Privacy
Last updated 2026-09-13 (added section 3, Cookies; the optional database is now a Postgres database, section 6). Written in plain English on purpose; if anything is unclear, ask.
The short version. You can use every lesson, the glossary, the notes and the careers guide without an account, and when you do, your progress is stored only in your own browser. Analytics are cookieless and aggregate, and the only cookies are the ones sign-in needs (see section 3). Signing in is optional and stores the minimum needed to keep your progress and put your name on a certificate. Nothing is sold, and there is no advertising.
1. Using the site without an account
Your progress (lessons completed, XP, streaks, the name you type on the dashboard, editor drafts, theme preference) is saved in your browser's localStorage. It never leaves your device unless you sign in. Clearing your browser data erases it; a different browser or device starts from zero. This is a deliberate design choice, not a limitation we plan to remove: the code you write runs inside your browser too.
2. Analytics
The site uses Vercel Web Analytics and Speed Insights. They are cookieless, do not use fingerprinting, and report only aggregate page views, referrers, country, device type and performance timings. There is no advertising or cross-site tracking of any kind. Custom events (for example "lesson completed") carry no personal data.
3. Cookies
There are no advertising or analytics cookies. The sign-in library (Auth.js) currently sets two security cookies when a page loads, even if you never sign in: __Host-authjs.csrf-token, which protects sign-in against cross-site request forgery, and __Secure-authjs.callback-url, which remembers where to send you after sign-in. Both are HttpOnly (scripts on the page cannot read them), hold no personal data and are deleted when you close your browser.
If you sign in, a short-lived cookie (__Secure-authjs.pkce.code_verifier, 15 minutes) protects the exchange with Google or GitHub, and an encrypted session cookie (__Secure-authjs.session-token) keeps you signed in. It holds the basic profile described in section 4 and expires 30 days after your last visit, or as soon as you sign out. Your progress and theme choice are kept in localStorage, not in cookies (section 1).
4. Signing in (optional)
You can sign in with Google or GitHub. We receive the basic profile the provider shares (an ID, your name, email and avatar) and keep it in an encrypted session cookie in your browser (section 3); there is no password on this site. If you sign in and the optional database is switched on (section 6), your progress is synced to it so it follows you across devices, and your name and score can appear on the public leaderboard and community page. The account ID never appears on those public pages. You control that name on your dashboard. We do not read anything else from your Google or GitHub account and do not post on your behalf.
5. Waitlist and email
A few places let you leave your email: the pricing-page waitlist, an optional reminder when you finish a track, and the "use this in my course" enquiry. An address you enter is used only to reply to you about that one thing. When the optional database is switched on it is stored there; while it is off, the form tells you so and asks you to email directly instead, so nothing is quietly dropped. Your address is never shared or sold, we do not log it, and every message will have a way to opt out.
6. Third parties
The site is hosted on Vercel; the in-browser Python runtime (Pyodide) is loaded from the jsDelivr CDN; sign-in goes through Google or GitHub; the optional database (Postgres) is not switched on yet. Each is bound by its own privacy policy for the data it processes on our behalf. We use no advertising networks, no social-media pixels and no data brokers.
7. Retention and your rights
Browser-stored progress stays until you clear it. Signed-in progress and leaderboard entries stay until you ask for deletion. You can ask at any time to see, correct or delete anything we hold about you: email sitrakaforler@gmail.com. If you are in the UK or EU you have the rights set out in the UK GDPR / GDPR, including the right to complain to your supervisory authority (in the UK, the ICO).
8. Children
The site is intended for university students and adults. It does not knowingly collect personal data from children under 16; if that has happened, email us and it will be removed.
9. Changes
If this note changes materially, the date at the top changes and the change is described in plain terms. This is a personal, non-commercial project run by one lecturer; the intent is to store as little as possible.
Questions: sitrakaforler@gmail.com · About this site · Terms of use