Privacy
What XIG Learn keeps about you, why, where it is kept, for how long, and how to have it removed. Last updated 5 October 2026.
Who runs XIG Learn
XIG Learn is run by XIG Australia Pty Ltd, ABN 58 684 707 266, at learn.xig.com.au. Questions about your information go to privacy@xig.com.au.
What we keep
Your email address. It is your account, and it is how you sign in.
Your account type (free or full), when the account was made, and when you last signed in.
Your progress: the lessons you have read, your drill answers and scores, and your mock exam attempts. This is what lets you pick up on another device.
Notes you leave on the course, if your account is one that can leave them.
Each sign-in code, kept only in scrambled form, with the time it was asked for. These go after two days.
A scrambled form of your internet (IP) address with each request for a code, so the site can limit how many codes one connection asks for. The address itself is never stored, and these go after two days.
There are no passwords, so none are kept. We do not ask for your name.
Why we keep it
To sign you in, to keep your progress across devices, to stop the sign-in page being misused, and to improve the course from the notes testers leave. We do not sell your information, share it for marketing, or use advertising trackers.
Emails we send
Sign-in and account codes, when you ask for them. Nothing else. If we ever send news about the course, it will only go to people who ticked a box to ask for it, and every one will carry a working unsubscribe link.
Services that handle it for us
Cloudflare hosts the site and runs the check that a new account is made by a person. It also counts page visits without cookies. It sees your IP address and browser details.
Supabase is the database that holds your account, progress, notes and sign-in codes.
Resend sends the code emails, so it handles your email address and the email itself.
GitHub holds a private copy of the notes left on the course, for our own review. The copy carries no email addresses: each note is marked with a code that stands for the account that left it.
Google's YouTube player, in its privacy-enhanced mode, shows the videos on lesson pages. When you open a lesson's Go deeper tab, your browser fetches the player from Google, which shares your IP address with Google. The fonts come from this site, not from Google.
When paid access starts, the payment service will be named here before it does.
Where it is stored
These services run outside Australia, including in the United States, so your information is stored and handled overseas.
How long we keep it
Your account, progress and notes stay until you delete your account. Sign-in codes and the scrambled IP addresses go after two days. When a note is deleted, the GitHub copy drops it at its next nightly update; earlier versions of that copy stay in the private repository's history.
Your choices
You can delete your account at any time from the account menu: Delete my account removes your account, progress, notes and sign-in codes. To get a copy of what we keep, or to correct it, email privacy@xig.com.au. We answer within 30 days.
Cookies
One cookie, ccaf_session, keeps you signed in for 90 days. A few values in your browser remember your place and your choices, such as light or dark and your audio speed. There are no advertising or tracking cookies. The Cookies page lists every one.
Age
The course is for adults. The exam is only open to people aged 18 or over. We do not knowingly keep information about anyone younger; if you think we have, tell us and we will delete it.
Complaints
Email privacy@xig.com.au first. If we do not resolve it, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au. If you live in the European Union or the United Kingdom, you can also complain to the data protection authority where you live.
Changes to this page
The date at the top changes whenever this page does. If a change affects what we keep or who handles it, we email account holders before it takes effect.