What we collect
What we hold depends on what you do on the site:
- You can practise the free lessons without an account. Then your progress is not saved on our servers; it stays in your browser (see Cookies and storage below).
- Your account. When you sign up, our sign-in provider, Clerk, keeps your email address, your name if you give it, and your sign-in details. Our own database links your progress to you by your Clerk account id; it does not hold your email address.
- Your practice. For each exercise: whether you solved it and when, how many tries and hints it took, the last formula you checked, and when it is due for review. Every answer you check: the formula, whether it was right and, if not, the kind of mistake, with the time and the day where you were. Your time zone, as your browser reports it, so your streak counts your days.
- Your final tests: the exercises drawn for you, when each test started and ended, the formulas you entered and the order you saved them in, which were right, and your score.
- Your certificate, if you earn one: the name you choose to print on it, your final-test score, the date, and what the course covered.
- Payments. Plans are sold through Clerk Billing, and card payments are handled by Stripe. Your card number goes to Stripe; we never see or store it. We know which plan you have, and record its payments in our analytics (see Analytics below).
- Teams. If you join a team, its admins and members can see your name and email address in the team’s member list. They cannot see your progress.
- What you send us when you write to us.
- How you use the site, through analytics (see Analytics below).
Why we use it
To run the lessons and save your progress, to check your answers, to issue and verify your certificate, and to provide the plan you pay for. This is necessary for our contract with you.
To understand how the site is used and improve it (analytics), and to keep the site secure, including limiting how many answers one account can have checked in a short time. These are our legitimate interests.
To meet our legal obligations, such as keeping billing records.
We do not sell your personal data.
Analytics
We use PostHog to understand how ExcelStreak is used and to improve it, on every page of the site, including the blog and the function reference. It records the pages you open, what you click, when you check or solve an exercise or open a hint (which exercise, whether the answer was right, the kind of mistake, how many tries and hints it took, but not the formula itself), which version of the home page you were shown, your browser, device and screen size, the site that sent you, and the campaign details in the address (utm_source and similar). When you arrive from an ad, it also records the ad's click id (such as Google's gclid), so we can tell which ads work.
Analytics reaches PostHog through our own site, which passes on your IP address so PostHog can work out your approximate location (country, region and city).
Until you sign in, PostHog knows your browser only by a random id. When you sign in, it links your visits to your account by your account id and your email address, so we can understand how learners use the site. It is not given your name.
When you pay for a plan, our server also records it in PostHog, linked to your account id (and, for a team's plan, to the team's id): when the plan starts, renews, changes (for example from monthly to yearly), is canceled, falls past due or ends, and each payment, including one that fails. Each record has the plan, whether it is monthly or yearly, whether it is a free trial, a team's number of seats, the amount, the tax, the price of the next renewal and the currency, and the ids our payment provider gives the plan and the payment. This tells us how long people keep each plan. We do not send your card details, why a payment failed, your email address or your name with these records. In PostHog they sit with your visits, on the profile that has your email address once you have signed in.
PostHog also makes session recordings: a replay of a visit, showing the pages, scrolling, mouse movements and clicks. Whatever you type into a field is hidden in a recording, except the formulas you type into the practice spreadsheet of a lesson or of the home page, which we keep so we can see how people work out a formula. The text of the sign-in and account forms, the name on a certificate and the page title are hidden too.
Before anything is sent, secret codes that can sit in a link (sign-in tickets, password-reset and other tokens) are removed from every address.
Analytics starts as soon as you open a page; it does not wait for the cookie banner. The banner lets you choose about session recordings only. Decline stops them at once, in every tab you have open on the site, and on every later visit, on the lessons, the blog and the function reference alike: one answer counts for the whole site. Everything else described here continues, and if you are signed in your visits stay linked to your account and your email address. Accept, or not answering, leaves recordings on. Once you have answered, the banner is not shown again; to change your answer, clear this site's data in your browser and it asks again. If your browser does not let the site store anything, your answer can't be remembered: it holds until the page is reloaded (moving between the lessons and the blog reloads it too), and then the banner asks again.
