Policies

1. Operator and scope

“AxiOstra Operator” (the “Operator”) means the service operator identified on the About us page, which forms part of this controller identification. The Operator determines the purposes and means of the processing described here and is the controller where applicable data protection law uses that term. Privacy and rights requests can be made through the contact details below; further legally required identifying information will be provided through the appropriate channel.

Privacy enquiries, rights requests and security concerns may be submitted to [email protected]. This policy covers this website and related account, forum and messaging services. Independent websites reached through external links have their own privacy practices.

2. Public access and required information

The home page, public forum and currently published visualization pages may be viewed without registration. Posting, account management and messaging require an account. Account services require an email address and information needed for the selected sign-in method; optional profile information is not a condition of registration. Public browsing still produces the technical request information described in section 5.

3. Information processed

• Account information: email address, nickname, account identifiers, registration time and authentication information. Passwords are stored as salted PBKDF2-SHA-256 hashes, rather than plaintext. Hashing reduces exposure but does not eliminate the risk of password guessing. A sequential user number (UID) is assigned to each account.
• Email verification: registration, email changes, account deletion and certain sign-ins require a six-digit code. The service stores the code hash, expiry and attempt counters. Codes are valid for 10 minutes and at most five attempts. Uncompleted registration records are eligible for automatic cleanup approximately one day after code expiry; cleanup depends on the relevant service running.
• Google sign-in, if selected: Google provides an account identifier, email address, email-verification status, name and profile-picture URL. The service stores the identifier and email address and may use the supplied name as the initial nickname. Google processes its own sign-in activity under its policies. An account password may be set after email verification.
• Optional profile information: avatar, banner and crop position, birth date and derived age, gender, region, education and verification description. These fields can be omitted or removed. Do not include information about other people without appropriate authority. Birthday and gender are optional at registration. For users under 18, an optional account setting can fold courses with a reference age at least two years below their age. New users in this age group choose whether to enable it during registration and may change that choice in Settings. Users aged 18 or over, and users without a birth date, see all courses without age-based folding. Folded courses remain accessible. Curriculum reference ages are editorial estimates. Language supplies a changeable initial curriculum suggestion and is not treated as evidence of nationality or ability. Gender is not used for recommendations.
• Account settings: preferred language, the option to hide posts in another language, discoverability through Friends search, and per-contact private-message mute and block settings. These settings are associated with the account and are available across signed-in devices.
• Private messages: encrypted message content, sender and recipient identifiers, key identifiers, sending, reading, editing and withdrawal timestamps, public encryption keys and a passphrase-encrypted private-key copy. The message passphrase is used locally by the browser. Reply references and quoted text are included within the encrypted payload. Read receipts indicate that a recipient device displayed a successfully decrypted message; they do not establish that the recipient understood it. The service currently supports text messages.
• Friends: requests, their status and the resulting connections. Sending or accepting a request produces a notification containing the account nickname and user ID.
• Reports and appeals: the relevant content or penalty identifiers, reporting account or submitted UID, selected reason, supporting information, review status and decision. A private message voluntarily supplied as evidence is processed as a report or correspondence, outside its original encrypted conversation.
• Forum information: published posts and articles, comments and reply relationships, uploaded images and files, reactions, bookmarks, reposts and cloud-saved drafts. Replies generate service notifications for the publication author and the directly addressed commenter, excluding the sender and duplicate recipients; these notices include public account details, the publication title and a link. Successful public submissions containing word-list matches are associated with matched terms, category counts, content and account identifiers, timestamps and review status for operator review. This queue does not collect private-message plaintext or a separate full copy of the public content. Tags are stored separately from the body and their public counts reflect distinct posts. Interest matching uses preset subject tags, sufficiently repeated co-tag associations, or aggregate preferences from at least 20 consenting readers for posts carrying a single novel tag. A single reader does not establish a tag classification. With personalized recommendations off, Explore uses popularity-weighted random selection, emphasizing recent view velocity alongside likes, saves, reposts and comments. It uses no individual interest profile. Latest order remains available; temporary feed-order snapshots expire after 15 minutes.
• Post views: a post identifier is temporarily associated with an account identifier, or a hash derived from a signed-out visitor’s IP address, to limit repeat counting within six hours. Authors’ own views are excluded. Only aggregate counts are public. Hashing is pseudonymisation, not a guarantee that a record is anonymous.
• Correspondence: the content, contact details and attachments included in messages sent to [email protected], together with information needed to investigate and respond.

4. Public information and message visibility

Forum posts and comments are public and may be accessed, copied or indexed by third parties. Public account information includes the nickname, avatar, user ID, UID, verification description and applicable badges. Profile pages additionally display a banner, public account identifier and published content. Public interaction totals are also displayed.

