Privacy Policy
Last updated 2026-10-25 · Version 2026-10-25.1
Effective date: 25 October 2026 Controller: Kanabe Aron Persoană Fizică Autorizată ("we", "us", "our") Address: 692, Sânsimion, Harghita 537285, Romania Tax identification code (CIF): 42879844 Trade Register No.: F19/359/2020 VAT identification number: RO42972799 Email: [email protected] Service: codingchallenge.dev (the "Service")
Summary of key points
- We collect very little: your email address, a display name if you set one, the code you submit, and your subscription status.
- We do not log IP addresses, device identifiers, or geolocation, and we do not store passwords — authentication is handled by Supabase. The one exception is the technical error report described in Section 4 (Sentry), which contains the type of browser and operating system but no account information.
- We use no analytics, advertising, or tracking cookies. There is no cookie banner because there is nothing to consent to beyond strictly necessary cookies.
- We never sell your personal data and we do not use your code to train machine-learning models.
- Submission files and logs are deleted about 30 days after a submission completes. Keep your own copies.
- Our infrastructure is hosted in the EU. Some providers may process data in the United States under Standard Contractual Clauses — see Section 9.
1. What information we collect
Information you give us
| Data | Where it comes from | Why |
|---|---|---|
| Email address | Signup, or your Google / GitHub / Discord / Microsoft account | Account identity, login, service messages |
| Password | Set by you, stored and verified by Supabase — we never see or store it | Login |
| Display name | Optional, set in your profile | Shown in the interface |
| Source code you submit | Uploaded by you or by our CLI tool | To build, run, and evaluate your submission |
| Submission notes | Optional free-text field | Your own reference |
| Cancellation feedback | Optional, when you cancel a subscription | To understand why people leave |
| Billing details (name, address, tax ID, card) | Entered on Stripe's checkout page | Payment and invoicing — we receive only confirmation and the last digits, never the full card number |
Information generated by using the Service
Account and profile records (tier, plan, submission quota, remaining submissions, last-active timestamp, preferences such as dark mode); challenge progress (challenges started, level reached, preferred language); submission records (status, timings, file references, memory and execution measurements); test results, which include build and test output and error messages — these can contain fragments of the code you submitted; subscription records (Stripe customer and subscription identifiers, plan, period dates, cancellation and refund status, and the date you accepted our terms); and invitation records, if you joined via an invitation.
What we deliberately do not collect
We do not store IP addresses, user-agent or device information, geolocation, advertising identifiers, or biometric data in our own systems. Our application code contains no fields for any of these, and our build and test logs are passed through a sanitizer that strips IP addresses and signed URLs before storage. The only exception is the error report sent to Sentry when something breaks in your browser or on our server (see Section 4), which includes your browser and operating system type.
Note that our network provider, Cloudflare, necessarily processes your IP address in order to route and secure your connection — see Section 4.
2. How we use your information
- To create and operate your account, and to authenticate you.
- To build, execute, and evaluate your code submissions and return the results.
- To enforce submission quotas and plan limits.
- To process payments, manage subscriptions, and issue refunds.
- To send service messages — email verification, password resets, and important notices about the Service or these policies. We do not send marketing email.
- To keep the Service secure and reliable: detecting abuse, debugging failures, and monitoring performance.
- To comply with legal obligations, including keeping accounting records.
We do not sell your personal data, share it with advertisers, use it for advertising or profiling, or use your submitted code to train machine-learning models.
3. Legal bases for processing (EU/UK)
| Purpose | Legal basis |
|---|---|
| Providing the Service, running your submissions, managing your account | Contract (Art. 6(1)(b) GDPR) |
| Taking payment and managing subscriptions | Contract (Art. 6(1)(b)) |
| Security, abuse prevention, debugging, service monitoring | Legitimate interests (Art. 6(1)(f)) — keeping the Service available and safe for everyone |
| Keeping accounting and tax records | Legal obligation (Art. 6(1)(c)) |
| Strictly necessary cookies | Contract / legitimate interests; no consent required under the ePrivacy Directive |
Where we rely on legitimate interests, we have considered the impact on you and limited the data involved. You may object to that processing — see Section 11.
