ALTITUDE
Legal

Privacy Policy

Last updated: 2026-10-16

JnJ Ventures, LLC, a California limited-liability company, doing business as Altitude.

This explains what Altitude collects, why, and what you can do about it. The short version: we collect information to teach you and understand how the service is used. We do not sell it or track you across sites.

Who is responsible

JnJ Ventures, LLC, a California limited-liability company, doing business as Altitude, decides what Altitude collects and why. Under EU and UK data protection law that makes us the data controller.

Write to us at support@learnaltitude.com, or by post at JnJ Ventures, LLC, 2108 N Street, Suite N, Sacramento, CA 95816.

What we collect about your account

  • Your email address. It is required — it is how you sign in and how we reach you.
  • Your name, your time zone, and how you heard about us, from the profile step.
  • When you were last active, so we can tell a live account from an abandoned one.
  • If you subscribe, a Stripe customer reference linking your account to your Stripe record. We never see or store your card number — Stripe handles payment details.
  • Sign-in security records: each time a sign-in code is requested we store the email it was sent to, the IP address the request came from, and the time. That is what stops someone spamming codes at your address.

What we collect while you learn

In the web app:

  • your skill-check answers and the skill profile they produce;
  • your project interview — the conversation, your answers, and the project ideas generated from them;
  • your journey: its plan, its tasks, and your progress through them;
  • your review answers and explanations, the grades AI gave them, and the review schedule that follows;
  • your settings, your points, and your activity history;
  • help-agent conversations, if you use the in-app help — the transcript is stored with your account.

On signed-in pages, a first-party activity beacon records a page key (a short page name) and an optional object ID, such as the journey or review session you opened. It records page views, engagement when you interact with a visible tab, and whether the tab is visible or hidden. Each event is linked to your account ID and a server timestamp. The beacon does not store full URLs or what you type, and public pages do not send these events. We use them to measure usage, understand where learners spend time, and improve the service.

What the workshop sends from your computer

This is the part people most want a straight answer on, so here it is in full. When the altitude command-line tool and the agent plugin run inside your coding agent, they send us events about your learning. Between them, those events can carry:

  • your answers, word for word, and the questions you were asked;
  • notes your tutor recorded during the session, and the check-in questions you accepted or declined;
  • which concepts a task touched, and whether a check was marked correct, partial, or incorrect;
  • session identifiers and timestamps, so a session can be assembled;
  • the working directory of the project you are building in — a path on your machine, which usually contains your operating-system username;
  • the name of your computer (its hostname), which coding agent you use, and the versions of the agent, the command-line tool, and the plugin;
  • error messages and stack traces when a check crashes, so we can fix it.

Unless you turn it off, the workshop also sends us a copy of each lesson conversation with your coding agent: what you and the tutor wrote, the commands the tutor ran, and short excerpts of the code it wrote, the files it read, and what its commands printed. Before the copy leaves your computer, the workshop removes things that look like passwords, API keys, tokens, and private keys, and leaves out the contents of .env files. We scan it again when it arrives. We use these copies only to see where lessons work and where they don't, and to make them better. They are never shown to other learners, never sold, and never used to train AI models. Apart from these lesson copies, the workshop does not upload your source files, commits, or repository contents.

These events are claims from your machine, not facts. We record them with their provenance, and you can review your sessions and the evidence attached to them in the app.

Cookies

We use cookies for exactly two things, and neither of them is advertising.

  • Your sign-in session. After you sign in, our authentication library sets a session cookie — authjs.session-token, or __Secure-authjs.session-token over HTTPS. It is HttpOnly, so page scripts cannot read it, and signing out clears it. The same library sets short-lived cookies during sign-in to protect the form against cross-site request forgery and to remember where to send you afterwards.
  • Your skill check before you have an account. altitude_assessment is an HttpOnly cookie holding a random identifier, so an anonymous skill check can be resumed and then claimed when you sign up. It lasts 30 days.

We run no advertising pixels and no third-party tracking scripts. There is no Google Analytics, no advertising pixel, and no session recorder anywhere in the app. We do not sell personal information, we do not share it for cross-context behavioural advertising, and there is no third-party cookie to opt out of.

