Privacy Policy

• Account: Your email address and (optionally) a display name. Passwords are handled and hashed by our authentication provider — we never see or store your plaintext password.
• Learning data: Course progress (which chapters you complete), lab topologies you choose to save, and ARIA usage records used to enforce plan limits (the monthly AI allowance and request-rate limits).
• ARIA AI conversations: ARIA AI is included only with the Lab & AI Pass and All-Access Max. On those plans, when you send ARIA a message or run Agent Mode, we send your message, the recent conversation and a description of your current lab (devices, cables and configuration) — or, in a course chapter on All-Access Max, the chapter you're reading — to our AI provider, Google (Gemini API), to generate the reply. We keep a log of your questions and ARIA's replies with your account so we can review ARIA's answers and improve the course; deleting your account deletes that log. Your open ARIA chats are also saved in this browser's local storage, so you can pick up where you left off on this device; clearing this site's data in your browser removes them. We also record how much of your monthly AI allowance each request uses, to enforce plan limits. On the Free plan, the Lab Only Pass and the Course & Lab Pass, ARIA AI isn't available and nothing you do is sent to an AI provider. The course's pre-recorded ARIA narration is audio we produced in advance; playing it sends nothing to an AI provider.
• Billing: If you subscribe to a paid plan, payment is processed by PayPal. We store only what we need to run the subscription and show you your own billing history: a PayPal subscription reference, your plan and its status, the current billing period's start and end dates, any scheduled end date after you cancel, and one record per payment (amount, currency, status, and date). We do not receive or store your card number, bank details, or PayPal login — those stay with PayPal. You can see everything we hold about your billing at Account → Billing.
• Analytics: We use Vercel Web Analytics to understand how the site is used — page views, Core Web Vitals performance metrics, and a small set of anonymous product events that tell us which steps people complete or get stuck on (for example: the lab was opened, a device was added, a save was attempted, or a plan limit was reached). Those events carry only counts and plan tier — never your name, email, IP address, or anything you type or build. It is cookieless and privacy-first: it sets no cookies, does not collect or store your IP address or any cross-site identifier, and cannot be used to track you across other websites. This Vercel analytics stream is never linked to your account.
• Google Analytics: We also use Google Analytics 4 to see which channels bring people to the site (search, referral, direct) and which of the same anonymous product events they complete. Unlike the stream above, Google Analytics sets cookies (_ga) to recognise a returning browser, and Google receives your IP address in order to derive an approximate location before discarding it. We do not send Google your name, email, account ID, or anything you type or build. The only account details it receives are your plan tier on some product events and whether this browser is signed in (yes or no), so we can count signed-in and anonymous visitors separately. We have not enabled advertising features or cross-site remarketing, and this data is not linked to your NetForge-AI account. If you are visiting from the EEA, the UK, or Switzerland, no Analytics cookie is set until you accept the banner, and declining is remembered. Wherever you are, you can change your choice at any time with Cookie settings (in the site footer and in the Cookies section below). You can also opt out for every site with Google's browser opt-out add-on or by blocking cookies for this site.
• Google AdSense: Some pages carry Google AdSense advertising. AdSense sets advertising cookies (for example __gads, __gpi, and DoubleClick's IDE) to select and measure ads, and may use them to personalise ads based on your visits to this and other sites. It does not receive your name, email, account ID, or anything you type or build. If you are visiting from the EEA, the UK, or Switzerland, AdSense is not loaded for you unless Google's own consent message is shown to you first, and no AdSense cookie is set until you agree to it there. You can opt out of personalised advertising for every site at Google Ads Settings or aboutads.info.
• Product usage (signed-in only): When you are signed in, we also keep a record of how you use the product that is linked to your account: the pages you open, how long each page is in the foreground of your browser, which features you use (adding a device, running a command, saving a topology, hitting a plan limit), and how much of a chapter video you have watched. We use it to see where learners get stuck and what to build or fix next. For a lab command it records the first word and whether the simulator accepted it. A command the simulator accepts is never stored, so the configuration you enter is not kept. When it rejects a command, we keep that line (up to 120 characters) so we can see where the simulator confuses people: before it is stored, everything after a password, secret, key or community keyword is removed, and any line that looks like a password, key, email address or phone number is dropped entirely. These lines are deleted after 30 days. We do not collect this for signed-out visitors, we do not sell it, and deleting your account deletes it.

