Last updated: November 6, 2026

Privacy policy

What we collect

If you sign up for a free guide or our research briefings, we collect your email address.

Why

To send you what you asked for (the guide) and occasional research briefings. We never sell or rent your data.

Who processes it

Emails are stored and sent by Sender (sender.net). When you sign up, the site checks that your email domain can receive mail; nothing else is stored on this website. Free videos on this site are embedded from an external video platform in privacy-enhanced mode. The site is hosted on Cloudflare Pages. Analytics: Cloudflare Web Analytics, and Google Analytics only with your consent (see below).

Course purchases

Payments for the paid course "AI Security Engineer" are processed by Razorpay (razorpay.com), a payment gateway. You pay on Razorpay's own secure payment page; this website never sees or stores your card, UPI or bank details. Razorpay handles that payment data under its own privacy policy and keeps the transaction records the law requires.

What we send to Razorpay when you press Buy: the email address and mobile number you type on our Buy form (Razorpay requires a phone number for every payment; we pass it on and do not store it), the price and currency you chose, and a random ticket ID that links the payment back to your purchase. What Razorpay tells us back: that the payment succeeded (or was refunded), its payment ID, amount and currency. We don't keep your name, phone number, address or card details.

To give you access, this website stores only: your email address (the one you typed on the Buy form; it's also your sign-in email), the Razorpay payment ID, the amount and currency you paid, and whether it was refunded; your sign-in sessions (a fingerprint of a random session ID and its expiry date, so you can be signed in on up to 3 devices); sign-in codes we email you, kept only as a salted, keyed fingerprint (never the code itself), valid for 10 minutes and deleted within about a day; an instant-access ticket created when you press Buy (a random ID plus a fingerprint of a secret that stays in your browser, your email, the price and Razorpay's payment-link ID), which lets the browser you paid in sign in straight after paying, works once and expires after 24 hours (unpaid tickets are deleted about a week later); and short-lived, hashed attempt counters used to block guessing and abuse (no raw IP addresses). This is kept in a Cloudflare D1 database. Sign-in codes and the welcome email are sent by Sender (sender.net) as transactional emails, with no marketing and no tracking pixels from us; they are not added to the newsletter. The course area uses three essential cookies (on the course's own address, learn.thesecguy.com, they are named with the __Host- prefix, which means the browser keeps them for that one address only): tsg_learn, only in the course area, to keep you signed in for up to 30 days; tsg_claim, only for the instant-access ticket (up to 24 hours, deleted once used); and tsg_login, only on the sign-in page, which ties an emailed sign-in code to the browser that asked for it (30 minutes). Course videos are streamed by Bunny.net with time-limited links. To discourage sharing, videos show your own email address and an account code as a faint watermark (only you see it, on your screen), and we keep a small record of which signed-in session is currently streaming a video (a fingerprint of the session, the video ID and the time), so one account plays one video at a time; it is deleted with your enrollment. Course PDFs you download are stamped with your email and payment ID so a shared copy can be traced.

If you are refunded, access ends and your sessions, instant-access tickets and any pending sign-in codes are deleted or canceled. To have your course records deleted, email [email protected] from the address you bought with; we'll confirm within 30 days (Razorpay keeps its own transaction records as the law requires).

Free accounts

You can create a free account to open the free lessons of the course. We store the same things as for a paid account, minus anything about payment: your email address, your sign-in sessions and codes, your progress and badges, and whether you ticked "Send me research briefings". Only if you ticked it do we add your email to our briefing list at Sender (sender.net), and every briefing has an unsubscribe link. Free accounts follow the same EU rule: if you sign up from an EU/EEA connection or tick "I live in the EU / EEA", the account is stored only in our EU database. If you later buy the course with the same email, your free progress moves to your paid account and the free account is closed. To delete a free account, email [email protected].

On the course sign-in page you can use "Continue with Google" instead of an emailed code. It is optional, and the email code works just as well. We ask Google for one thing only: the verified email address on your Google account (the openid and email scopes). We never ask for your name, photo, contacts, calendar or anything else, we never post anything to your account, and no Google script, button image or font loads on our pages. Google tells us that email address and whether Google has verified it; we use it only to find a course account you already bought with that same address. Signing in with Google never creates an account or grants access on its own: if no active purchase matches the address, we sign you in to nothing and show a neutral message. While the sign-in is in flight your browser holds one short-lived cookie, tsg_google (on learn.thesecguy.com it is named __Host-tsg_google), which ties Google's answer to your browser and is deleted within 10 minutes or as soon as the sign-in finishes. To stop this site from using your Google account, remove its access in your Google Account under Security, "Your connections to third-party apps and services".

Certificates and the public verify page

When you finish the course you can claim a certificate of completion. You type the name to print yourself. We store it with a random certificate ID, the issue date and the cloud streams you completed. It sits in the same database as the rest of your course account (the EU one for EU / EEA buyers). Each certificate has a public page at thesecguy.com/verify/<certificate ID> so an employer can check it. That page shows only the name on the certificate, the course title, the cloud streams completed, the issue date, whether the certificate is valid, and a list of skills. There is one skill per module you completed, marked "Assessed" where you passed the module's final quiz. That list is worked out from your progress each time the page is opened, so modules you finish later appear too. It never shows your email, payment details, quiz scores, dates or XP. It asks search engines not to index it, and only people you give the link (or ID) to can find it. If a certificate is revoked (for example after a refund), the page says so and no longer shows the name. Deleting your course account deletes the certificate and its page.

