Privacy Policy

courses.dragos.cc is run by Dragos, the person behind the reels it belongs to. I decide what is stored and why, so I am responsible for it.

Send a direct message to the Instagram account that posts the reels, or reply to any email I send you.

When you create an account I store:

• Your username and email address.
• Your password, stored as a hash. I never see or store the password itself.
• When you created the account, and when you accepted these terms and this policy.
• Whether you opted out of marketing emails.

Email addresses are not verified. They are used to sign you in and, while marketing emails are on, to send you news about new guides and kits.

Signing in creates a session: a random token kept in a cookie, plus the IP address and browser user agent the sign-in came from and when the session expires. Sessions keep you signed in and help me spot abuse. Sign-in and sign-up attempts are rate limited by IP address.

Guides unlock from comments on my reels, so the reel bot stores:

• Comments left on my reels: the comment id, the reel, your Instagram username and the comment text.
• Your Instagram user id, username and display name, the link to your profile picture, and earlier usernames the account had.
• The private guide link sent to you, when it was opened, and which account on this site it was linked to.

This data comes from Instagram through the official Meta API, for comments on my own posts only.

I record how the site is used so I can see which reels, guides and pages work. For every page view, click and download I store:

• The page, what was clicked and the page you came from.
• The campaign tags in the link you followed (utm_source, utm_campaign and the like).
• Your country, worked out from your IP address, and the IP address itself.
• Your device type, browser, operating system and browser user agent.
• A random visitor id, a device fingerprint made from your browser and screen settings, and your account if you are signed in.

The reel bot also records funnel events: a guide link was opened, an account was linked, a file was downloaded, a nemu link was clicked.

• session: keeps you signed in.
• visitor: a random id that tells repeat visits apart.
• country and device: your country and device type, so they do not have to be worked out on every request.
• fp: your device fingerprint.
• utm: the campaign tags of the link that first brought you here.

These cookies are set by this site only. There are no advertising or third-party tracking cookies.

Account creation uses Cloudflare Turnstile to stop bots. Turnstile runs in your browser and sends Cloudflare signals about your browser and connection to decide whether you are a person.

• To run the service you asked for: sending your guide link, unlocking guides and keeping you signed in.
• To keep the service safe: rate limits, spotting abuse and suspending accounts that break the terms.
• To improve the reels and guides, using the activity counts above.
• To email you about new guides and kits, unless you opt out.

I do not sell your data. It is processed by the services this site runs on:

• Vercel, which hosts this website.
• A rented virtual server, which runs the reel bot, the API, the database and the analytics store.
• Cloudflare, which runs the captcha on the sign-up page.
• Meta, whose Instagram API delivers the comments and sends the direct messages.

Links to nemu carry a referral code so nemu knows the visit came from here. nemu does not receive your account details from this site.

Marketing emails are on by default when you create an account, and you can untick them on the sign-up page. You can turn them off at any time on your account page, and every email will have a way to stop them.

Account data is kept while your account exists. Sessions expire on their own. Comment, analytics and activity records are kept for statistics, and are removed or anonymised when you ask me to delete your data.

You can ask for a copy of the data I hold about you, ask me to correct it, or ask me to delete your account and everything linked to it. You can also object to marketing at any time. If you are in the EU, you can complain to your data protection authority.

Send a direct message to the Instagram account that posts the reels, or reply to any email I send you.

If this policy changes, the date at the top changes too. For bigger changes I will tell you by email or on the site before they apply.