• Operate the lab, the course and — on the plans that include it — ARIA, and save your progress.
• Enforce plan entitlements (course, lab and AI access) and ARIA usage limits.
• Take subscription payments, show you your billing history, apply your cancellation on the right date, and prevent abuse. We process this data to perform our contract with you and to meet tax and accounting obligations.
• Diagnose errors and keep the service reliable and secure.

An essential cookie keeps you signed in (your authentication session), and a short-lived session cookie (nf_sid) helps us de-duplicate anonymous page views within a single visit — it is cleared when you close your browser. We never sell your data, and we never share it with an ad network beyond the standard ad-serving relationship described below.

Google Analytics sets _ga and _ga_<id> cookies (expiring after up to two years) so that a returning browser is counted as one visitor rather than several. These are analytics cookies, not advertising cookies. Google AdSense, where shown, sets its own advertising cookies (__gads, __gpi, DoubleClick's IDE) to select, measure, and in some cases personalise ads. To refuse either, block cookies for this site in your browser, enable its “do not track” / tracking-protection setting, or use Google's Analytics opt-out add-on and Ads Settings. Everything else on NetForge-AI works normally without them.

You can change or withdraw your Google Analytics choice at any time: open Cookie settings. Declining also deletes the Google Analytics cookies already stored in this browser.

We share data only with the processors required to run NetForge-AI:

• Supabase: Authentication, database, and hosting of your account data.
• PayPal: Subscription billing and payment processing for the paid plans. PayPal is the controller of the payment data you give it directly (card or bank details, PayPal account) under its own privacy statement.
• Vercel: Hosting and cookieless site usage analytics (page views, Core Web Vitals performance). See Vercel's privacy policy.
• Google Analytics: Site usage analytics (traffic sources, page views, anonymous product events). See Google's privacy policy.
• Google AdSense: Serves the advertising shown on some pages. See how Google uses data from AdSense partner sites.
• AI providers: ARIA messages on the Lab & AI Pass and All-Access Max are processed by Google's Gemini API solely to generate replies; Google may retain prompts and responses in accordance with its Gemini API terms. Posts you submit through NetForge-AI are screened by a keyword filter that runs on our own servers. No post, answer or comment is sent to an AI provider for moderation. We do not use your ARIA conversations to train our own models.

Each processor handles your data under its own terms and security controls. We do not sell your personal data to anyone.

We keep your data while your account is active. You can delete your account at any time from Account → Danger zone; this removes your profile, progress, lab saves, ARIA history, and product-usage records, and cancels any active subscription at the same time. The text of lab commands the simulator rejected is deleted after 30 days even while your account is active.

Billing records are the one exception to immediate deletion: tax and accounting law requires us (and PayPal) to keep a record of payments taken for a number of years, so payment records may be retained for that period after your account is gone. They are kept only for that purpose and are not used for anything else.

Every account's data is isolated at the database level with row-level security, so one user can never read or modify another's data. Traffic is encrypted in transit, and sensitive keys are kept server-side only.

You can view and update your profile, see your stored progress and saves, and delete your account and its data — all from your account page. Depending on where you live, you may have additional rights to access, correct, or port your data; contact us to exercise them.

NetForge-AI is not directed at children under 13. We do not knowingly collect personal information from anyone under 13. If you believe a child under 13 has provided us with personal data, please contact us at support@netforge-ai.com and we will delete it promptly.

We'll update this page when our practices change and revise the date above. Questions about privacy? Email support@netforge-ai.com. See also our Terms of Service.