Red Heroz Corp
Legal

Privacy Policy

What we collect, what we don't, who we share it with, and how to get a copy or have it deleted. Covers redheroz.com and the Learning Center.

Effective 17 August 2026 · Version v2026.08.17

This policy explains what personal information Red Heroz Corp collects, why, who it goes to, and what you can do about it. It covers two sites that behave very differently, so it is split into Part A (redheroz.com, the blog and storefront) and Part B (learn.redheroz.com, the Learning Center where courses are delivered).

Red Heroz Corp (a Texas corporation) operates both sites and is the party responsible for the personal information described here. You can reach us at hello@redheroz.com or at the postal address in the Contact section at the end.

Part A — redheroz.com

What we do not do

It is easier to start with what is absent, because most of it is:

  • redheroz.com sets no cookies of its own.
  • No analytics. No Google Analytics, no Plausible, no anything else.
  • No advertising or retargeting pixels, no conversion tags, no ad networks.
  • No A/B testing, no heatmaps, no session recording or replay.
  • No third-party trackers loaded into the pages.
  • No accounts and no login on this site, so there is nothing here to sign in to.
  • We do not buy personal information from data brokers, and we do not sell, rent or trade yours.

One detail worth naming because it is unusual: the site's web fonts are downloaded from Google when the site is built, then served from our own hosting. Rendering this site's typography sends no request from your browser to Google.

We share personal information only with the service providers listed further down, and only so they can do work for us.

What redheroz.com collects

Very little, and only when you hand it over:

  • Newsletter. If you ask to subscribe, we store your email address, the source you asked from, the date you asked, and a short code identifying which version of the consent wording was on screen when you did. We also store the date we sent your confirmation email and the date you confirmed it. The confirmation link is stored only as a one-way hash, never as the link itself, so a copy of our database would not let anyone confirm subscriptions on other people's behalf. We do not record your IP address or your browser when you subscribe. If you unsubscribe we record that date too, so we know not to email you again.
  • Purchases. When you buy something, Stripe handles the payment and passes back your email address. We store that email with the order record: the Stripe checkout session ID, the Stripe payment intent ID, the amount, the currency, whether the item was digital or physical, the product identifier, the order status, and timestamps.
  • Shipping address — physical goods only. If you order the Red Heroz Tee, Stripe collects a shipping address at checkout so the item can be posted to you. Shipping is offered to the United States and Canada only. We see that address in Stripe in order to send the parcel; our own order record does not store it. The course involves no shipping address and no country restriction.

That is the whole list. There is no contact form on this site — the contact page simply prints an email address, so nothing is collected unless you choose to write to us. If you do email us, we have your message and your email address, and we keep them for as long as we need them to deal with what you wrote about.

Our host, Vercel, keeps ordinary server access logs for the site, which include IP addresses, as part of running and protecting the service.

Sending your details to the Learning Center

When you buy a course, we send your email address, your name if you gave one, and the course identifier to our Learning Center at learn.redheroz.com so it can create your account and email you an invitation. That transfer is signed so the Learning Center can confirm the request really came from us. Once your account exists, Part B of this policy applies to it.

Part B — learn.redheroz.com (the Learning Center)

The Learning Center is a system we host ourselves on our own server. It has student accounts, so it necessarily stores more than the storefront does.

What the Learning Center stores

  • Your account: your name, your email address, an avatar image if you upload one, your role (student or administrator), and — only if we ever have cause to apply it — a banned flag and the reason for it.
  • Sessions: when you sign in we create a session record containing a session token, your IP address and your browser's user agent string. This is how you stay signed in, and it is what we look at if we need to investigate suspicious access.
  • Enrollments: which courses your account has access to, and the status of that access.
  • Lesson progress: whether a lesson is complete, your last playback position in seconds, and the percentage of a lesson you have watched. This is what lets a video resume where you left off.
  • Quizzes: your attempts and the answers you gave.
  • Certificates: a snapshot of the name printed on the certificate, the generated PDF, and a verification code.
  • Email log: a record of emails we sent you — recipient address, which template, the subject line, delivery status, the delivery provider's message ID, and any error returned.
  • API request log: endpoint, IP address, and a request payload that is deliberately trimmed of email addresses and names before it is written.
  • Administrator audit log: a record of administrative actions taken in the system.
  • Drip notification records: which scheduled lesson notifications have been sent to you.
  • Uploaded media: course video and audio files and their metadata. Video and audio are served from our own server through per-user links that expire.

