Privacy Policy
Last updated: September 12, 2026
Who Operates This Site
Mapleham Study (mapleham.ca) is a non-commercial hobby project operated by VY2EK, a licensed amateur radio operator in Prince Edward Island, Canada. This site provides free educational content for the Canadian Amateur Radio Basic Certification.
What Personal Information We Collect
Google Analytics
We use Google Analytics, a web analytics service provided by Google LLC (United States). Google Analytics uses cookies and similar technologies to collect information about how visitors use the site, including:
- IP address (anonymized where possible)
- Browser type and version
- Device type and operating system
- Pages visited and time spent on each page
- Referral source (how you arrived at the site)
- General geographic location (city/country level)
This data is used to understand site traffic patterns, improve content, and diagnose technical issues. Google may transfer this data to servers in the United States and other jurisdictions. For more information, see Google's Privacy Policy.
Cloudflare Turnstile
We use Cloudflare Turnstile, a privacy-focused bot detection service provided by Cloudflare Inc. (United States). Turnstile collects minimal signals to distinguish human visitors from automated bots, including:
- IP address
- TLS fingerprint
- Browser user-agent header
- Sitekey and associated origin
Cloudflare states it cannot directly identify any individual from these signals. Turnstile cookies are classified as strictly necessary. For more information, see Cloudflare's Turnstile Privacy Addendum.
Feedback Form
When you submit feedback through the site's feedback form, we collect:
- Your name (optional: you may provide a callsign or pseudonym)
- Your email address (optional: used only to respond to your feedback)
- The content of your message
This information is stored in the site's database and used solely to review and respond to your feedback. It is not shared with any third party.
Mapleham Study Account (optional)
You do not need an account to use this site. If you create one, it exists only to save your own study and practice-exam progress, and we store the minimum needed for that:
- Your email address: it is your sign-in identifier and the address we send account emails to. It is stored in lower case. No display name, avatar, phone number or any other profile field is collected.
- A password hash: your password is hashed with bcrypt before it is stored. We never store the password itself and cannot read it.
- Progress data: which slides you marked Studied or Review, the slide you were last on (so "continue where you left off" works), per-question counters from practice exams (times seen, correct, incorrect, and the latest result), and a row for each completed practice attempt with its date, score, duration and mode.
- Session and token hashes: random session and remember-me tokens, and email verification or password reset tokens, are stored only as SHA-256 hashes and expire (24 hours for a session, 30 days for remember-me, 24 hours for a verification link, 1 hour for a password reset link).
We do not sell, rent, share or use account data for advertising, and we do not build a profile of you beyond the progress you can see on your own account page.
Account Emails
Accounts receive only two kinds of email, both transactional and both sent from noreply@mapleham.ca:
- An email verification link when you register (or request a new one).
- A password reset link when you use "Forgot your password".
There is no newsletter, no marketing and no other email. The links are one-time use, expire as described above, and are the only way an email address is used.
Donations (Buy Me a Coffee)
This site includes a voluntary donation link to Buy Me a Coffee. If you choose to make a donation, your payment information (credit card details, billing address) is processed entirely by Buy Me a Coffee and Stripe. We do not collect, store, or have access to your payment information. See Buy Me a Coffee's Privacy Policy for details on how your payment data is handled.
Cookies
This site uses the following cookies:
- Google Analytics: used to analyze usage pattern to improve site experience. Only set if you accept optional cookies via the cookie banner.
- Cookie consent: stores your cookie preference (accept/reject).
- Bunny Shield: strictly necessary for abuse mitigation, bot detection, and CDN security.
- Cloudflare Turnstile: strictly necessary for bot detection and abuse prevention.
- Account session: strictly necessary when you sign in. A session cookie keeps you signed in for 24 hours, and a separate remember-me cookie keeps you signed in for 30 days if you tick that box. Both are HTTP-only (not readable by scripts) and are removed when you sign out or delete your account.
On your first visit, a banner asks whether you accept analytics cookies. If you click Reject, Google Analytics is never loaded. You may also control cookies through your browser settings. Disabling cookies will not affect your ability to use the site's educational content; you will simply need to sign in again on each visit.
How We Use Your Information
We use collected information only for the following purposes:
- To understand and improve site content and user experience (Google Analytics)
- To protect the site from automated abuse and spam (Cloudflare Turnstile, Bunny Shield)
- To review and respond to feedback submitted through the feedback form
We do not sell, rent, or trade personal information to third parties. We do not use personal information for advertising or marketing purposes beyond the Google Analytics data described above.
Guests Are Not Tracked
Every chapter, slide, question and practice exam is open to guests, and guests are not tracked by the account system at all. If you are not signed in:
- No study or exam progress is recorded, and no progress data is written for you.
- No progress or account interface is shown: the slide status controls, readiness bars and "your progress" card exist only for signed-in accounts.
- No account cookie is set. The only cookies in play are the ones listed above (analytics only if you accepted them, plus strictly necessary security and consent cookies).
Your Account Data and Controls
Everything stored for your account is visible and controllable from your account page (/account) while you are signed in:
- Change password: requires your current password and signs you out of your other devices.
- Reset study progress: clears your slide statuses and your "continue where you left off" pointer. Your exam history is kept.
- Reset exam progress: clears your per-question counters, your review queue and your attempt history. Your study progress is kept.
- Delete account: requires your account password and immediately, permanently deletes your account and every row stored for it (email, password hash, progress, sessions and tokens). It cannot be undone and no copy is kept.
- Sign out: ends the session on that browser immediately.
Because the account stores nothing but the data listed in this policy, deleting the account is also the complete deletion of your personal data. If you cannot sign in and want your account removed, use the feedback feature in the footer.
Third-Party Data Processors
We use the following third-party services that may process your personal information:
| Service | Provider | Jurisdiction | Purpose |
|---|---|---|---|
| Google Analytics | Google LLC | US | Traffic analysis |
| Bunny Shield | BunnyCDN | NL | Abuse protection |
| Cloudflare Turnstile | Cloudflare Inc. | US | Bot detection |
| Buy Me a Coffee | Buy Me a Coffee Inc. | US | Donation processing |
Account data is not shared with any third party: account emails are sent directly from this site's own server, and progress data stays in this site's database.
Data Retention
Google Analytics data is retained for 14 months. Feedback form submissions are retained indefinitely or until manually deleted. Cloudflare Turnstile signals are retained as necessary for bot detection and improvement of the service. Account data (email, password hash, progress rows and session/token hashes) is retained until you delete your account or reset the relevant progress, and is removed immediately when you do. Expired session and token rows are purged automatically. You may request deletion of your feedback data at any time using the contact information below.
Contact
For privacy-related inquiries, you can reach the site operator via the feedback feature in the footer of this site.
Changes to This Policy
We may update this privacy policy from time to time. Changes will be posted on this page with an updated "Last updated" date. Continued use of the site after changes constitutes acceptance of the updated policy.