Signed-in users may search for accounts by UID or user ID through Friends. Results include public profile details and links to profile and messaging features. Disabling discoverability removes the account from that search; it does not make existing public posts or profile URLs private.

Message content is encrypted before transmission and is intended to be decrypted by the participants’ devices. The Operator still processes the message metadata listed above. Recipients may retain or disclose content, and compromised devices, malicious browser code or weak passphrases may defeat confidentiality. Mute settings suppress the conversation’s notification count without deleting messages; private-message blocking prevents further sending between the accounts while preserving existing history.

Editing replaces the stored encrypted message; withdrawal removes the active ciphertext and leaves a withdrawal record. Neither action recalls copies already displayed, captured, quoted in another message or retained in a recovery backup. Read receipts and edit indicators are visible to the conversation participants.

Email address, birth date, derived age, gender, region and education are not displayed as public profile fields. Friend lists and personal message preferences are restricted to their account owner in the interface. The Operator and relevant service providers may process stored information to operate and secure the service; a recipient may infer blocking from delivery restrictions.

5. Technical and operational information

AxiOstra does not use advertising or third-party audience-analytics scripts. Optional first-party learning activity and personalized recommendations are off until explicitly enabled. Registration offers adults with a supplied birthday a separate choice to enable them; creating an account alone does not enable collection. Registration keeps them off for users under 18 or without a supplied birthday. Account settings remain available afterwards, and existing opt-outs are preserved. When enabled, the service records active foreground reading time and visit counts for identified courses, associated with the account. Idle and background time is excluded. The recommendation profile uses only the last 30 days, with older records deleted during subsequent processing. Turning off collection stops new interest events, deletes stored personal interest records and disables personalized recommendations. A separate control clears history while leaving the chosen settings in place.

• Network and server records may include IP address, request time, requested URL, response information and browser User-Agent. Cloudflare and the hosting environment may process these records for delivery, security and troubleshooting. Server logs are subject to operational rotation; provider retention is also governed by the relevant service configuration and terms.
• Abuse prevention uses temporary counters or identifiers for authentication attempts, verification email requests, appeals, message operations, key resets, Friends searches and friend requests. Limits may reject or defer an action; users may contact the Operator to contest an apparent error.
• Device management records a random browser identifier, browser description and User-Agent, first sign-in and recent activity time. Activity updates are limited to approximately once every five minutes. Device records support sign-in verification and the device list in Settings, where recognised sessions can be renamed or signed out.
• The app records the most recent opening time, saved-course choice and manually marked completion for published courses. Signed-in records sync through the AxiOstra account and remain until account deletion. Separate field timestamps prevent delayed offline changes from overwriting newer choices. Guest records stay in this app and join an account only when the reader chooses to add them. These explicit learning records are separate from optional interest tracking. Disabling recommendations does not erase saved courses or manually marked completion. Existing website quiz-completion preferences remain local. Laboratory recordings and measurement tables stay in the page session unless exported.

6. Cookies and device storage

The cookie controls distinguish storage necessary for requested features from optional preferences. Cookie settings can be reopened from the footer. Blocking necessary storage may prevent sign-in, messaging or draft recovery.

• axiom_session: a necessary sign-in cookie valid for up to seven days. Session values are stored as hashes on the server. The cookie is HttpOnly, uses SameSite=Lax and is marked Secure in the HTTPS production environment. Signing out invalidates the relevant session. Google sign-in also uses the necessary axiom_google_oauth cookie for state and PKCE validation, with a 10-minute lifetime; it is cleared when the callback is processed.
• Language selection is represented in the URL: Chinese pages use /zh and English pages do not. A legacy axiom_locale cookie, if present, is removed by the current language routing.
• axiom_device: a necessary random browser identifier with a one-year cookie lifetime, used for account security and device management. It is not used for cross-site advertising.
• axiom-consent: local storage recording the cookie choice and consent version, so the interface can apply and remember that choice.
• axiostra-dm: IndexedDB storage for the unlocked messaging key on the device. The browser key is marked non-exportable, but scripts with access to the page can still use it for cryptographic operations. Signing out clears the locally retained key through the application’s sign-out flow.
• axiom-chunk-reload and axiom-slow-notice: session storage used, respectively, to prevent repeated reloads after an update and repeated performance notices in a 3D model. These normally end with the browser tab’s session.
• Local forum drafts: device storage used to recover unfinished writing. Publishing removes the relevant draft. Clearing browser site data removes locally held drafts and settings.
• Website preferences include theme, laboratory controls, views, recent emoji and local learning records. New preference writes require an affirmative current choice; website cookie controls can remove these preferences. The installed app keeps its own functional settings and learning queue without the website cookie notice. Keys beginning axiostra-learning-v2: separate guest and account records. Account queues are sent only to the matching signed-in account. Public course pages, programs and media are bundled for offline reading; packages contain no forum posts, account database, login tokens or server secrets. App storage is separate from browser profiles and is not imported from them.