Passwords are stored only as argon2id hashes. We cannot read your password and we cannot tell you what it is.

Administrator access to your account

Administrators can access a student account for support purposes — for example, to see why a lesson will not unlock. Every such access is recorded against the session as an impersonation, so there is a log of it.

Public certificate verification

Certificates are meant to be checkable by other people, so verification is a publication rather than a private record. If you earn a completion certificate, it carries a verification code, and anyone who has that code can open learn.redheroz.com/verify/ followed by that code and see the name on the certificate and the course it was issued for. We do not publish the codes and the page is not a searchable directory, but it is public to whoever holds the code.

If you would rather not have your full name shown there, email hello@redheroz.com and we will either show initials only or remove the certificate from public verification altogether. Your certificate PDF is unaffected.

Cookies and similar technologies

In this section, "cookies and similar technologies" means cookies, local storage, session storage, tracking pixels and device fingerprinting — anything that stores or reads something on your device or identifies it.

redheroz.com

As of the effective date of this policy, redheroz.com sets no cookies of its own, and we use no analytics, advertising or session-recording tools on it.

There is one small exception, and it is not a tracker. The site stores a single value in your browser's session storage to remember a display preference — whether motion is reduced. It is deleted when you close the tab, and it is never sent to us or to anyone else.

The Learning Center

learn.redheroz.com sets strictly necessary authentication and security cookies, prefixed "redheroz". They are set when you sign in, and they exist to keep you signed in and to protect the session. There are no analytics or advertising cookies on it, so there is nothing optional to consent to and no consent banner to click. If you sign out or clear the cookies, you will need to sign in again.

Stripe Checkout — you are leaving our site

When you click a Buy button you are sent to checkout.stripe.com, which is operated by Stripe, not by us. Stripe sets its own cookies there under its own policies, and card details are entered on Stripe's page. We never see, receive or store your card number.

YouTube video embeds

Some articles may include a YouTube video player. Nothing is requested from Google, or from any other third party, until you click play. The placeholder you see before that — including its preview image, where there is one — is drawn and served entirely by us. If you do click play, the player loads from youtube-nocookie.com, and at that point YouTube receives your IP address and may set cookies under Google's privacy policy.

The distinction matters, so it is worth stating why we build it this way. A click-to-play player that fetches its thumbnail from a Google address has already told Google about you by the time you decide not to watch. Ours does not fetch anything, so declining to click is a real choice rather than a formality.

Do Not Track and Global Privacy Control

We do not track visitors across third-party websites, so a Do Not Track or Global Privacy Control signal has nothing here to act on. We do not claim to honour these signals, because there is no cross-site tracking for them to switch off.

Service providers

We share personal information only with the providers below, and only so they can perform a service for us:

  • Vercel Inc. — hosts and serves redheroz.com and keeps server access logs.
  • Supabase — the managed Postgres database, hosted in the United States, holding orders, entitlements and the newsletter list.
  • Stripe, Inc. — takes payment on our instruction and runs checkout. Stripe also carries out fraud prevention and meets its own regulatory and record-keeping obligations under its own privacy policy, which we do not control. See stripe.com/privacy.
  • Resend — delivers our transactional emails (invitations, password resets, receipts) and the newsletter.
  • Hostinger — provides the virtual server that runs learn.redheroz.com.
  • Google LLC (YouTube) — receives nothing unless you click to play an embedded video. If you do, it receives your IP address and may set cookies.

We may also disclose information if the law requires it, or to protect our rights, our users, or the security of our systems.

The newsletter

The newsletter is free and optional. You give us an email address; we send occasional writing about the same subjects as the blog. Every newsletter has an unsubscribe link at the bottom, and one click removes you. You can also email hello@redheroz.com and ask to be removed, and we will do it by hand.