The skill check also keeps your in-progress answers in your browser’s own session storage so a refresh does not lose them. That never leaves your browser and disappears when you close the tab.

Do Not Track: because we do not track you across sites at all, we do not respond to Do Not Track signals from your browser. California law requires us to say so.

AI, and who else sees your data

Altitude uses AI to grade answers, write lessons, generate project ideas and journeys, and answer help questions. Doing that means sending the relevant text to our AI providers.

These are the companies we rely on to run Altitude. Each one gets only what it needs to do its job:

  • Amazon Web Services — hosting and the database, in the United States (us-east-2).
  • Anthropic — the AI models behind grading, lesson and journey generation, and the help agent, under its commercial API terms.
  • OpenAI — a backup AI provider for journey and prototype generation, used when our main provider is unavailable, under its API terms. Data sent through OpenAI's API is not used to train its models.
  • Stripe — payments. Stripe handles your card details; we do not.
  • Kit — our newsletter and waitlist email.
  • Microsoft 365 — our support mailbox, so the email you send to support@learnaltitude.com lives there.

We review shared lesson copies ourselves, and we use Anthropic's Claude to help us read them, with training on our conversations turned off.

Your data is stored and processed in the United States. If you are outside the United States, using Altitude means your data is transferred here.

Explore shares learning activity and published projects with other people. Its activity feed shows your trail name and learning milestones, such as concepts mastered, badges, levels, streaks, and project publications, to other subscribers. Activity sharing is on by default. You can turn it off in Settings › Privacy using “Show me on the explore page”.

If you choose to publish a project in the Explore gallery, anyone with an Altitude account can see its title, summary, progress, your trail name, and your level title. Project sharing is separate: turning off activity sharing does not hide published projects. You can make each project private in Settings › Privacy or in that project’s Journey settings.

We do not sell your personal information and we do not share it for advertising. Beyond the sharing described above, we may disclose it if the law requires it, or if Altitude is sold or reorganised — in which case it moves with the business and this policy keeps applying until we tell you otherwise.

How long we keep it

  • Your account and your learning history stay while your account exists. The whole point is a review schedule that stretches over months, so we do not expire it early.
  • Web activity events stay for the life of your account. Resetting your learning progress keeps them; deleting your account removes them from the database.
  • Application logs are kept for 30 days; web access logs at our content delivery network are kept for 90 days.
  • Database backups are kept for 14 days, so deleted data can survive in a backup for up to that long before it ages out.
  • Lesson copies are deleted after 90 days, or within 7 days of you turning lesson sharing off or your account being deleted. They are stored as files outside our database, so they do not linger in database backups.
  • Billing records live with Stripe for as long as tax and accounting law requires.

Your choices

  • See or correct your data: your profile and settings are editable in the app. For anything else, email us and we will get it for you.
  • Delete your account: email us from the address on the account and we will delete the account and its data within 30 days. Deletion is permanent — your journey, your reviews, and your history go with it.
  • Stop sharing lesson copies: lesson sharing has a switch in Settings. Turning it off stops new copies and deletes the ones we have.
  • Turn off email: review reminder emails have a switch in Settings, and every reminder has an unsubscribe link.
  • Disconnect a machine: Settings lists every connected workshop, and revoking one signs that machine out immediately.

If you are in the EU or the UK, you have the right to access your data, correct it, delete it, take a portable copy elsewhere, and object to the processing we base on legitimate interest. Email support@learnaltitude.com and we will do it. You can also complain to your local data protection authority.

If you are in California, you can ask what we have collected about you, ask for a copy, and ask us to delete it, at the same address. We will not treat you differently for asking.

Children

Altitude is for adults, 18 and over. We do not knowingly collect data from children. If you believe a child has an account, email us and we will delete it.

Security

Traffic runs over HTTPS. Sign-in codes are stored hashed, never in the clear, and the token your workshop uses is stored hashed too.

No system is perfect. If we ever have a breach that affects you, we will tell you.

Changes to this policy

If we change this policy in a way that matters, we will email you and update the date at the top of this page.