Privacy policy
What personal data we process, on what basis, who processes it for us, and what rights you have over it.
Last updated: 19 October 2026
Who is responsible
The data controller is Libreria de Satoshi, Inc., a corporation organized in the state of Delaware, United States. Postal address for contact: 651 North Broad Street, Suite 201, Middletown, DE 19709, United States. Email: privacidad@ismos.xyz.
This policy covers the ismos.xyz site and the campus at campus.ismos.xyz. Third-party services we link to — Discord, GitHub, X — are governed by their own policies.
What we process, and why
Reading the site requires no data from you. Data appears when you choose to do something specific.
Applying to a course, or registering interest
We process your email address together with the identifier of the course and cohort you signed up for. We use it to handle the application, to tell you when a course you were waiting on opens a new cohort, and to send enrollment reminders.
Legal basis: performance of the application you asked for and, for reopening notices, your consent — which you can withdraw at any time from the unsubscribe link in any of those emails.
Subscribing to the newsletter
We process your email address and the language you subscribe in. We use them to send you the welcome email and the newsletter with updates on courses, programs and fellowships.
Legal basis: your consent, which you can withdraw at any time from the unsubscribe link in any of those emails.
Proposing a course as a teacher
If you go to /become-a-teacher to propose a course, we process:
- Your account identifier at our identity provider, along with the name, email and profile photo that provider gives us.
- Your country of residence, years of teaching experience and the environments you have taught in, which you enter in the profile form.
- Your GitHub username, if you choose to connect it. This is optional and used only as authorship attribution in the course files.
- The course drafts you save as you go and a pointer to the submitted proposal, so you can pick your work back up on any device and follow the review.
Legal basis: performance of the relationship you start by proposing a course.
Worth knowing before you submit anything: a course proposal is submitted as a pull request to the LibreriadeSatoshi/courses repository on GitHub, carrying the course content and the name you are credited under. That repository is private right now, but the plan is to open it to the public, so assume your proposal and your name as its author will end up visible to anyone.
We check the country of residence against international sanctions lists, and that check can block a submission. It is a verification the law requires of us.
Donating
Donations run through our own BTCPay Server instance. We never receive or store card details. For Bitcoin or Lightning donations, we process the transaction data the protocol itself makes visible.
Studying on the campus
The Moodle campus processes your name, email, course enrollments and grades. Some badges are publicly verifiable and publish the recipient’s name: if you earn one, that name is visible to anyone who opens the verification link. Some activities may associate a Lightning address or a Nostr identity with your account.
Writing to us
If you use the contact form, we process what you tell us and the address you send it from, in order to reply.
Cookies and browser storage
We use no advertising cookies. This is what the site stores when it needs to:
| Name | Where | Purpose | Lifetime |
|---|---|---|---|
lang |
Cookie | Remember whether you prefer the site in Spanish or English | 1 year |
theme |
Local storage | Remember whether you prefer light or dark mode | Until you clear it |
lds_session |
Cookie | Keep the session of someone proposing a course | The session |
lds_oauth_state |
Cookie | Cross-site request forgery protection during sign-in | Minutes |
The last two exist only if you sign in as a teacher. None of them needs your consent: they are either strictly necessary or a preference you chose yourself. Analytics, and any cookies it may add, is covered in Analytics, at the end of this policy.
Who else processes your data
We work with providers who process data on our behalf and on our instructions:
| Provider | Purpose | Location |
|---|---|---|
| Netlify | Site hosting and server logs | US |
| Cloudflare | DNS and network protection | US |
| AWS | Moodle campus hosting | US |
| Supabase | Teacher profile and draft database | US |
| Customer.io | Application, notice, reminder and newsletter email | US |
| GitHub | Publication of course proposals | US |
| Internal working tools | US |
Where your data is handled: the controller is a US company and most of these providers are too, so your data is processed mainly in the United States, wherever you happen to be. Using the service means accepting that. If it does not work for you, do not use it.
We do not sell personal data, and we do not share it with third parties for advertising.
How long we keep it
We keep each piece of data as long as it is still needed for what we asked it for, and afterwards for as long as we could be held legally accountable for it.
Specifically: course application data, for the duration of the admission process and the cohort concerned; newsletter subscriptions, until you unsubscribe; teacher profiles and drafts, for as long as you keep the account; campus academic records, for as long as certifying the training requires. The content of a course proposal already submitted stays in the GitHub repository’s history.
What you can demand of us
You have the right to access your data, to correct it if it is wrong, to have it erased, to restrict or object to its processing, and to receive it in a portable format. You can also withdraw your consent at any time, without affecting what was done before you withdrew it.
To exercise any of these, write to privacidad@ismos.xyz. We will answer within the statutory deadline.
If you believe we have handled your data badly, write to us first — nearly everything is settled before it goes anywhere else. If our answer still does not satisfy you, you can take it to the data protection authority for your country of residence.
Two honest limits, because promising otherwise would be false: anything that enters a Git repository’s history is very hard to remove without rewriting the whole history, so we cannot promise immediate erasure; and a blockchain transaction is, by design, irreversible and public.
Minors
The site and the campus are aimed at adults. We do not knowingly collect data from children under 13. If you find that a minor has given us data, write to us and we will delete it.
Changes to this policy
If we change anything substantial we will announce it on the site and update the date at the top of this page. The version in force is always the one published here.
Analytics
We use Matomo (InnoCraft Ltd), with the data hosted in the European Union, to learn which pages people visit. By default it counts visits in aggregate, without cookies and without storing anything in your browser. Only if you accept in the cookie notice does it write the cookies in the table below, which let us tell new visits from returning ones. We do not share this data with third parties or use it for advertising.
| Name | Where | Purpose | Lifetime |
|---|---|---|---|
cc_cookie | Cookie | Remember what you chose in the cookie notice | 1 year |
_pk_id | Cookie | Recognise your browser when you come back (only if you accept) | 13 months |
_pk_ses | Cookie | Group the pages of a single visit (only if you accept) | 30 minutes |
mtm_cookie_consent | Cookie | Remember in Matomo that you accepted | 1 year |
You can withdraw your consent at any time from "Cookie preferences" in the footer; doing so erases those cookies.