Minimal profile
Required records are an internal learner ID, tenant or installation, lifecycle state, and timestamps. Display name and accessibility preferences are optional.
Learner data
Your learning data, without fine print.
Project 42 is building cross-device learning records deliberately. This page separates what is available now from the account protections that must pass before hosted records turn on.
Available today
Private to this browser
Project 42 currently keeps learner progress in this browser. Account-backed cross-device records are not enabled yet.
You can download a portable JSON backup or CSV transcript and erase the local record from My progress.
- Account-backed records
- Not enabled
- Policy version
- 2026-07-25
- Current hosted collection
- None
Identity
An email address is never your account key.
Future accounts use OpenID Connect Authorization Code with PKCE. Project 42 binds the provider's stable issuer and subject to an internal learner ID. Changing an email cannot create or merge accounts.
Tenant boundaries
Every command and query must name its tenant or installation and is denied by default outside that boundary.
Portable storage
The hosted profile uses Sites-managed D1. The supported self-host reference uses PostgreSQL under the same contract tests.
Account lifecycle
Only explicit transitions are allowed.
Deleted is terminal. Recovery cannot use an email address to replace, merge, or guess an identity.
- CreatedMay move to Active, Deletion Requested
- ActiveMay move to Suspended, Recovery Pending, Deletion Requested
- SuspendedMay move to Active, Recovery Pending, Deletion Requested
- Recovery PendingMay move to Active, Suspended, Deletion Requested
- Deletion RequestedMay move to Active, Deleted
- DeletedTerminal state
Consent and choice
One purpose, one visible decision.
Every decision records its purpose, policy version, choice, and time. Optional uses cannot be bundled into the learning service.
| Purpose | Required | What it does | If withdrawn |
|---|---|---|---|
| Learning Record | Yes | Store profile, enrollment, progress, attempts, scores, badges, and transcript records. | Starts account deletion because the service cannot operate without it. |
| Product Improvement | No | Use minimized, non-transcript events to improve the learning experience. | Stops future optional product-improvement events. |
| Learning Reminders | No | Send learner-requested progress and review reminders. | Stops future reminders without deleting the learning record. |
Retention and recovery
Records have an end date.
Active learning records remain while the account is active. Inactive account records expire after two years; diagnostics after 30 days; audit detail after one year; and deletion receipts after 90 days.
Deletion cancellation
A confirmed request can be cancelled inside this window.
Active-store deletion
Adapters must return verified receipts before the account is deleted.
Backup expiry
Every restore replays the deletion ledger before serving records.
Recovery objective
Initial recovery point and recovery time targets, tested every 90 days.
Export and deletion
Your record must remain movable and erasable.
Export
- Portable Project 42 JSON and transcript CSV
- Authentication within the previous 15 minutes
- A single authenticated download, never a public object URL
- An audit event without retaining the exported payload
Deletion
- Explain scope and offer export.
- Require recent authentication and explicit confirmation.
- Issue a receipt and allow cancellation.
- Verify active-store deletion.
- Expire backups and replay deletion after every restore.
Authorization
Visibility is not permission.
Hiding a button is never enough. Every server operation checks the actor, tenant, role, and requested record.
Learner
Only the authenticated learner's own record in the current tenant.
6 explicit permissionsSupport
Read-only minimized summary for an active support case in the assigned tenant.
1 explicit permissionsContent Editor
Curriculum content only; no learner-data access.
1 explicit permissionsAdministrator
Explicit privileged role, current tenant only, with immutable audit events.
5 explicit permissionsSystem
Named service operation in one tenant with auditable execution context.
2 explicit permissionsOpen contract
Inspect the exact policy applications must follow.
The machine-readable endpoint is generated from the same validated platform contract as this page.