7. Purposes and legal grounds

Processing is limited to the purposes below. Where the EU or UK GDPR applies, the stated legal ground depends on the particular processing and applicable requirements; acceptance of the Terms of Service is not a substitute for consent where consent is legally required.

• Account creation, authentication and requested account functions: performance of the Terms of Service, insofar as the processing is necessary to provide those functions.
• User-requested verification and confirmation emails: provision and security of the requested account operation; contractual necessity and, where appropriate, legitimate interests in preventing unauthorised access.
• Publication and management of submitted forum content: performance of the Terms of Service and the publication instructions given by the contributor.
• Private-message delivery, read receipts, mute/block controls, friend connections and service notifications: performance of the requested communication and account functions.
• Content moderation, reports and appeals: legitimate interests in protecting participants and enforcing proportionate community rules, and compliance with applicable legal duties where relevant.
• Security, fault diagnosis and abuse prevention: legitimate interests in maintaining a functioning service and protecting accounts, subject to users’ rights and reasonable expectations.
• Optional profile fields and optional device preferences: the user’s choice and, where required, consent. Consent can be withdrawn through profile or cookie settings without affecting the lawfulness of earlier processing.
• Responding to enquiries: the requested assistance and legitimate interests in resolving issues. Mandatory disclosure or recordkeeping: the specific legal obligation that applies. No solely automated decision with legal or similarly significant effects is intended; automated filters and rate limits may still restrict particular submissions.

8. Recipients and service providers

Personal information is not sold, rented or shared for targeted advertising. The following providers or recipient categories process information as necessary for their roles; some providers also act independently for their own security, account and legal obligations.

• Cloudflare: DNS, network delivery, transport security and related infrastructure, including forwarding email addressed to [email protected].
• RackNerd: United States server hosting for the application, database and uploaded content. Hosting providers may process technical and administrative information associated with the service.
• Resend and its delivery infrastructure: transactional emails, including verification codes, moderation outcomes and automated feedback acknowledgements. The information required for delivery is disclosed to this provider.
• Microsoft: the Operator’s Outlook mailbox and correspondence. Google processes optional Google sign-in information. GitHub Actions stores encrypted release-recovery backups for 90 days; backup decryption keys are retained separately from those artifacts.
• Competent authorities, advisers or other recipients where a lawful obligation requires disclosure, or where disclosure is necessary and proportionate to establish or defend legal claims or protect persons from harm. Any applicable procedural safeguards remain in force.
• Public content is available to website visitors. External links lead to independent services; following them may disclose request information to their operators. Their processing is governed by their own notices.

9. Locations and international processing

The application’s primary server and database are in the United States. Service administration may involve processing in Malaysia, and infrastructure, email, sign-in and backup providers may process information in other countries. These locations may have different legal protections. This policy does not constitute consent to an otherwise unlawful transfer or a claim that a particular transfer mechanism has been established. Where transfer restrictions apply, the Operator must establish the required legal basis and safeguards. Contact [email protected] for information about the arrangements applicable to your data.

