IP address with each request. It may be used for short-lived rate-limit counters, and it isn't stored with your activity.

If you create an account

  • Account: your email address (private), your display name (shown on the public leaderboard unless you hide it), and your password, stored only as a one-way hash.
  • Sign-in sessions: a session record with an expiry date, plus the IP address and browser information that were used to sign in, so sessions can be managed and abuse limited. Sessions expire after 7 days of inactivity or when you sign out.
  • Verification codes and password-reset links: stored only in hashed form, and they expire after 10 and 30 minutes.
  • Learn QA: which lessons you read or completed, your exercise and practice-lab results, and whether you viewed a sample solution first. Your written answers, API requests and SQL queries are not saved.
  • Bug Arena Ranked: your attempts in each mission, the actions you take in the training app, your bug reports, the evidence the server records, and your verified points. Your display name and best scores appear on the public leaderboard unless you hide them.
  • Leaderboard moderation: if a moderator hides a name or excludes an account, the action, the name at that time and the reason are recorded.
  • Rate limiting: to slow down password guessing, short-lived counters are kept per account and per hashed email address.

Cookies

  • One cookie, set only when you sign in: the session cookie (gs.session_token), which keeps you signed in. It can't be read by page scripts (HttpOnly). There are no advertising or analytics cookies.

Email

  • We send account emails only: verification codes, password-reset links, and a notice if someone tries to register with your address. No newsletters or marketing.
  • Emails are sent through an email delivery service, which handles your address and the message to deliver it.

Your choices

  • Hide yourself from the public leaderboard at any time in My progress; your private progress stays.
  • Change your display name, sign out of other sessions, or reset your learning progress.
  • Delete your account in My progress. This removes your account, sessions, pending codes and reset links, learning progress, Ranked attempts, reports and leaderboard entries straight away. Moderation records about your account keep the action and reason but not your name or account id.