4. Who processes your data
We use the following providers ("processors" or "sub-processors"). We have data-processing terms in place with each, or are in the process of concluding them.
| Provider | What they do | Data involved | Location |
|---|---|---|---|
| Supabase | Authentication and the main application database | Email, password (hashed, held by them), all account and submission records | EU — Frankfurt, Germany (eu-central-1) |
| Hetzner Online GmbH | Servers running the application, code execution, and file storage | Everything processed by the application, including your submitted code | EU — Helsinki (Finland); capacity may also run in Falkenstein and Nuremberg (Germany) |
| Cloudflare | Network entry point, TLS, and protection against attacks. All traffic to the Service passes through Cloudflare | Connection metadata including your IP address, request URLs, and headers | Global network; EU data-protection terms apply |
| Stripe | Payment processing, subscriptions, invoices, and the customer portal | Email, name, billing address, tax ID, payment method, transaction history | EU / US |
| Grafana Labs (Grafana Cloud) | Application monitoring — performance metrics, traces, and logs | Your user ID and account tier, request and error metadata. Not your email, name, or code | EU — Germany |
| Functional Software, Inc. (Sentry) | Error reporting when something breaks, in your browser or on our server | When an error occurs: the error type and message, the technical stack trace, the address of the page (path only, without any query string or fragment), your browser and operating system type, and a reference id. We configure the reporting to exclude your account (user id, email), cookies, request headers, query strings, and request contents, and we do not record sessions or page interactions. Sentry necessarily receives your IP address with the connection but the project is configured not to store it. Error messages come from our application, your browser and the libraries we use. They are not intended to contain personal data and are not filtered for it. Reporting is used to find and fix bugs, on the basis of our legitimate interest in keeping the Service working | EU — Germany (Sentry EU data region). Sentry is a US company, see Section 9 |
| GitLab | Source control and our deployment pipeline; stores our application images | No user data in normal operation | EU / US |
We may also disclose information where legally required — to comply with a law, regulation, legal process, or enforceable governmental request — or to protect our rights, safety, or property, or those of our users.
If we are ever involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you before it becomes subject to a different privacy policy.
5. Cookies and local storage
We use only strictly necessary cookies and local storage. We use no analytics, advertising, or tracking technologies whatsoever, and we load no external fonts or third-party trackers.
Full details are in our Cookie Notice.
6. Social logins
You can sign in with Google, GitHub, Discord, or Microsoft. When you do, we request only your email address — no profile photo, contact list, repositories, or other data.
Your login with that provider is governed by their own privacy policy. We receive your email address and a unique identifier, nothing more.
7. How long we keep your information
These periods are enforced by an automated cleanup job that runs daily (error reports are deleted by Sentry itself).
| Data | Retention |
|---|---|
| Submission files and execution logs | Deleted about 30 days after the submission completes. The submission record remains; the uploaded code, logs, and built container image are removed |
| Submissions of inactive free accounts | Deleted after 90 days without activity. Paid accounts are exempt |
| Error reports (Sentry) | Kept by Sentry for 90 days (its standard retention for error events), then deleted by Sentry automatically |
| Execution queue records | Trimmed after 30 days |
| Deleted accounts | Deactivated immediately; permanently erased — including your authentication record — after a 7-day grace period, during which you can restore the account |
| Account, profile, and progress records | Kept for the life of your account |
| Billing and accounting records | Retained as long as Romanian accounting and tax law requires — currently 10 years from the end of the financial year. This obligation overrides a deletion request for those specific records |
The Service is not a backup or an archive. We give no guarantee that any submission, result, or other data will remain available, and data may be deleted at any time. Please keep your own copies of anything you want to keep.
