Privacy Policy

Last updated: October 27, 2026

Cedarras is an online course platform operated by Atchison Technology LLC (“we”, “us”). Course creators use Cedarras to publish courses; their students use Cedarras to take those courses. This policy explains what we collect, who can see it, and what we do with it.

There are three parties in Cedarras, and it matters which one is looking at your data:

• Cedarras — us. We run the platform and host the data.
• The course owner — the creator whose course you are taking. They control their own account and their own students.
• You — the student or the course owner, depending on which side of the product you are on.

Who is responsible for what

Cedarras holds two kinds of data, and the responsibility for each is different.

Learning records are handled for your course owner. Your enrollment, your progress, your quiz answers and scores, which lessons you opened, and the enrollment emails sent to you all exist because a course owner chose to teach you on Cedarras. We keep and use them on the course owner’s behalf and on their instructions, to run their course — in legal terms, we are their processor and they are the controller. Questions about why a course owner has your data, or what they do with it, are theirs to answer; we will help them answer them.

Account, sign-in and security data is ours. Your Cedarras account itself, your sign-in records, the records we keep to protect the service, error reports, email delivery records, and a course owner’s billing details are Cedarras’s own responsibility, and this policy governs them directly.

What we collect

Your account. Your email address, and your name if you or your course owner provided one. Whether you have set a password yet. If you set a password, we store a one-way hash of it — never the password itself. If you are a course owner, we also keep your connected Kit.com account’s name and email addresses, the access credentials Kit.com gives us to act on that account (stored encrypted; you can end the connection from Cedarras or from Kit.com at any time), and the student support email address you choose to publish, if any — we show it to your students on your course pages and in student help. When you sign up through Kit.com, we suggest the email address from your Kit.com account for your Cedarras login; you can change it before we create your login.

Team invitations. If a course owner invites you to join their team, we store your email address and the role offered before you accept. If you never accept, the invitation expires after seven days and we do not email you about it again.

Your enrollment. Which courses you are a student of, when your enrollment started and ended, and whether it is currently active. Enrollment in Cedarras is driven by tags in your course owner’s Kit.com account: when your course owner tags you for a course, you become a student of it; when they remove the tag, your enrollment ends. If your course owner allows it, you can also sign up for a Cedarras account from their site. When you set your password, we add your email address to their Kit.com audience. Signing up does not by itself put you in a course — your course owner’s tag does. If your course owner locks a lesson until you have a certain tag, we also keep which of those tags you currently have, so we know what to show you.

Your progress. Which lessons you have marked complete and when. Which lessons you have opened, when you first and last opened each one, and how many times. When you started a course and when you finished it.

Your quizzes. For each quiz you take: the questions you were shown, the answers you chose, and your score. If a course is graded, your overall grade for it.

Email we send you. We email you when you are enrolled in a course, and when you ask for a link to set or reset your password. We keep a record of when each enrollment email went out, for as long as the enrollment record exists. If mail to your address bounces or is reported as spam, we record that, along with the reason the receiving mail server gave, and we stop sending to it. We send no marketing email. If you are a course owner, we will also email you about material changes to this policy or our Terms of Service.

Your sign-ins and account activity. When you sign in and out, whether a sign-in attempt failed, the IP address and browser user-agent of the request, and when your session expired or was ended. We also record changes to your account, such as a password change or reset, and, for course owners, connecting or disconnecting Kit.com, Vimeo or an AI assistant, and choosing to protect a Vimeo video. We keep these records for one year.

Course content you are given. Files, videos and text your course owner publishes. Cedarras does not ask you to upload anything.

Technical records. Ordinary server logs, and error reports when something in the application breaks. An error report may include your user id and email address, so we know who was affected and can contact you.

Payment, if you pay us. Students never pay Cedarras — what you paid your course owner, if anything, is between you and them. Course owners on a paid plan pay us through Stripe, our payment processor (an Agency plan can instead be paid by an invoice we send ourselves). You enter your card on Stripe’s own pages; we never see or store your card number. What we keep is an identifier for your Stripe customer and subscription, whether that subscription is currently paid, and the date it next renews. Stripe also receives your billing address and, if you are outside the United States, your business tax ID, which it uses to work out tax. Your card receipts and invoices come from Stripe and live in Stripe. An invoice we send you directly (Agency plans) comes from us.

We do not run advertising, we do not sell anything about you, and we do not use your data to train AI models.

Cookies

Cedarras sets two cookies: one that keeps you signed in, and one that holds short-lived state the site needs to work, such as protecting forms against cross-site request forgery and remembering where to send you after you sign in. Both are necessary to sign you in. Cedarras itself sets no advertising or tracking cookies. A lesson that includes an embedded video is a separate matter, described next.

Embedded videos. A course owner can add a video to a lesson by linking to YouTube, Vimeo, Descript or Mux. On a lesson with such a video, your browser contacts that provider directly to load and play it, so the provider receives your IP address and browser details and may set its own cookies, under its own privacy policy. Cedarras uses YouTube’s privacy-enhanced mode for YouTube videos, but we do not control what any of these providers do. If you would rather not load them, do not play the video or open the lesson. Links to other websites in lessons and resources work the same way.

