Privacy Policy

Signifier is an online UI/UX design course operated by Savinda Rukshan in Sri Lanka, at signifier.academy. For any question about your data, write to hello@signifier.academy.

If you only read the free lessons, we collect nothing that identifies you. No account is required and there is no tracking cookie.

If you give us your email address — to receive the rubrics, or to create an account — we store that address, and where you arrived from if you came via a tagged link (for example, which ad or which video description).

If you have an account, we additionally store:

• Which lessons you have completed, and how far through a video you are, so you can resume.
• Your quiz attempts and scores.
• Notes you write against a lesson, and flashcard review history.
• Work you submit for an exercise — images or links you upload — and the feedback written on it.
• Whether you are enrolled, and which tier you bought.

If you pay us, we store the amount, currency, date and the reference you provide. We never see or store your card details. Those go directly to the payment processor.

• Card numbers, CVVs or bank credentials — these never reach our servers.
• Your name, address or phone number. We do not ask for them.
• Anything from advertising or analytics cookies on the free pages.

• To give you access to what you paid for, and to let you resume where you left off.
• To review your submitted work and return feedback.
• To issue and verify your certificate.
• To send you course-related email you asked for, which you can stop at any time.
• To know which channels bring students, so advertising money isn't spent blindly.

We do not sell your data, and we do not share it for anyone else’s marketing.

These companies handle data on our behalf, under their own terms. They are the only third parties involved.

• Supabase — accounts, course progress and submitted work.
• Vercel — hosting, and standard server logs including IP addresses.
• Bunny.net — video delivery, when video is enabled on your lessons.
• PayHere — card payments. Your card details go to them, not to us.
• Resend — transactional and course email, when email is enabled.

A certificate is only useful if someone else can check it. When one is issued to you, a public page at signifier.academy/verify/ shows your name, the course, the date and the serial to anyone who has the link — no account required. That is the entire point of it.

Nothing else appears there: not your email, not your scores, not your submitted work. If you would rather no such page existed, tell us before the certificate is issued, or ask us to revoke it afterwards.

Work you submit for review belongs to you. We look at it to write feedback and for no other purpose. We will not publish it, show it to another student, or use it in marketing unless you have given permission for that specific piece.

We set one cookie, and only after you sign in: the session cookie that keeps you signed in. There are no advertising or analytics cookies on the site itself.

If you reach us from an advertisement, the advertising platform may set its own cookies before you arrive. That is governed by their policies, not this one.

• Account and course data: while your account exists, and for 30 days after you ask us to delete it.
• Payment records: seven years, because tax law requires it. This is the one thing we cannot delete on request.
• Email list: until you unsubscribe, then removed.
• Certificates: indefinitely, unless revoked — a credential that disappears is worthless.

Email hello@signifier.academy and we will send you everything we hold about you, or delete it, within 30 days. Deletion removes your account, progress and submitted work. It does not remove payment records, for the reason above.

Access to course material and student data is enforced at the database level, not just hidden in the interface. Video is served through short-lived signed links. Certificates are signed with a private key so a forged one fails verification.

No system is perfectly secure, and we will not claim otherwise. If we ever discover a breach affecting your data, we will tell you.

This course is not intended for people under 16, and we do not knowingly collect their data. If you believe a child has given us information, write to us and we will remove it.

If this policy changes materially, we will email everyone with an account rather than quietly updating the date at the top.