Who we are
Xyber One (“Xyber One”, “we”, “us”) is a cybersecurity career learning app for iOS and Android, and we operate this website. This policy explains how we handle personal data when you visit the website, join the waitlist, contact us or use the Xyber One app.
For privacy questions or requests, write to privacy@xyberone.com.
What we collect
On this website
- Waitlist: your email address and, if you choose to share them, your goal and phone platform.
- Contact form: your name, email address, topic and message.
- Technical data: standard server logs such as IP address, browser type and pages requested, kept for security and reliability.
In Xyber One
- Account: email, display name, username, avatar, and optional bio, country, job title and LinkedIn URL.
- Learning data: your chosen goal, experience and daily target, module progress, quiz and scenario attempts, flashcard reviews, assessment results, XP, streaks, badges and certificates.
- AI Tutor: the messages you send and the learning context passed with them (role, module, question and your answer). Conversation metadata and your thumbs up or down ratings are stored.
- Usage analytics: product events such as lessons completed or tabs selected, designed to carry minimal personal data.
- Purchases: subscriptions are handled by the Apple App Store or Google Play. We receive the plan status, not your payment card details.
How we use it
- To provide Xyber One: save progress, personalise recommendations, run leagues and leaderboards, and issue certificates.
- To power the AI Tutor and to review answer quality.
- To keep the service secure, prevent abuse and fix bugs.
- To email you about the waitlist, your account and, only if you opt in, product news.
- To understand which features help people learn, using aggregated analytics.
We rely on these legal bases where the law requires one: performing our contract with you, your consent (for optional emails and notifications), our legitimate interests in running and securing a safe service, and legal obligations.
AI Tutor and your data
The AI Tutor sends your message and learning context to our server, which calls a language model provider on your behalf. API keys never live in the app. We send only your first name and what is needed to answer, not your email or other profile details.
We keep tutor transcripts for 30 days for quality review, then delete them. Conversation metadata and ratings may be kept longer in de-identified form. Answers you flag go to a content review queue.
How long we keep it
| Data | Kept for |
|---|---|
| Account and learning data | While your account is active. Deleted within 30 days of an in-app deletion request. |
| AI Tutor transcripts | 30 days |
| Waitlist email | Until launch communications are complete or you unsubscribe |
| Contact messages | Long enough to answer you and keep a reasonable record |
| Server logs | A short, fixed period for security and troubleshooting |
Your choices and rights
Depending on where you live, you can:
- Access and download your data. In the Xyber One app, Profile, Privacy & Security, Download my data exports your profile, progress and attempts as JSON.
- Correct your details in Profile, Edit.
- Delete your account and personal data from inside the app.
- Hide from public leaderboards and control notifications.
- Object to or restrict certain processing, and withdraw consent at any time.
- Complain to your local data protection authority.
To use a right we cannot give you in the app, email privacy@xyberone.com. We may need to confirm it is really you first.
How we protect it
We encrypt data in transit with TLS, store sign-in tokens in the device keychain or keystore, apply row-level security so each learner can read only their own records, grade assessments on the server so correct answers are never sent to your phone, and offer two-factor authentication. Read more on our security page.
No system is perfectly secure. If a breach affects you, we will tell you and the authorities as the law requires.
International transfers
Our providers may process data in countries other than your own. Where required, we use safeguards such as standard contractual clauses so your data stays protected to a comparable standard.
Children
Xyber One is not directed to children under 13, or the higher minimum age in your country. If you believe a child has given us personal data, contact us and we will delete it.
Changes to this policy
We will update this page when our practices change and revise the date at the top. For material changes we will also tell you in the app or by email.
Contact us
Xyber One, privacy@xyberone.com. You can also use our contact page.