What this course stores

Signing in

Signing in is GitHub, and GitHub is the only way in. When you sign in, GitHub hands over your username, your display name, your avatar image and an email address. GitHub hides real addresses by default, so what usually arrives is the noreply address it generates for you, and that is the one stored. With it we keep the tokens that let the site know the session is yours, and a session expires on its own.

That is the whole of what signing in creates. The permission asked for is the smallest one GitHub offers, which is your public profile and your email address. Nothing reads your repositories, your private activity, or anything else on your account, and nothing is ever written back to it.

Your progress, and every attempt

Progress is which items you have finished, where you left off in each chapter, which worked solutions you have revealed, how many hints you took, and any draft code still sitting in an editor you have not submitted.

Every graded attempt is recorded as well, and this is the part worth being plain about, because it is more than most courses keep. A row says which exercise, whether it passed, which try it was, how long you sat with it before answering, which hints you had already taken, and, when the course recognised your mistake, which mistake it was. Attempts are never edited and never overwritten.

They are kept because they are the only way this course improves. An exercise where many people fail the same way and nothing explains it is a missing explanation, and this is how a missing explanation gets found. They are kept for as long as the course runs, unless you ask for them to go.

None of it is scored, ranked, or shown to anyone else learning here. There are no leaderboards and there will not be any.

The code you write

Your code runs in your own browser. It is graded there, in a worker, and no server anywhere runs it.

What is stored is the text of it. When you submit an exercise, the code you submitted is saved with that attempt, and drafts you have not submitted are saved too, so the editor still has your work when you come back. This is the thing the sign-in page has always said, and it is the most personal thing here: how somebody writes code is closer to handwriting than to a form field. It is read to work out where the explanations are missing, and for nothing else.

The duck, and the explanation

Two different things sit behind the still stuck button, and only one of them leaves your machine. The difference is worth a paragraph each.

The duck is first, and it goes nowhere. You explain the problem out loud or in writing, to nobody. If you speak, the recording is made and played back inside your browser and thrown away when you move on: not uploaded, not saved, not transcribed, and that is a design decision rather than a current limitation. If you type instead, what you type is not sent either. What is recorded is that the duck was used, whether you spoke or typed, and how many times. Never a word of what you said.

The explanation is second, and it does leave. When the course cannot explain your mistake from its own hand-written list, it sends the exercise, the failing case and your code to Groq, whose model writes the explanation you read. Your name, your email and your account do not go with it. Nor does anything you told the duck, in either form, which is deliberate: someone who prefers to talk should not get a worse explanation than someone who types.

The answer that comes back is cached, so the next person who makes the same mistake on the same exercise gets it instantly. That cache is keyed by the exercise and the code alone and carries no account, no name and no identifier, so nothing in it points back to a person.

If you buy

Payment is handled by Stripe. Your card details are typed on Stripe's own page, not on this site, and they never touch this database. Nobody here can see a card number.

What is kept here is the record of the sale: which checkout it was, which cohort you bought, the amount, and the email or reference Stripe reported so the payment can be matched to your course account. That matching is the whole reason the row exists. A payment nobody can match to an account is a person who paid and got nothing.

One small thing worth knowing rather than hiding. If you go to checkout while signed in, the email address on your account is passed to Stripe in the link itself, so the form arrives already filled in and the payment is easier to match to you afterwards. That is the only place on this site where a personal detail is written into a web address rather than sent inside the request, and the practical consequence is that it can sit in your browser history.

Stripe holds its own copy, under its own privacy policy, and that copy is the subject of the last section on this page.

Cookies

There is one cookie, and it is the one that keeps you signed in. It is set when you sign in, it is how the next page knows it is still you, and it goes when you sign out or the session expires.

That is also why this site has no cookie banner. A banner asks permission for the cookies that need permission, and a cookie that does nothing but keep you signed in is not one of them. Putting one up anyway would be theatre, and it would train you to click accept on the sites where it matters.

What is never done with any of it

Nothing is sold. Nothing goes to advertisers. There is no analytics package on this site, no tracking pixel, no advertising script and no third-party script of any kind.

The only companies that receive anything are the ones it takes to run the thing: GitHub to sign you in, Groq to write an explanation when the course cannot, Stripe to take a payment if you make one, and Vercel and Neon to serve the site and hold the database. Each of them gets the part of it their job needs and no more.

This is one person's project rather than a company with a data department, which cuts both ways and is worth saying. There is no business model here that wants more of your data, and there is also nobody to hide behind if something goes wrong.

Deleting it, and the part that cannot be deleted

Ask, and everything about your learning goes: the account, the progress, the attempts, the code stored with them, and the events. Not anonymised, not archived. Deleted, in one go, and you do not have to give a reason.

There is one thing a request cannot reach. If you have bought the course, Stripe processed that payment and keeps its own record of it, and financial law requires them to hold it for years after the sale, for tax and for anti money laundering rules. Nobody here can shorten that or reach into it, and it does not matter who asks.

The purchase row in this database survives too, with your account detached from it and the payment reference left behind. That is a deliberate choice and not an oversight: a course should not be able to delete the evidence that somebody paid it, least of all at the moment that person is asking it to forget them.

So "delete everything you have about me" is not something this product can do, and it is not going to be promised. The true version is that everything about your learning goes, and a record that a payment happened stays, holding as little about you as it can.