Privacy Policy
Last updated 2026. Written to be read — if anything here is unclear, ask and we'll fix the wording.
The short version
We collect the minimum needed to save your progress: a username, an email address, and what you've completed. Your code never leaves your browser. We don't sell anything, we don't run advertising trackers, and you can export or delete everything at any time.
1. What we store
| Data | Why |
|---|---|
| Username | To identify your account and show you on the leaderboard. |
| Email address | To let you sign in and recover access. |
| Password (hashed) | To sign you in. Stored as a one-way hash — we cannot read it. |
| Google account ID and avatar | Only if you choose "Continue with Google". |
| Lessons, challenges and projects completed | To show progress, XP, streaks and achievements. |
| Last active date | To calculate your daily streak. |
2. What we don't store
We don't store the code you write. It runs in your browser through WebAssembly and is never sent to a server. Lesson notes and playground drafts live in your browser's local storage, on your device.
There are no advertising trackers and no third-party analytics scripts on this site.
3. Who else sees it
Your data sits in a Postgres database hosted by Supabase, and the site is served by Vercel. Both act as processors on our behalf. If you sign in with Google, Google tells us your email, name, Google ID and avatar — nothing else, and we don't get access to your Google account.
Your username, XP and streak appear on the public leaderboard. Your email never does.
4. Cookies
One cookie: the session that keeps you signed in. It's HttpOnly (scripts
can't read it) and SameSite=Lax (it isn't sent from other sites). There are
no tracking or advertising cookies, which is why there's no cookie banner.
5. Your rights
From your profile you can, at any time and without asking us:
- Access and port — download everything we hold as a JSON file.
- Rectify — change your display name and avatar.
- Erase — delete your account and all associated progress. This is immediate and permanent; we keep no shadow copy.
If you're in the UK or EU, these are your rights under UK GDPR / GDPR. You may also complain to your data protection authority.
6. Keeping it
We keep your data for as long as your account exists. Delete the account and it goes immediately. We don't have a separate archive to restore from.
7. Children
The site is suitable for all ages, but an account requires you to be 13 or older, in line with common practice for online services. If you're younger, learn without an account — every lesson is open.
Contact
Questions about your data? Contact us at hello@learnwithpython.com.