Privacy
What Keelmark keeps
As little as the course needs. No accounts, no email addresses, no analytics services, no tracking cookies.
Reading the lessons
The home page, the syllabus and the information pages set no cookie. Lesson pages, the exam page and the record page carry a form, so they set one security cookie (__Host-km_csrf, kept for a day) that stops a form being sent from another site; it holds a random token and nothing about you. So do the page that opens a private link and a certificate’s check page when its holder views it, since both carry a form too. Reading stores nothing about you in Keelmark’s database.
Your record
When you start a record, Keelmark makes a random 20-character key and stores only its SHA-256 fingerprint, with the time it was made and last seen. The key itself lives in one cookie on your device (__Host-km_rec, kept for 400 days) and in the private link shown on your record page. On the record Keelmark keeps your lesson-check scores, your exam sittings (which questions were drawn, your answers and the score) and any certificate.
Your certificate
A certificate stores the name you typed, its number, your exam score, the syllabus version and the date. Anyone who has the number can see these on its check page; that is the point of a check page. Check pages ask search engines not to index them. Withdrawing a certificate erases the name.
Limits on use
To slow down abuse, Keelmark counts some actions per visitor address (lesson checks, new records, opening a private link, exam sittings, certificates, look-ups). It stores a salted fingerprint of the address, never the address itself, and deletes the counts after two days.
Server logs
The hosting server keeps standard access logs (address, time, page requested, browser) for a limited time, as web servers do. A page address in a log can include a certificate number or a private record link.
Deleting everything
“Forget this record” on your record page deletes the record, its checks, its sittings and any certificate issued from it, and removes the cookie. Records not seen for 400 days are deleted automatically, unless they hold a certificate that has not been withdrawn. A forgotten record and a withdrawn certificate’s name stay in backups until those backups are deleted (below).
Backups
So the site can be restored after a failure, the database is copied every night and each nightly copy is kept for 14 days. A copy is also made just before and just after each software update; the server keeps the newest ten of those, and WeldonPC.com keeps copies of them on its own storage for restoring the site. A record you forget, or a name erased by withdrawing a certificate, is deleted from backups only when those copies are deleted, so it can remain in them after it has gone from the site. Backups are never published and are used only to restore the site.
Sharing
Keelmark sells no data and shares none. There are no tracking cookies. The one outside service Keelmark’s pages load is the adengine.us banner described under Advertising. When checkout opens, PayPal will handle payments on its own pages under its own privacy terms.
Advertising
The home page, the syllabus, the lesson pages, the pricing page and the about page each show one banner ad, below the page’s own content. It comes from AdEngine (adengine.us), the small ad network run by WeldonPC.com, the company behind Keelmark. For now the ads are for WeldonPC.com’s own services. The exam, your record, private links, certificates and their check pages, lesson-check results, this page, the terms and error pages show no ad.
To show the ad, your browser loads a script from adengine.us, asks it for one banner, loads the banner image, and reports once that the page was viewed and once that the banner was shown. Like any website, adengine.us receives your visitor address (IP address) and browser type with those requests. The requests name this site; they never carry the address of the page you are reading.
- No cookies, no profile. AdEngine sets no cookies, gives you no ID and does not follow you from site to site.
- How your address is used. adengine.us looks up the approximate city for your address in a location database kept on its own server (nothing is sent to anyone else), so that ads meant for one area are shown only there. It also uses the address to count each ad view or click only once and to leave out robots and WeldonPC.com’s own office traffic. The address is not stored with the counts; the temporary entries made from it expire within six hours and are cleared from the server within two days.
- What is kept. Daily totals only: page views for this site (one per page with the banner), and views and clicks for each ad. The adengine.us web server also keeps a standard access log (address, time, address requested, referring site, browser) for security; it is deleted on a rolling schedule.
- Clicking an ad passes through adengine.us, which counts the click, and then opens the advertiser’s site, which has its own privacy policy.
- Nothing about you is sold or shared.
Questions about this notice: ask WeldonPC through weldonpc.com/contact.