Privacy Policy
Version 0.8 · 8 September 2026 · Rockbeach, LLC
What Rockbeach, LLC holds about you, why, and who else sees it. Where something is not settled this says so rather than filling the gap with a sentence that sounds reassuring.
What this covers
How Rockbeach, LLC handles personal information in Rockbeach Training at rockbeachtraining.com. Rockbeach Currents is a separate product with its own policy.
What we hold about you
Because you gave it to us: your name and email address, and - only if you choose to - your mobile number, where you are studying or working, a photo, and a résumé file. Your name, your email address and a password are the only things required to have an account.
Your date of birth, which we ask for and do not keep. Signing up asks for it because accounts are for people aged 18 and over. We work out whether you are 18, record the fact that we checked and the date we checked it, and store nothing else - the birthday itself is never written down. Asking and discarding is deliberate: a birth date we do not hold cannot be lost, and nothing in the product needs one.
Because you used the course: your exam attempts and scores, the answers you chose, the written answers you submitted and their grades, which sections you have read, how you used the simulated ticketing system, the badges you have earned, and anything you posted on the board.
Because a browser asks for a page: sign-in cookies, and a count of active seconds and how far down a page you scrolled. That counting is our own and stays with us. We do not store your IP address, and we do not record which browser or device you used.
If you pay us, what the payment needs. Card details are typed into Stripe's form and go to Stripe, not to us - we never receive, see or store a card number. What we keep is a Stripe customer reference, and for an organization being invoiced, the billing contact, the billing address and any purchase order number its finance office needs printed on the invoice.
If you teach. A faculty account holds your name, your institutional email address, where you said you teach, and the classes you create - a name, a length in weeks, and roughly how many students you expect. Nothing is charged to a faculty account. We hold no more about a professor than we hold about a student, and a good deal less.
If your professor uploads a class list. A professor can paste the names and email addresses of their students so that their class link only works for the people actually in the class. This is the one place where somebody else gives us your details rather than you, and it means we may hold your name and address before you have ever opened Rockbeach - or without you ever opening it at all. We use a class list for one thing: deciding whether an address may join that class, and telling your professor if the name you signed up under does not match the one they listed. It is never used to email you, is never shared with anyone outside your class, and is replaced whenever your professor uploads a corrected list. If you want to be taken off one, ask your professor - they can remove the list themselves - or write to us at hello@rockbeachtraining.com and we will delete it.
An access code, if you have one. Accounts opened before passwords existed used a code, and a trainer can still issue one to somebody locked out. We keep it on your record so a trainer can look it up for you. It stops working as a way in once you set a password.
If you text us, the message and the number it came from. Replies to our texts reach a Rockbeach number and are kept so we can act on STOP and HELP and answer you. If you never text us, there is nothing here.
Your password, in a form nobody can read. We never store the password itself. We store a scrambled version of it - scrypt, with a random salt for each account - which cannot be turned back into the password. Nobody at Rockbeach can read it, tell it to you, or hand it to anyone else; if you forget it we can only replace it. Signing in creates a session that lasts thirty days, and changing your password ends every other session immediately.
What we do not do
We do not sell your personal information.
We do not run third-party analytics, advertising pixels or trackers of any kind. There is no Google Analytics, no advertising network and no social media tracking anywhere in this product. The only measurement is our own, described above.
We do not use advertising cookies. The cookies we set exist to keep you signed in.
What we use it for
To run your account and show you your own progress. To grade written answers and produce the reading of your results on your profile. To let a Rockbeach trainer help you. To issue and verify certificates. To improve the course.
Who else sees it
Rockbeach trainers. They can see your work, your scores, and which account is behind a board handle.
Companies that run parts of the service for us. Vercel — Hosts the site and stores uploaded files. Neon — Stores the database. Anthropic — Grades written answers and writes the reading of your results. Twilio — Would carry text messages, if you have asked for them. Resend — Sends account email, such as a password reset link. Stripe — Takes payment when a paid tier is switched on. Card numbers go to Stripe and never to us. Google — Checks who you are when you choose "Continue with Google", and only then. Each handles the information on our instructions and none of them may use it for anything else.
