Account identifiers
Name or preferred name, email, unique private username, daily goal, and terms version accepted at account creation. We store a salted one-way password verifier—not the password you typed.
Open learner accounts
Ages 14+, with no upper age limit.
Practical learning can help at 14, 24, 28, 35, or later. Signup asks only for an age range, not a date of birth. Learners aged 14–17 confirm parent or guardian permission. Public access is separate from eligibility for a funded cohort.
Your learning record
is not the product.
This policy describes what The Life Starter stores, why it is used, who helps us run the service, and the choices available to you.
Privacy questions and requests: thelifestarter@gmail.com
Our privacy promise
Collect what the experience needs. Keep private data private. Never sell learner data.
Accounts exist to open the free program and save progress, checks, projects, and optional follow-ups. We do not operate a public learner directory, public leaderboard, or targeted advertising system. A partner or sponsor does not receive a learner's email, password record, private work, or individual activity simply because it supports the program.
What the system stores.
We try to collect only the information needed for account access, learning continuity, safety, and a response you asked us to provide.
Learning record
Completed lessons, quiz attempts, last-opened lesson, course progress, points, streaks, badges, daily check-ins and their selected goal/timezone, and optional program projects so your work can continue across devices. If you save a Course Library project in My Proof, we also store your description, optional work link, practice method, checklist, self-review status, curriculum version, and timestamps.
Program record
Starting and final checks, pathway choices, weekly projects, rubric responses, program events, supplemental workforce exercise drafts/completions, and optional follow-ups used to operate the self-paced program. These records are tied to your account and are not a public profile.
Website builder projects
Website drafts, revisions, up to 20 saved checkpoints per website, Trash records, and uploaded photos are tied to your existing LifeStarter account. Uploaded image bytes are stored privately in Cloudflare object storage; the database stores their owner, size, type and time.
Contact requests
A contact name, email, organization, selected opportunity, and optional note when someone sends a partnership or privacy request. We use it to respond; it is not displayed publicly.
Where it comes from.
Most information comes directly from you when you create an account, complete a lesson or check, save a project, update your profile, or submit a request. The service also creates operational records such as timestamps, session-token hashes, completion status, and security events. Our hosting provider may process request metadata such as an IP address or user-agent in infrastructure logs for reliability and abuse prevention; the application does not use those logs for advertising.
Purpose limits.
We use information to authenticate you, save and restore your work, calculate private progress, provide account support, prevent abuse, troubleshoot errors, improve lesson clarity, meet legal obligations, and answer a request you made. We may use aggregate or de-identified activity to understand whether the product is functioning. We do not sell personal information or share it for cross-context behavioral advertising.
Who helps operate it.
Our hosting and database provider, Cloudflare, processes the application and account records on our behalf. No transactional email provider is currently connected. Verification and password-reset emails are unavailable. YouTube and other linked sites process activity under their own policies when you open or play their resources. Staff or contractors receive only the minimum learner information needed for an authorized support role.
Access, correct, or delete.
Depending on where you live and which law applies, you may have rights to access, correct, delete, or receive a copy of personal information, object to certain uses, or appeal a response. We do not claim every privacy law applies to every person; we honor rights that apply to the service. Use the privacy-request form or email us. We may ask for reasonable proof of account control before acting.
06 · Visibility
Learner identities are not published.
The Life Starter does not publish learner profiles, usernames, emails, points, badges, progress checks, projects, or individual activity. Your username is a private sign-in identifier and must be unique.
Authorized support staff may receive a minimum-necessary learner view only when a real role is assigned. Ordinary accounts cannot grant themselves staff access.
07 · Passwords and sessions
Designed for practical protection.
New and reset passwords are normalized and hashed with scrypt (N=16,384, r=8, p=5), using a unique 128-bit random salt. Existing PBKDF2-HMAC-SHA-256 records retain their stored work factor (up to 100,000 iterations) until a successful sign-in upgrades them to scrypt. Your password stays the same, and learning records are preserved. Only the verifier, salt, algorithm version, and work parameters are stored. Session cookies are HTTP-only, same-site, secure over HTTPS, and expire after 30 days; the database stores only a SHA-256 hash of each session token.
