Privacy policy
Last updated 29 October 2026
Grad ML (ml.grad.lk) is a free machine learning course, developed and run by Vimuthu Wijesiriwardana in Sri Lanka (“we”). In short:
- We collect only what the course needs: your account, your progress and your test answers, plus any details you choose to share.
- We don't sell your data, show ads, or use tracking or analytics tools.
- You can download or delete everything from your dashboard at any time.
What we collect and why
Your account
What: Your name, email address and password.
Why: To log you in and greet you by name. Your password is stored only as a scrambled hash by our login provider, so nobody can read it, including us.
Details you choose to share (optional)
What: Your university or school, what you study, your level and your country.
Why: To understand who uses Grad ML, for example which universities our learners come from, and to shape the course for them. You can leave these blank or change them at any time.
Your learning progress
What: The lessons you open, how far you get in each, when you start and finish them, the modules you pass or skip, and the days you learn.
Why: To save your place, show your dashboard and path, unlock modules, and count your day streak.
Your test answers and marks
What: Every answer you give in lesson checks and module tests, your score, whether you passed, and the date.
Why: To show your results, unlock the next module, and find the questions many learners get wrong so we can improve those lessons.
Sign-in records
What: When you sign up, confirm your email and sign in. Our login provider also keeps security logs that include your IP address and browser.
Why: To keep accounts secure and stop abuse.
What we don't do
- We don't sell or rent your data to anyone.
- We don't show ads or use advertising or tracking cookies.
- We don't use analytics tools that follow you around the web.
- We don't send newsletters or marketing emails.
What's stored in your browser
We keep your login session and a copy of your progress in your browser's local storage, so the site keeps you signed in and loads quickly. Both are removed when you log out. Our fonts are served from our own site, so loading a page doesn't contact other companies.
Videos
Lessons include YouTube videos. Nothing is loaded from YouTube until you press play. When you do, the video plays in YouTube's privacy-enhanced mode (youtube-nocookie.com), and Google's privacy policy applies to that video.
Who can see your data
- You. Everything is on your dashboard.
- The Grad ML admin (the developer) can see every learner's name, email, shared details, progress and test results, to run and improve the course.
- Other learners can't see anything about you.
- Companies that run the site for us: Supabase (our database and login provider), the company that hosts the website, and the service that delivers our account emails. They handle your data only to provide their service to us.
- Authorities, only if the law requires us to share it.
Where it's stored and how it's protected
Your data is stored by Supabase on servers in Ireland, in the European Union, so it's kept outside Sri Lanka. It travels over encrypted connections (HTTPS). The database only lets each learner reach their own records, and only admin accounts can see the overview of all learners.
How long we keep it
We keep your data for as long as you have an account. When you delete your account, everything about you is removed from our database straight away. Copies in our providers' backups are overwritten after a short time.
Emails we send
Only account emails: one to confirm your email address when you sign up, and one when you ask to reset your password.
Your rights
- See your data: use Download my data on your dashboard.
- Correct it: edit your name and details under About you on your dashboard.
- Delete it: use Delete my account on your dashboard.
- Withdraw your consent for the optional details by clearing them.
- Ask a question or make a complaint: contact us (below). You can also complain to the Data Protection Authority of Sri Lanka, or to your local data protection authority if you live elsewhere.
These rights come from Sri Lanka's Personal Data Protection Act, No. 9 of 2022, and, if you live in the EU or UK, the GDPR. We use your account and learning data to provide the course you signed up for, your optional details because you chose to share them, and sign-in records and answer statistics because we have a legitimate interest in keeping the service secure and improving it.
Children
If you're under 18, please ask a parent or guardian before you create an account.
Changes to this policy
If we change what we collect or how we use it, we'll update this page and the date at the top. Big changes will also be shown in the app.
Contact
Grad ML is developed by Vimuthu Wijesiriwardana. Get in touch through www.vimuthuthesara.tech.