Your course owner may enable their own page analytics on their student pages (see “What your course owner can see”). Those measure page views only, and the data goes to the course owner, not to us.

Our own website, cedarras.com, measures page views with Fathom Analytics, which sets no cookies and honors your browser’s Do Not Track setting.

If you sign up for email from us on cedarras.com, such as our waitlist, you sign up through a form provided by Kit.com, and your email address goes to our own Kit.com account. We use it to tell you when Cedarras opens, and for other product and marketing email about Cedarras. You can unsubscribe from any email we send. Kit.com’s own privacy policy explains what its form collects and how Kit handles it.

What you can see

Signed in, you can see and change your own name and password, see every course you are a student of across every creator using Cedarras, and see your own progress through each one. You can undo a lesson you marked complete.

You cannot see other students. Cedarras has no student directory, no comments, no discussion, and no way for one student to see another’s progress or existence.

What your course owner can see

Your course owner runs the account that publishes the course. In Cedarras itself, they can see:

• You, in their student list. Your name and email address, whether you have set a password yet, whether email to you is bouncing or was reported as spam (and the reason given), and when they last sent you an enrollment email.
• Your enrollment in each of their courses. Whether it is active or ended, when you started, and when you finished.
• Counts, not names, for everything else. How many of their students have enrolled, started, completed or gone quiet; how many reached each lesson; where students most often stop; how students did on each quiz, on average. Quiz averages and per-question results appear only once at least 5 students have taken a quiz, so they never reveal how one student answered. Cedarras does not show a course owner which lessons you opened, which you marked complete, or your quiz answers and scores.
• Nothing about your other courses, from any other creator. Your activity in one creator’s course is invisible to every other creator.

Three things are worth being direct about, because they are not obvious:

Your email address is already theirs. You are their Kit.com subscriber — that is how you got into the course. Your email address, your name, and the tags on you live in their Kit.com account, which they control and which is outside Cedarras. This policy cannot govern what they do there; their own privacy policy does.

Your progress can be sent to their Kit.com account. If your course owner sets it up, Cedarras adds tags to your Kit.com subscriber record when you start a course, finish a lesson, finish a section, or finish a course. It can also write your percent complete and your grade into fields on that record. Once it is in Kit.com, your course owner can see it there, per student, and it is governed by their policy, not ours.

They may run their own analytics. A course owner can connect their own Fathom Analytics site to their student pages. When they do, page views on those pages are measured by Fathom and reported to the course owner’s own Fathom account, under their own terms and privacy policy. Cedarras never sees that data.

What we can see

Our platform administrators can see everything stored in Cedarras. That is the honest answer, and it is what running the servers means. In practice we look at it to keep the service working, to investigate a problem, and to respond when a course owner or student asks us for help. We do not read it for any other purpose, and we do not share it with other creators or sell it to anyone.

Our platform administrator may use an AI assistant, Claude from Anthropic, to look at the platform’s administrative information, such as accounts, users (including email addresses), sign-in activity and system status. The assistant can only read that information; it cannot change anything. It is set up so that Anthropic does not use this data to train its models. It sees only per-course counts of students, never an individual student’s enrollment, progress or quiz answers.

An authorized platform administrator can also sign in to Cedarras as you, to see exactly what you see and act as you would. We do this to assist you or another customer, to solve a technical problem in the system, or for other similar purposes. Only authorized individuals may do so, and every time it starts and ends is logged, along with who did it.

How we protect your data

• Everything is sent over an encrypted connection (HTTPS). Our database and file storage are encrypted at rest.
• Passwords are stored only as a one-way hash. The Kit.com credentials we hold for a course owner are stored encrypted.
• Access to production systems is limited to the people who run Cedarras.
• A course owner sees only their own account, courses and students. Cedarras keeps every account’s data separate in the application.

No system is perfectly secure, and we cannot promise there will never be a breach. If we learn that personal data we hold has been accessed without authorization, we will investigate promptly, and where the law requires it we will tell the people affected and the relevant authorities. Where we hold student data for a course owner, we will tell the course owner without undue delay so they can meet their own obligations.

Who else your data touches

• Amazon Web Services — hosting, databases, file storage, and sending email, in the United States (Oregon).
• Kit.com — your course owner’s audience platform, and the source of your enrollment. Cedarras reads your subscriber record and tags from the Kit.com account your course owner has connected. It also writes to that account: it adds you as a subscriber if you sign up yourself, and, if your course owner has set it up, it adds progress tags and your percent complete and grade. We also use our own Kit.com account for the cedarras.com waitlist and our other product and marketing email.
• Vimeo — only if a course owner connects their own paid Vimeo account. Cedarras then reads the owner’s list of videos (titles, lengths and thumbnails) so they can pick one for a lesson, and, for each video the owner chooses to protect, changes that video’s privacy settings on Vimeo so it is hidden there and plays only inside their course. The owner can disconnect at any time, which deletes the access token we hold; the settings already on Vimeo stay as they are. Cedarras sends Vimeo no student data.
• Anthropic — the AI assistant our administrator uses to read platform administrative information, described above. Separately, if your course owner connects their own AI assistant, that is their choice and covered by that assistant’s provider’s terms.
• Honeybadger — error monitoring. Receives an error report when the application breaks, which may include your user id and email address.
• Fathom Analytics — on our own website, cedarras.com, for page views. And, only if your course owner has enabled it, on their own student pages, reporting to their Fathom account.
• YouTube, Vimeo, Descript and Mux — video hosting, only if a course owner has put a video from one of them in a lesson. Your browser talks to them directly when you open that lesson (see “Embedded videos” above); Cedarras does not send them your account data.
• Stripe — payment processing, and only for a course owner on a paid plan. Stripe receives their email address, their card details, their billing address and, outside the United States, their business tax ID directly; we receive back only the identifiers and the paid/unpaid status described above. Students’ data is never sent to Stripe.