Rockbeach Currents. Rockbeach, LLC runs both products and shares information between them where running your account requires it - for example, connecting your training to your production numbers if your employer uses Currents. Currents has its own privacy policy, its own subprocessor list and its own security statement, published at rockbeachcurrents.com/legal, and its list is not identical to the one above.
Google, only if you choose it. If you press "Continue with Google", Google tells us your name, your email address, whether it has verified that address, and a link to your profile picture. The permissions we ask for are openid, email and profile - we request no access to Gmail, Drive, contacts or calendar, and we send Google nothing about you. We keep the Google account identifier so signing in a second time is one click. An address Google has not verified is refused, because accepting one would let somebody who can claim an address at Google take over the Rockbeach account that uses it. If you never press that button, Google is told nothing - no Google code runs on any page of this site.
Signing in with Google does not skip the age check. Somebody who arrives through Google without an account is sent to the ordinary sign-up form and gives a date of birth like anybody else. There is no way into an account that avoids it.
Hiring organizations - only if you switch it on. Sharing your profile with hiring organizations is off unless you turn it on, and even then nothing is shared before you reach expert level. You can turn it off at any time and you disappear from their searches immediately.
Rockbeach partners - only if you switch that on, separately. A second and different box. If you tick it we may pass your name and your email address, and nothing else, to a partner - never your phone number, never your résumé, never your scores. It is for offers and material connected to training, such as a partner's newsletter. It is off unless you tick it, it is independent of the box above, and turning it off stops any further sharing from that point. We have no partners today, so nothing has been shared with anybody under it; the permission is asked for now so that we are not writing to you later to ask for it.
Anyone, for two things you can see. The board is readable by anybody who can reach it, under your handle rather than your name. A certificate verification page is public and shows the holder's name, score, issue date and code.
Nobody, when you share a badge. The share buttons on a badge are ordinary links to LinkedIn, X, Facebook. Nothing from those companies loads on this site, nothing is sent to them unless you click, and the page you would share carries the badge rather than your name or your scores.
Text messages and email
Both consents are off unless you tick them. We store the exact sentence you agreed to and when, so there is a record of what you were actually asked.
You can turn either off in your profile at any time, or reply STOP to any text. Turning it off is recorded with the time.
How long we keep it
Said plainly, because a retention schedule we do not operate would be worse than none: nothing in Rockbeach Training deletes itself automatically today. Your account and the work in it stay until you or we remove them.
Ask us and we will delete your account and the personal information in it. Two things survive: a board post is hidden rather than erased, so a conversation other people took part in stays readable, and it stops carrying your handle; and certificate records are kept so that a certificate you have shown to an employer does not stop verifying.
What the right retention period should be is not settled, and we would rather say that than publish a number we do not keep to.
Your choices
You can see and change most of what we hold from your profile: your picture, where you are now, both message consents, recruiter sharing, and your résumé.
Ask us for a copy of what we hold about you, for a correction, or for deletion, and we will do it. Email privacy@rockbeachtraining.com.
Under 18
Rockbeach Training is for people aged 18 and over. Signup refuses a date of birth under 18 and stores nothing from that attempt. If you believe somebody under 18 holds an account, tell us and we will close it.
Where it is stored
On servers in the United States. Every company listed above that handles Rockbeach Training information is based in the United States and stores it there. If you use Rockbeach from outside the United States, your information is handled there.
Some things cross that border, and none of them are yours from this product. Rockbeach Currents - the separate product for athletic departments, with its own privacy policy - uses two services operated from Germany: one that alerts Rockbeach when a school asks for help, carrying the school's name and the type of request and nothing else, and one that returns historical weather for a venue, carrying a location and a date and nothing about any person. Neither receives personal information, and nothing collected through Rockbeach Training is sent to either.
They are named here because this page tells you information can move between the two products, and you should not have to read a second policy to find out the other one has processors abroad. The current list for Currents is published at rockbeachcurrents.com/legal/subprocessors, and that page rather than this one is the authority on it.
Changes
The version and date are at the top of this page. If a change is material we will say so in the product rather than changing the page quietly.
Contact
Rockbeach, LLC — privacy@rockbeachtraining.com
Privacy Policy, version 0.8, 8 September 2026. See also the Terms of Service.