Cookies and storage in your browser
ExcelStreak stores these in your browser:
- Sign-in cookies from Clerk, which keep you signed in and protect your session. The site needs them to work, so they are always on.
- "xlc_landing", which remembers which of two versions of the home page you were shown, so you see the same one each time. It is set the first time you open the home page and lasts 90 days.
- PostHog's cookie and browser storage (their names start with "ph_"), which hold the random id that recognises your browser from one visit to the next (and your account id and email address once you sign in), the first page you opened on the site and the site that sent you there (without any secret codes, see Analytics), the current visit, and which version of the home page you were shown. The cookie lasts up to 365 days.
- "xlc:consent" in local storage: your answer in the cookie banner (Accept or Decline), so the banner is not shown again and a Decline keeps session recordings off on every part of the site. It is kept until you clear this site's data, and it never leaves your browser.
- "xlc:solved" in local storage: the exercises you solve without an account, with your formula and when you solved it, so they move into your account when you sign up. An entry named "xlc:solved:" followed by your account id keeps an answer that could not be saved to your account (for example when you were offline) until it can be. Nothing in them leaves your browser until then.
- When you pay, Stripe's payment form may set its own cookies, which Stripe uses to prevent fraud.
Your certificate is public
Each certificate has its own page at an address like excelstreak.com/certificates/…, so an employer can check it. Anyone with the link can see the name on it, the score, the date, the number of modules and exercises, the functions covered and the certificate id. We do not list these pages anywhere, but if you share the link publicly (for example on LinkedIn), search engines may find it. Deleting your account removes your certificate and its page. To have it removed and keep your account, write to hello@excelstreak.com. A copy a search engine already made can take a while to disappear.
Who handles your data for us
We share personal data only with the companies that run parts of the site for us, each for its own part; with a buyer or successor if the site is ever sold; and with authorities where the law requires it. The companies are:
- Vercel, which hosts the site and handles every request to it, including your IP address.
- Neon, which hosts our database (your progress, your answers, your final tests, your time zone and your certificate).
- Clerk, for sign-in, accounts, teams and billing.
- Stripe, which handles card payments for Clerk Billing.
- PostHog, for analytics and session recordings.
Where it is processed
Some of these companies process data outside your country, including in the United States.
How long we keep it
Your progress, answers, final tests, time zone and certificate are kept while your account exists.
When your account is deleted, by you from your account page or by us (see the Terms), Clerk removes your sign-in details and tells our site, which then deletes everything our database holds about you: your progress, your answers, your final tests, your time zone, your certificate (its page stops working) and the record that links them to your account. This happens on its own, usually within a minute, and cannot be undone: signing up again starts from nothing. If it fails at that moment, Clerk tries again for about a day. You cannot see this from outside, so if you want to be sure, write to hello@excelstreak.com from the email address your account had and we will check, and delete anything that is left.
Our database host, Neon, keeps a short history of changes so the database can be recovered after a fault; what was deleted leaves that history when it runs out.
What is stored in your browser stays there until it is saved to your account, or until you clear your browser’s data. Deleting your account does not clear it.
Analytics and session recordings are kept by PostHog for the period our PostHog plan sets, and then deleted.
Deleting your account does not delete what PostHog holds: your visits, your recordings, the record of your payments, and the account id and email address they are linked to. PostHog is not told. Payment records that arrive after your account is deleted, such as your plan ending, are recorded too, linked to the same account id. To have them deleted, write to hello@excelstreak.com from the email address your account had.
Billing records are kept by Clerk and Stripe for as long as tax and accounting law requires.
Your rights
You can ask us for a copy of your personal data, to correct it, to delete it, to limit or object to how we use it, or to receive it in a portable form. Write to hello@excelstreak.com from the email address of your account. You can also complain to your data protection authority.
Security
Connections to the site are encrypted. Analytics and the blog are passed through our own site in a way that never forwards your sign-in cookies to those services. No system is perfectly secure, but we limit who can reach your data to what running the site needs.
Children
ExcelStreak is not meant for anyone under 14.
Contact
ExcelStreak, Dollani, LLC, 262 Chapman Road, Suite 240, Newark, DE 19702, United States. Email: hello@excelstreak.com.