8. How we keep your information safe
All traffic is encrypted in transit with TLS. Passwords are never handled by our application. Access to production systems is restricted to the operator, requires key-based authentication through a single hardened gateway, and is protected by an IP allowlist. Code submissions run in isolated, short-lived containers in a separate, network-restricted environment, and are automatically destroyed after execution.
In the interest of transparency, two limitations you should know about:
- Your submitted code is visible to the operator. While a submission is being built and tested, your code is placed in our execution cluster in a form that is not separately encrypted. Anyone with administrative access to that cluster — in practice, the operator — could read it. Do not submit secrets, credentials, or confidential third-party code.
- No system is perfectly secure. We cannot guarantee that unauthorized access will never occur. Transmission to and from the Service is at your own risk.
Data breaches. If a personal-data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the Romanian supervisory authority (ANSPDCP) within 72 hours of becoming aware of it, as Art. 33 GDPR requires. Where the breach is likely to result in a high risk to you, we will also notify you directly, by email to the address on your account, without undue delay.
9. International transfers
Our primary infrastructure is in the EU.
Our monitoring provider, Grafana Cloud, processes data in an EU region located in Germany. The limited technical telemetry it receives — including your user ID and account tier, but not your email, name, or code — therefore stays within the EU/EEA.
Our error reporting provider, Sentry, stores error reports in its EU data region (Germany), but as a US company it may access them from the United States. Stripe and GitLab may also process data in the United States. Where this happens, transfers are covered by Standard Contractual Clauses and, where applicable, the EU–US Data Privacy Framework.
You may request details of the safeguards in place by emailing [email protected].
10. Children
The Service is not intended for anyone under 18, and our Terms of Service require you to be at least 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us at [email protected] and we will delete the account.
11. Your privacy rights
If you are in the EU/EEA or the UK, you have the right to access your data, to rectify inaccurate data, to erase it, to restrict or object to processing, to data portability, and to withdraw consent where we rely on it.
How to exercise them
- Access, correction, restriction, objection, or portability: email [email protected]. We will respond within one month, as Art. 12(3) GDPR requires. We may ask you to confirm your identity from your registered email address.
- Deletion: you can delete your account yourself from your profile page. Your account is deactivated immediately and permanently erased after a 7-day grace period. You can also ask us by email.
- Some data can be edited directly in your profile — your display name and preferences.
Note on portability: we do not currently offer a self-service data export. Email us and we will provide your account data, challenge progress, and any submissions still within their retention window in a machine-readable format.
Complaints. If you think we have handled your data improperly, please contact us first. You also have the right to lodge a complaint with a supervisory authority — in Romania, the National Supervisory Authority for Personal Data Processing (ANSPDCP), dataprotection.ro. If you are elsewhere in the EU/EEA or in the UK, you may complain to your local authority.
We have not appointed a Data Protection Officer, as we are not required to. There is no EU representative, as we are established in Romania.
12. US state privacy rights
If you are a resident of California, Colorado, Connecticut, Virginia, or another US state with a comprehensive privacy law, you may have rights to know, access, correct, delete, and opt out of "sale" or "sharing" of personal information, and to appeal a refused request.
We do not sell or share personal information, we do not process it for targeted advertising, and we do not engage in profiling with legal or similarly significant effects. To exercise any right, email [email protected].
We do not currently respond to Global Privacy Control signals, because we operate no tracking or advertising technology for such a signal to act upon.
13. Updates to this notice
We may update this Privacy Policy. The version and last-updated date at the top of this page always reflect the current version.
For material changes — for example, adding a new category of data or a new processor that meaningfully affects you — we will give you notice by email to the address on your account and by a notice in the application before the change takes effect.
14. How to contact us
- Email: [email protected]
- Post: Kanabe Aron Persoană Fizică Autorizată, 692, Sânsimion, Harghita 537285, Romania
You can request a copy of, or deletion of, the personal data we hold about you at the address above.