Capstone grading

The M19 capstone and the M32 advanced capstone are graded automatically, the same way. When you submit, we store the address of your public GitHub repository, the commit you chose, which capstone it is for, the time, and later the grade and the results of the automated checks. This sits in the same database as the rest of your course account (the EU one for EU / EEA buyers) and is deleted with it. To grade it, we start a job in a private GitHub repository of ours (GitHub Actions, run by GitHub, github.com) and give it only four things: your repository address, the commit, which capstone (M19 or M32) and a random submission number. It never receives your email, your name or where you live. That job downloads your public repository from GitHub, runs the course's own checks on throwaway GitHub machines and sends us the results. No AI model reads or scores your work. Everything the job reads is already public in your repository. The course owner can read your submission and change a grade. Your capstone submissions are included in "Download my progress".

Where your data is stored

Buyers in the EU / EEA: your course account (email, Razorpay payment ID, sessions, sign-in codes, progress, badges, the stamped copies of your PDFs, and our admin notes about your account) is stored only in a Cloudflare D1 database and a Cloudflare R2 storage bucket that were created with Cloudflare's EU jurisdiction setting, which keeps the stored data inside the European Union. We treat you as an EU / EEA buyer if you buy from an EU / EEA internet connection; this is decided once, when you buy. If you live in the EU / EEA but bought from elsewhere, email [email protected] and we'll sort it out.
Everyone else: the same records are stored in a Cloudflare D1 database and R2 bucket without a jurisdiction setting, so Cloudflare may store them in any of its locations worldwide.
Either way: the website's code runs on Cloudflare's network, in the data center that answers your request (usually one near you), so your request is handled there even though the stored records stay where described above. Short-lived, hashed attempt counters (no raw IP addresses) from visitors connecting from the EU / EEA are kept in the EU database; those from other visitors are kept in the global one.
Payments: Razorpay, our payment processor, processes your payment and keeps its own records.
Emails: sign-in codes, the welcome email and the newsletter are sent by Sender (sender.net).
Capstone grading (M19 and M32): GitHub (GitHub Actions) receives your public repository address and reads its contents as described under "Capstone grading", never your email or name.
Videos: course videos are streamed by Bunny.net (bunny.net), which receives the technical data any video host needs to deliver a stream to you.
Backups: once a week we save an encrypted copy of the course database so a technical failure can't lose your account. The copy for buyers outside the EU / EEA is encrypted by our backup job and kept in a private GitHub repository of ours for 90 days; only we hold the key. The EU database is not copied there: it stays in Cloudflare's EU storage.

Your choices

Every email has an unsubscribe link. To see or delete your data, email [email protected] and we'll handle it within 30 days.

Deleting your data

Email [email protected] with the subject "Delete my data" and the email address to remove. It will be deleted within 30 days and you'll get a confirmation.

Analytics

We use two tools to see which pages are useful. They run only on the public pages, never in the course area (/learn), the owner console or our server endpoints.

Cloudflare Web Analytics counts page views and page load times for everyone. It sets no cookies and stores nothing on your device, and Cloudflare says it does not collect or use visitors' personal data. It does not record query strings.
Google Analytics 4 runs only if you click Accept on the cookie banner. Until then Google's script is not loaded at all. If you accept, Google receives: the page address without anything after ? or #, the address of the page you came from (shortened the same way), your browser, device type, screen size and language, an approximate location that Google derives from your IP address, and a few events: viewing the course page or a free lesson, a successful newsletter signup (and which guide), clicking a link to one of our videos, and pressing the course Buy button (with the currency only). We never send your name, email address or anything you type into a form. Google signals and ad personalization are off, we run no ads, and Google's advertising consent settings stay "denied". Google Analytics keeps this data for at most 14 months, then deletes it.

Error reports and server logs (course area)

So we can fix problems before you have to tell us, the course pages send us a short, anonymous report when something breaks in your browser: a script error in our own code, the video player not loading or not starting, a failed request to our server, or a very slow page. A report holds the kind of problem, the type of page (for example "lesson", never the address), a short error message with email addresses removed, your browser family (for example "Safari on iPhone") and the country Cloudflare sees. It also holds a random ID for that browser tab, kept in the tab's session storage under tsg-tab and deleted when you close the tab; we store it only in a scrambled form that changes every day. It never includes your email address, your account or your IP address, and the course area still loads no analytics.

Our server writes a log line for each request to the course area, the owner console and our endpoints. Log lines carry a short reference code (shown as "Reference" on error pages, so you can quote it when you email us), the page type, the result and the time taken. For course students outside the EU/EEA they also carry the account code printed in your video watermark; for students in the EU/EEA they carry only the region "EU". They never contain email addresses or IP addresses. Logs are deleted after at most 30 days.

Cookies and your choices

If you click Accept, Google Analytics sets two cookies, _ga and _ga_<ID>, which tell visits apart (Google keeps them for up to 2 years). If you click Reject, or ignore the banner, no analytics cookies are set. To change your mind at any time, use Cookie settings at the bottom of every page; choosing Reject there deletes the _ga cookies from this site. Your choice is remembered in your browser's local storage under tsg-consent, and your Light/Dark choice under tsg-theme; neither is sent to us.

The course area uses only the essential cookies described above (tsg_learn for staying signed in, tsg_claim for instant access after buying, tsg_login for sign-in codes, and, only while a "Continue with Google" sign-in is in flight, tsg_google for up to 10 minutes). This site sets no advertising cookies.