Privacy policy
In short
- We know you only by an anonymous learner ID. We never receive your name, email address or photo from Google.
- We keep your answers and results so that you can see them and build on them. They are stored in the EU: on our server in Finland and, as xAPI learning records, in a learning record store in Estonia.
- We do not sell your data, use it for advertising or share it for anyone else’s purposes.
- You can see, export and delete everything we hold about you. Ask at peepkungas@gmail.com.
- This website runs no analytics and loads nothing from other servers. Its public pages set no cookies; if you sign in to see your results, one cookie keeps you signed in, and nothing else.
Who is responsible
Skilirium is run by Peep Küngas, Tallinn, Estonia, who is the controller of the personal data described here. Contact: peepkungas@gmail.com. We answer privacy questions within one month.
How we apply the MyData principles
We follow the MyData Declaration: personal data should serve the person it is about. In practice that means:
- You are in control. Your results are collected for you. We use them for anything beyond running your test only in the ways listed below, and you can object to that or withdraw your consent at any time.
- Data minimisation. Sign-in asks Google for the
openidscope only. We turn Google’s identifier into a learner ID with a keyed one-way function and do not keep the Google identifier itself. - Portability. On request you get your answers and results as a file in xAPI, the open standard for learning records, so you can take them to another service or your own learning record store.
- Transparency. This page lists every kind of data we hold, why, where and for how long.
- Open structures. The knowledge structure tests are built on (occupations, competences, knobits) is described in an open ontology, so results can be interpreted outside Skilirium.
What we collect and why
| Data | Why | Legal basis (GDPR) | Kept for |
|---|---|---|---|
| Learner ID: a pseudonym derived from your Google account identifier | To know that the same person is taking and returning to tests | Providing the service you ask for, Art. 6(1)(b) | Until you ask us to delete your data |
| Your answers, the questions you were shown, when you answered and how long each answer took | To choose the next question and work out your result | Art. 6(1)(b) | Until you ask us to delete them |
| Your learning record: the same test events (test started, each answer, test completed with your result) as xAPI statements, identified by your learner ID | To keep your results in an open format that you can take with you, and to analyse how well the tests work | Art. 6(1)(b) | Until you ask us to delete them |
| Your results: mastery status per knobit and coverage per stage | To show you what you have mastered and what to learn next, in the app you test in and on your results page at skilirium.com/app | Art. 6(1)(b) | Until you ask us to delete them |
| The name and version of the app you connect with (for example Claude), and its sign-in registration | To run the sign-in and to know which app a test ran in | Art. 6(1)(b) | As long as the app stays connected |
| Sign-in tokens (stored only as one-way hashes) | To keep you signed in | Art. 6(1)(b) | 1 hour (access) and 30 days (refresh) |
| Website session, if you sign in to see your results on this site: a random session key in a cookie (stored on our side only as a one-way hash), linked to your learner ID, and the language you chose | To keep you signed in while you look at your results | Art. 6(1)(b) | 7 days, or until you sign out |
| Web server logs: IP address, time, requested address, browser or app identifier | To keep the service secure and working | Legitimate interest in security, Art. 6(1)(f) | 14 days |
| Answers and results without your learner ID, combined with those of others | To find questions that are unclear or too easy and improve them | Legitimate interest in improving the test, Art. 6(1)(f); you can object | As long as the questions are in use |
We do not collect your name, email address, contact list, location or any special categories of data. We do not track you across sites and we do not profile you for marketing.
Cookies
The public pages of this site set no cookies. When you sign in at skilirium.com/app to see your
results, we set one cookie, __Host-skilirium. It holds a random key that keeps you signed in and
nothing else: it is sent only to skilirium.com, cannot be read by scripts, is never shared and is not used to track
you. It ends when you sign out, and after 7 days at the latest. Because the results page cannot work without it,
it is strictly necessary and needs no consent. There are no analytics, advertising or third-party cookies.
Automated assessment
Your result is calculated automatically from your answers with a statistical model (knowledge space theory). It is an estimate meant to help you learn. It has no legal effect and we do not use it to make decisions about you. If you share a result with someone else, for example an employer, it is your choice how it is used, and you can ask us to explain how it was calculated.
Where your data is and who handles it
- Hosting: our server is in a Hetzner Online GmbH data centre in Helsinki, Finland (EU). Hetzner processes the data on our behalf only.
- Google: when you sign in, Google confirms your identity under Google’s privacy policy. Google learns that you signed in to Skilirium; it does not get your answers or results.
- The app you use: you take a test inside an app such as Claude. That app shows the questions and passes on your answers, and its own privacy policy applies to what happens there. Your results page on this site shows the same results when you sign in with the same Google account.
- Learning record store: your test records are kept as xAPI statements in a Learning Locker store that we run on a server in the Tallinn University of Technology (TalTech) cloud in Estonia. TalTech provides the server; we run the store. A record contains your learner ID, the question and the choice you made, whether it was right, how long you took and your result. It never contains your name or email address.
We do not transfer your data outside the European Economic Area.
Your rights
You can ask us to:
- show you the data we hold about you (access), and give it to you as your xAPI learning record (portability);
- correct it, delete it or stop using it for a while (rectification, erasure, restriction);
- stop using your answers to improve the questions (objection);
- withdraw any consent you have given, without affecting what was done before.
Email peepkungas@gmail.com and include your learner ID, which is shown with your results on skilirium.com/app. We only know you by that ID, so it is how we find your data. We act on requests within one month.
If you think we handle your data wrongly, you can complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, www.aki.ee) or to the data protection authority where you live.
Security
All connections use HTTPS. Sign-in follows OAuth 2.1 with PKCE, tokens are stored only as hashes, and each person’s tests are visible to that person only. Access to the server is limited to the operator.
Children
Skilirium is meant for adults and students preparing for an occupation. It is not directed at children under 13.
If the service closes
If we stop running Skilirium, we will say so on this site at least 30 days in advance, offer you an export of your data, and then delete it.
Changes to this policy
When this policy changes, we update the version and date above and keep earlier versions available on request. We will not start using your data for a new purpose without asking you first.