10. Retention

• Account and profile records are retained while the account exists. Account deletion clears identifying profile fields from the active database but retains an internal account identifier and UID placeholder to prevent number reuse.
• Posts and articles remain until removed by their author, moderation or account deletion. Removing a post also removes its associated comments and reactions. Separately stored uploads may remain until account deletion.
• Comments remain while their parent content and author account exist. Operator removal clears the comment body and retains identifiers, author association, reply links and a removal marker so that other replies can remain in context. Individual comment removal is not self-service and can be requested by email. Public-content match metadata remains until its parent post or account is deleted, or an edit no longer contains a configured match; a reviewed or removed status alone does not erase that metadata. It is restricted to moderation review.
• Completed uploaded files and images, including unused completed uploads, may remain until the owning account is deleted. Interrupted document uploads may leave technical fragments that are not yet associated with a completed file; their cleanup is not currently guaranteed by account deletion.
• Cloud drafts are replaced by later saves for the corresponding writing type and removed on publication.
• Sign-in sessions expire after seven days or earlier invalidation. Device records remain until removal through device management or account deletion.
• Private-message ciphertext is removed from the active message on withdrawal. Message metadata and withdrawal records remain until either participant deletes their account. An account’s key history remains until that account is deleted. Conversation preferences remain until changed or account deletion. Resetting a key does not automatically delete old message records or the other participant’s ability to read retained messages.
• System notifications ordinarily remain until account deletion. A manually dispatched console notice may be recalled by the Operator; recall removes all recipient and language copies from the active notification store. An already displayed or independently saved copy cannot be made unread or remotely erased. The console retains the batch identifier, dispatch and recall times and original recipient count, without retaining the recalled notice body in that dispatch record. Backups may retain earlier copies for their stated retention period.
• Friendships and requests remain until the relevant supported removal, cancellation or account deletion. Ignored requests are retained to enforce the one-month repeat-request limit.
• Reports, penalties and appeals are retained for moderation and review. Account deletion removes reports submitted by that account and its penalty/appeal records. Reports submitted by other users may remain after the reported account or post is removed, including relevant identifiers and the reporter’s description; their continued necessity should be reviewed.
• Verification codes expire after 10 minutes. Pending registrations become eligible for cleanup approximately one day after expiry; temporary anti-abuse and view-count records are cleared when their relevant expiry and cleanup conditions are reached.
• Technical logs are retained according to operational rotation and provider settings, taking account of troubleshooting, security incidents and legal requirements. No single verified maximum is promised for all providers.
• Correspondence is retained for the time needed to resolve the request, reasonable follow-up and any applicable legal obligation or dispute. Relevant records should be reviewed and removed when these purposes end.
• Automated release-recovery backups are encrypted and retained off-server in private GitHub Actions artifacts for 90 days. They may contain information deleted from the active service after the backup was made. Exceptional recovery copies may remain while an incident is unresolved; backup access is restricted and such copies are not part of ordinary website use.

11. Account deletion and its limits

Account deletion is available from the profile page and requires an emailed verification code. It removes the account’s active profile content, posts, comments, completed uploads, drafts, sessions, device records, messages and keys, notifications, public-content match records, friendships and reports submitted by the account and its penalty/appeal records through the deletion process. A conversation is shared by its two participants, so deleting either account removes its active message history for both. An internal identifier and UID placeholder remain. Deletion does not instantly erase incomplete upload fragments, recovery backups, independent correspondence or reports, legally required records or copies retained by other people.

Local browser data may remain on other devices or outside the current sign-out/deletion flow. Clear this website’s data on each relevant device to remove local drafts, preferences and stored keys. Recipients’ independent copies and encrypted quotations within other messages cannot be remotely recalled.

12. Security and encryption limitations

Security measures include HTTPS, hashed authentication secrets, access controls and encrypted off-server recovery backups. These measures reduce risk without guaranteeing absolute security. The Operator will assess incidents and provide notices to affected individuals or authorities where applicable law requires them.

Private messages use browser-side AES-GCM encryption with conversation keys derived using ECDH P-256 and HKDF. Private-key backups are encrypted using a passphrase-derived key. Protection depends on the integrity of the served application, devices, accounts and passphrases; it does not conceal message metadata. Participants may compare the conversation safety code through a separate trusted channel. The Operator cannot recover the messaging passphrase; a reset does not restore access to messages encrypted for a lost key.

13. Rights, choices and complaints

Account and profile information can be reviewed and corrected in the account interface. Subject to applicable law and its exceptions, individuals may request access, copies, correction, erasure, restriction or portability, or withdraw consent. Where processing relies on legitimate interests, individuals may object on grounds relating to their situation. Send requests to [email protected]; proportionate identity checks may be needed. Requests will be handled within the applicable statutory period, with reasons provided where a request cannot be fulfilled. Withdrawal does not invalidate earlier lawful processing.

You may complain to a competent data protection authority where applicable, including Malaysia’s Personal Data Protection Commissioner, the UK Information Commissioner’s Office or the relevant EEA authority. Contacting the Operator first is optional and does not restrict a statutory right to complain or seek judicial relief.

14. Children and parental authorisation

Accounts are intended for users aged 13 or over. A user who cannot independently accept the agreement or authorise the relevant processing under applicable law must obtain legally valid parental or guardian involvement before registering; the required age and procedure vary by jurisdiction. A registration declaration is not independently verified parental consent, and the site does not provide an automated verified-consent process. Parents may contact [email protected] before registration or to report a child’s account. If an account is identified as ineligible, the Operator will investigate and restrict or remove it as required. The profile interface rejects birth dates indicating an age under 13; this is not comprehensive age verification.

15. Policy changes

The revision date identifies the current policy. Material changes to processing will be explained through an appropriate website or account notice before they take effect where required. A change requiring fresh consent will not rely solely on continued use or acceptance of revised terms. Earlier notices and applicable statutory rights are not displaced retroactively.