If your course owner has connected an AI assistant to their account, that assistant can read and write their course content, and read course-wide quiz averages (under the same rule). It cannot read any individual student’s records, enrollment, progress or quiz answers.

How long we keep things

• Your account and enrollment — for as long as the account exists. An ended enrollment is kept so your progress is not lost if your course owner re-tags you. If a course owner deletes a course or closes their account, the enrollments and progress in those courses are deleted, but your own login stays, because you may be a student in other courses. It is removed when you ask us to delete it.
• Completion certificates — when you finish a course that offers one, we keep a certificate with your name, the course name, the creator's name and icon, and the date. It is yours: we keep it even if the course owner later deletes the course or closes their account, and delete it only when you ask us to delete your data. It is private to you unless you choose to make it public, which creates a link anyone who has it can open; you can turn the link off at any time and it stops working.
• Sign-in records and account activity — one year.
• Password links — a link to set a password works for 7 days; a password-reset link, for 1 hour. Each works once.
• Updates sent to Kit.com — the record of each one is kept for 30 days after it is delivered.
• Notifications from Kit.com — when Kit.com tells us a tag was added to or removed from you, we keep the notification for 30 days.
• Server logs — regularly deleted or overwritten, so old entries disappear on their own.
• Backups — we keep database backups for 7 days. Data you or we delete can remain in a backup until it expires, and is not restored except to recover from a failure.
• Error reports — kept in Honeybadger for as long as our Honeybadger plan retains them, and deleted sooner when we no longer need them to fix a problem.
• Billing records — if you are a course owner who pays us, the Stripe identifiers on your account are kept for as long as the account exists. Your Stripe invoices are kept by Stripe under their own retention rules, not ours.
• Sessions — signed out after 30 days idle, and after 90 days regardless.
• Course content and files — until the course owner deletes them. Deleting a course deletes its files and its student records, but not the certificates students earned in it.

Your choices

You can change your name and password yourself, at any time, from your profile page. If you have not set a password, or have forgotten it, you can get a link to set one from the sign-in page.

To ask what we hold about you, to correct it, to have it deleted, or to get a copy of it, email us at support@cedarras.com. We first confirm the request comes from you — normally by replying to the email address on your account — and then respond within 30 days. For learning records we hold for a course owner, we may pass your request to them or act on their instructions, and we will tell you if we do.

Deleting your account removes your Cedarras record; it does not remove you from your course owner’s Kit.com audience, or remove progress tags and fields already sent there — for that, unsubscribe from their emails or ask them directly.

If you want out of a course, the fastest route is your course owner: enrollment is their tag, and removing it ends your enrollment.

If you are in the European Union or the United Kingdom

If the GDPR or the UK GDPR applies to you, a few more things are true.

Why we use your data. For learning records, the legal basis is your course owner’s, since we handle them on their behalf. For our own data, we rely on: contract, to give you the account and service you signed up for or were enrolled in; legitimate interests, to keep sign-in records, protect the service from abuse, and find and fix errors; and legal obligation, for billing records we have to keep.

Your rights. You can ask us for access to your data, a correction, deletion, a restriction on how we use it, or a copy in a portable, machine-readable form, and you can object to uses based on our legitimate interests. You also have the right to complain to your data protection authority. Use the address in “Your choices” above.

Where your data is. Cedarras stores and processes data in the United States (Oregon). Moving your data there is necessary to provide the service.

Course owners. If you are a course owner and need a data processing agreement for the student data we handle on your behalf, email support@cedarras.com and we will send you our standard one.

Children

Cedarras is not intended for children under 13, and we do not knowingly collect information from them. Students aged 13 to 17 may use Cedarras only with a parent’s or guardian’s consent.

Legal requests

We disclose personal data to a court, police or other authority only when the law requires it, and only what is required. Where the law allows, we make reasonable attempts to tell the affected person or course owner.

If Cedarras is sold or merged

If Cedarras is sold, merged or transferred, the data we hold goes to the new owner, who must handle it under this policy or one at least as protective. We will tell course owners if that happens.

Changes

We may update this policy. The date at the top always says when it last changed. For a material change, we will email course owners at least 30 days before it takes effect.

Contact

Atchison Technology LLC — a Washington limited liability company
1037 NE 65th St #81899, Seattle, WA 98115
support@cedarras.com