Subscribing takes two steps, and this is deliberate. Filling in the form does not put you on the list. It sends one email to that address containing a confirmation link, and only clicking that link subscribes you. The reason is that the form is public: anyone can type anyone else's address into it. Requiring a click that can only happen in the mailbox itself means the person who receives the newsletter is the person who asked for it.

So if an email from us arrives asking you to confirm a subscription you never requested, ignoring it is enough. That single message is the only one you will get, and doing nothing means you stay off the list. Unconfirmed requests expire after seven days.

The same applies to coming back. If you unsubscribed and later want to return, subscribing again sends a fresh confirmation link — we will not put you back on the list without one, whoever submits the form.

Unsubscribing from the newsletter does not stop email about a purchase you made — receipts, course invitations, password resets — because those are part of delivering what you bought.

Children

Red Heroz Corp is for adults. You must be 18 or older to buy from us or to hold a Learning Center account, and we do not knowingly collect personal information from anyone under 18. If you believe a child has given us personal information, email hello@redheroz.com and we will delete it.

Security

We take reasonable measures suited to a small operation:

  • Traffic to both sites is encrypted in transit (HTTPS).
  • Passwords are hashed with argon2id and are not stored in readable form.
  • Database and server access is restricted to the operator and the service providers listed above, using separate credentials.
  • Course video and audio are served through signed links tied to your account that expire.
  • We do not store card numbers.

No system is perfectly secure, and we are not going to pretend otherwise. If something goes wrong that affects your information, we will look into it, tell affected people what we know, and notify people where the law requires it.

How long we keep things

  • Order and tax records — kept for the period tax and accounting law requires us to keep them.
  • Newsletter records — kept while you are subscribed, and for a period afterwards so we can show you were removed and avoid adding you back.
  • Learning Center account data — kept for as long as your account exists, because it is what makes the course work. There is no expiry date on your enrolment; what "lifetime access" means is set out in clause 7 of the Terms of Service.
  • Logs (server access logs, email log, API request log, administrator audit log) — kept for a limited operating period and then rotated out.

Deletion

If you ask us to delete your information, here is what actually happens:

  • We remove the records we can remove from our live systems, and we will tell you if something is holding it up. If you are a Washington or Nevada resident, the deadlines in the Consumer Health Data Privacy Notice apply to your request and we meet them.
  • Our databases are backed up on an encrypted, fixed rotation. A deleted record may still sit in a backup until that backup is overwritten in the ordinary course. We do not mine backups to bring deleted records back.
  • We have to keep order and tax records, so deletion does not cover those. If you delete a Learning Center account while your course access is live, that access ends.
  • Stripe keeps its own record of the transaction to meet its own legal obligations. We cannot delete that on your behalf; you would need to take that up with Stripe.

Your choices

Everyone who reads this gets the same choices, wherever you live. Email hello@redheroz.com and you can:

  • Ask what we hold about you, and get a copy of it.
  • Correct anything that is wrong — your name, your email address, the name printed on a certificate.
  • Delete your information, subject to the deletion section above.
  • Unsubscribe from the newsletter.
  • Change your certificate's public verification to initials only, or remove it.

We are a one-person business, so we answer these ourselves. We will not leave you waiting without a word. Where a law sets a deadline for a request — as Washington's and Nevada's do — we meet it; see the Consumer Health Data Privacy Notice. We may need to confirm you control the email address in question before we act, because otherwise anyone could ask for your data.

Related notices

If you are a Washington or Nevada resident, please also read the Consumer Health Data Privacy Notice. Our purchase and access terms are in the Terms of Service, refunds in the Refund Policy, and the limits of what this course is in the Disclaimer.

Changes to this policy

If we change this policy we will update the effective date and the version number at the top. For material changes, we will also email people who hold a Learning Center account. Older versions are superseded on the date shown; the version you are reading is the one that applies.

Contact

Red Heroz Corp is the operator responsible for redheroz.com and learn.redheroz.com, and is the point of contact for anything in this policy.

  • Red Heroz Corp
  • 5900 Balcones Dr, Suite 100, Austin, TX 78731
  • hello@redheroz.com