Repeated failed sign-ins are temporarily throttled. No security measure is perfect, so do not send passwords, payment-card numbers, government IDs, or other unnecessary sensitive information in a lesson or request.
Transactional account email
Verification and recovery messages are separate from marketing.
Verification and password-reset emails are currently unavailable. You can create an account, sign in, and save progress. Keep your password in a trusted password manager. For account help, contact thelifestarter@gmail.com. We never send your password. Marketing messages are not required to use the service and are not sent by default.
Simple website activity counts
We count homepage views, program-start clicks, signup-page views, organization-inquiry clicks, and selected dashboard actions as daily totals. Dashboard actions include continue, check-in, ProofPath, project, library, and follow-up activity. These counts do not store account IDs, emails, IP addresses, form contents, or device identifiers, and no analytics cookie is set. The tracker respects browser Do Not Track and Global Privacy Control signals. These are activity counts, not verified unique learners or outcomes.
Lesson problem reports
A report stores the lesson ID, content version, category, message, time, and resolution status. It does not automatically include your account, project, or calculator contents. A daily-changing hash of the connection address limits spam; old connection keys are cleared when a later report arrives after the hourly limit window. Reports remain available to authorized administrators for correction and reliability work. Please keep private details out of the message.
ProofPath starting plans
Making a starting plan runs in this page without an account. Choosing Save while signed out keeps your goal, optional focus, starting point, and time in this browser tab for up to 30 minutes during sign-in. These choices are not put in the URL. After sign-in, you review the plan and choose Save to store it privately in your account. A saved plan remains until you delete it in ProofPath or your account is deleted. You can download your plan; deleting it does not remove downloaded copies. Starting plans do not change lesson completion or assessment records.
Sample worksheet drafts
Answers are temporary by default and reset when you reload or leave this page. Choosing ‘Keep a draft on this device’ saves them in this browser, not your account. A draft can be restored for 30 days after its last save; editing it while saving is on restarts that window. The stored copy remains until you delete it, turn saving off, clear this site’s browser data, or replace it. Anyone using this browser may be able to read a stored draft. ‘Delete this draft’ stops device saving but leaves your current on-page answers until you leave or reload.
Youth and organizational data
The optional example selector uses school/first-job or work/independent-living scenarios without asking for a birth date or saving an age. Supplemental exercises should use sample information and must not contain eligibility documents, diagnoses, account numbers, or other people’s private details. Planned WIOA classification, referral, placement, mentor, and extended follow-up workflows are not active data collection. A future organizational implementation needs defined access, consent, and retention rules before collecting those records.
Keep what helps your account work.
Account and learning records remain available while the account is active so progress can be restored. If you choose Save on a calculator while signed out, that scenario is temporarily kept in this browser tab for up to 30 minutes to restore it after sign-in. It is not placed in the URL or saved to your account until you confirm Save. One-time verification and reset records expire and are invalidated after use. We may retain limited operational or request records as needed for security, reliability, dispute handling, fraud prevention, and lawful obligations. When a verified deletion request is completed, we delete or de-identify account-linked records unless a law or legitimate security need requires a limited exception.
- 1Request
Send an access, correction, or deletion request through the form or by email.
- 2Verify
We confirm that the request comes from the account holder or an authorized representative.
- 3Respond
We explain what we did, what we cannot do, and why, within the time required by applicable law.
Private website builder projects
Saved drafts and uploaded photos are private to your LifeStarter account. LifeStarter does not publish customer websites in this release. Downloading an export copies your chosen content and pictures to your device; uploading that export to a host makes it available under that host’s settings and policy.
