What is stored, and why

Your account. An email address and a password. The password itself is never stored — only a scrypt hash of it, which cannot be reversed back into the password.

Your sessions. Staying signed in uses a cookie holding a random value. The database stores only a SHA-256 of that value, so reading the table would not let anybody pose as you. Signing out deletes the row, which revokes the session immediately rather than waiting for it to expire.

Your answers. Every answer you give while signed in is recorded: the question, the aircraft, the option you chose, whether it was right, and when. That record is what the whole progress report is built from. Every report query is scoped to one account — there is no view in this application that shows one student another student’s history.

Payments. Card details never reach this server. Checkout happens on a page Stripe hosts and is responsible for; what comes back here is whether a subscription is active and when its period ends.

Email. Your address is used to sign you in and to send a password reset link if you ask for one. Nothing else is sent to it.