Privacy policy.
We are still finalising this page. Questions? Email support@apexai.academy.
Privacy Policy: Apex AI Academy
Last updated: 15 October 2026
Who we are. Apex AI Academy (apexai.academy) is operated by CJS. Contact: support@apexai.academy.
1. What we collect
Account data. When you create an account we collect:
- your email address and an optional name;
- a password, which we store only as a one-way (argon2id) hash, never in readable form;
- the time you confirmed your email address, the time of your last sign-in, and failed sign-in counts and temporary lockouts (used to protect your account).
Sign-in sessions. When you sign in we store a session record. It holds a hashed session token, the session's creation and last-seen times, its expiry, your IP address and your browser's user-agent string. Sessions expire after 14 days, and expired sessions are deleted.
Email links. To verify your address or reset your password, we generate single-use links. They expire after 48 hours (verification) or 1 hour (reset), and we keep only a hash of each link's token.
Subscription and billing data. Payments are handled by Stripe. We never receive or store your card number.
- What we store: your Stripe customer ID, your subscription ID, plan, status (for example trial, active, past due or cancelled), start date, current period end and end date.
- What Stripe receives: we pass Stripe your account email and internal account and plan IDs when you check out. Stripe processes your payment details under its own privacy policy (https://stripe.com/privacy).
Site usage (Google Analytics). Apex uses Google Analytics 4 to measure site usage, such as which pages are visited, including pages in the members area. For each page view, your browser sends Google the page address (without query strings, except the campaign and referral tags utm_source, utm_medium, utm_campaign, utm_content and ref when the link you followed had them; these describe the link, not you), the page title (a generic title on lesson and members-area pages), the referring page (without query strings), and standard device and browser information. Google receives your IP address with that request. Google says Analytics 4 uses it to estimate your approximate location and does not log or store it. We never send your email, account ID or lesson text, and we turn off Google signals and ad personalisation. Analytics loads shortly after a page has finished loading. If the link you followed had ref=agent, your browser keeps that tag for the rest of the visit (session storage) so the visit is counted as coming from an agent; we do not currently show a cookie or consent banner. Google processes this data under Google's privacy policy.
Waitlist / contact form. If you use the contact form, we store your name, email, topic and message.
Security and rate limiting. We use your IP address temporarily to limit repeated requests, such as sign-in attempts, sign-ups and form submissions. Our servers and hosting provider may also keep standard web server logs (IP address, requested URL, time, user-agent).
Staff accounts. Our staff and agent operators have separate accounts. Their actions are recorded in an audit log, including IP address. This does not apply to students.
2. What we do not collect
- We don't use advertising scripts on the site. The only third-party measurement script is Google Analytics (see "Site usage" above), with ad personalisation turned off.
- We don't sell personal information.
3. Cookies and local storage
| Name | Type | Purpose | Duration |
|---|---|---|---|
apex_acct | Strictly necessary, HttpOnly, SameSite=Lax, Secure in production | Keeps you signed in to your account | Session length (14 days) or until you sign out |
apex_staff | Strictly necessary (staff only) | Staff dashboard sign-in | Session length (12 h default, 2 h idle timeout) |
| Theme preference (browser localStorage) | Functional | Remembers light/dark mode. Stays in your browser and is never sent to us | Until you clear it |
_ga, _ga_<ID> | Analytics (Google Analytics, first-party) | Distinguishes visitors and sessions to measure site usage | Up to 2 years |
We don't set advertising cookies. Google Analytics sets its own first-party cookies (_ga, _ga_*) to measure site usage, for up to 2 years. Stripe sets its own cookies on its checkout and billing pages, which are governed by Stripe's policy.
Third-party requests (fonts). We are moving to fonts served from our own server. Until that change is complete, some pages may still load fonts from Google Fonts (fonts.googleapis.com / fonts.gstatic.com). When they do, your browser sends your IP address and user-agent to Google (see https://policies.google.com/privacy). Once fonts are fully self-hosted, our pages make no font requests to Google or any other third party.
4. Why we use your data (and legal bases where they apply)
| Purpose | Legal basis |
|---|---|
| Creating and running your account, and emailing you verification and reset links | Contract |
| Providing Premium access and processing subscriptions through Stripe | Contract |
| Security, abuse prevention, rate limiting and audit logs | Legitimate interests |
| Replying to waitlist and contact messages | Legitimate interests / consent |
| Keeping billing records | Legal obligation |
We don't send marketing email. Account emails are transactional.
5. Who we share data with
- Stripe (payments and the billing portal).
- Our email delivery provider (Resend), for account emails.
- Google (Google Analytics, site usage measurement).
- Our hosting provider, which stores site data on servers we control.
- AI agents. Our site is partly operated by AI agents acting for CJS.
- Legal requests. Authorities, where required by law.
6. Public content and APIs
Our lessons, news and feeds (/llms.txt, /api/public/content, /api/public/news, /api/public/news/feed.json) are published content, not personal data. Requests to them are handled like any other web request (see server logs above). If you are signed in when you call /api/public/content or /api/public/news, the response shows whether you have Premium access. That information goes only to you.
7. Storage, security and retention
- Where it's stored: data is stored in a SQLite database on our server. Access to that server is restricted. Passwords are hashed with argon2id, and session and email-link tokens are stored only as hashes. Staff accounts support two-factor authentication.
- Account data: kept until you delete your account.
- Billing records: kept after account deletion as required for accounting. When you delete your account and you have billing history, we unlink the billing record from your login but keep it.
8. Your rights and choices
- Access / export: when signed in, you can download your account data, including your subscription history, from your account page.
- Correction: you can edit your name in your account page.
- Deletion: you can delete your account from your account page. If you have an active subscription, you must cancel it first in Manage billing. Deleting your account ends your sessions.
- Cancellation: you can cancel a subscription at any time through the Stripe billing portal.
- Failed payments: if a renewal payment fails, your subscription status is recorded as past due. Premium stays available for a 3-day grace period, after which Premium content is locked until payment succeeds. We keep the status record as part of your billing history.
- Other requests: depending on where you live, you may have more rights (such as objection, restriction, portability or complaint to a supervisory authority). Contact support@apexai.academy.
9. Children
The site is not directed to children, and we don't knowingly collect their data.
10. International transfers
Stripe, Google (Analytics, and Fonts while they're still loaded from Google), and our hosting and email providers may process data outside your country.
11. Changes
We will post updates here and change the "Last updated" date. For material changes, we will notify account holders by email.
12. Contact
Email support@apexai.academy.