Unfinished edits may be kept in this browser tab for recovery, separately for each account and for guests. This is not an account save, and closing the tab can remove it. On a shared device, finish saving or downloading, remove unwanted recovery drafts, and close the tab. Signing out does not erase tab recovery copies. Do not put passwords, payment-card information or other unnecessary sensitive details in a website.
Moving a website to Trash retains it until you restore it or choose Delete forever. Permanent website deletion removes its draft and saved checkpoints; uploaded images remain separately available for reuse in other drafts. Saved projects and uploads remain while your account is active, and are included when a verified account-deletion request is completed. Deleting an account or draft cannot remove copies already downloaded or hosted elsewhere.
Optional investment projections
Calculator inputs run on your device. If you choose Save scenario, the scenario name, hypothetical inputs, mode, and timestamps are stored privately in your account. A scenario age is not used as your verified age or WIOA eligibility. Saved projections are not actual investment accounts and may be deleted from the calculator.
Private next-step notes
Updated September 25, 2026. My next steps stores a goal title, next action, optional follow-up date, learner-selected status, optional public resource choice, short reflection and question, and save timestamps when you choose Save to my account. These notes help you resume your own plans. They are private to your account, accessible to authorized operators only for necessary support, and excluded from facilitator reports, public profiles, and public metrics. Opening a provider link does not save a record, change a status, submit an application, or send your notes to that provider.
Unsaved notes stay in page memory and are lost when you leave or reload. If you choose Keep through sign-in, a temporary draft is stored in this browser tab for up to 30 minutes. Going Back from sign-in restores that draft on the same resource’s form without extending its expiry. The stored draft is removed when you use the sign-in return link to review it. Expired drafts are discarded when read; you can also clear the sign-in draft before continuing. You must explicitly save after signing in. Notes are never placed in the page URL. Session storage may be accessible to another person using the same browser session, so clear the draft on a shared device.
Account notes remain until you delete the record or a verified account-deletion request is completed. You can download and delete individual records in My next steps. Downloads stay on your device until you remove them; deletion from the account does not remove those copies. Sharing a download is your choice and is not automatic. Avoid sensitive health, legal, eligibility, or identifying information in free-text fields. External provider sites manage their own accounts, applications, and privacy practices.
Private Course Library projects
My Proof records are private to your account and available to authorized operators for necessary support. They are not public portfolios, and saving a record does not request a facilitator review. Files are not automatically uploaded, and we do not fetch your optional work link. External document permissions remain under your control. You can download or delete each record in My Proof. Deleting a record does not delete downloaded copies or externally hosted files. Use fictional or de-identified examples; do not include sensitive records, passwords, or other people’s identifying information.
Young learners, with clear privacy limits.
Learner accounts and the Course Library are intended for ages 14+, with no upper age limit. Younger learners can use public Academy practice with a trusted adult and without an account. Accounts are not available to people under 14. We do not knowingly collect personal information from children under 13. If you believe someone under 14 created an account, email thelifestarter@gmail.com; after reasonable verification, we will take appropriate steps to delete the account and associated information. New accounts select 14–17 or 18 and older; dates of birth are not collected. Learners aged 14–17 confirm they have parent or guardian permission. We store that attestation and its time, not a verified guardian identity. Parents or guardians can contact us with concerns or a deletion request; we verify authority before disclosing account information. Organizational programs must arrange any additional required consent and safeguards.
Security decisions have a source.
The current build applies practical safeguards informed by standards and provider documentation. It has not received an independent security certification, and we will reassess controls before high-risk or large-scale use.
NIST SP 800-63BAccount recovery guidance
Informs one-time, expiring recovery links and account-notification choices.
OWASPForgot-password safeguardsInforms generic reset responses, single-use tokens, expiry, and session invalidation after a reset.
FTCPersonal-information securitySupports data minimization, access controls, retention review, and incident planning.
FTC COPPAChildren's privacy boundaryInforms the response to discovering a child’s personal data. Our platform sets its own higher minimum age of 14.
Apple DeveloperPassword AutoFill compatibilityThe account inputs expose the password-manager rules supported by Apple devices.