Legal & Privacy
Privacy Policy
No Data Selling
We never sell, rent, monetize, or share your personal information or learning activity with advertisers or data brokers.
Client-Side Execution
Python scripts run locally inside your browser via WebAssembly. Unsaved code runs on an isolated origin and never touches our servers.
Optional Email
Register with just a unique username and password. An email address is entirely optional and never required to learn or earn certificates.
1. Information We Collect
We only collect data necessary to maintain your account, track progress, and support your learning:
- • Unique username & industry-standard hashed passwords (PBKDF2).
- • Optional display name, institution, and daily learning goal.
- • Optional Google OAuth identity or email used strictly for sign-in/recovery.
- • Completed lessons, reading duration timer verifications, and streak counters.
- • Quiz answers, server-scored final exam submissions, and earned XP.
- • Cryptographically verified graduation certificates issued to your name.
- • Python scripts saved from the Playground into PyLabs Cloud Drive.
- • Personal markdown notes written alongside curriculum lessons.
- • Explicitly uploaded project datasets and reference files within your 100 MiB allowance.
- • Hashed security question answers and optional SMS phone number for account recovery.
- • User-submitted feedback: message text, optional screenshot image, and device telemetry (OS, browser, screen resolution, viewport, IP, and page URL) retained for 30 days solely for debugging.
- • Display & accessibility preferences: text zoom level (global and per-page) stored in local browser storage and synced to your profile.
- • Anonymous 7-day aggregate runtime crash counters (excludes learner code and stacks).
2. How We Execute Your Python Code
Complete isolation between code execution and your account credentials:
Local Execution, Explicit Persistence
Code runs in a disposable Web Worker inside an independent runner origin iframe. It cannot access your session cookies or tokens.
PyLabs never executes student Python scripts on application backend servers, eliminating arbitrary execution telemetry.
Running code alone does not transmit it. Code is only uploaded when you explicitly click Save or submit a practice challenge.
3. Infrastructure & Data Storage Security
Built on modern, serverless edge infrastructure with strict encryption:
Encrypted SQLite database engine storing relational progress, quiz attempts, and user credentials with strict parameterized query boundaries.
Private, S3-compatible encrypted object storage for Cloud Drive scripts and files. Downloads require authenticated authorization checks.
All production traffic requires HTTPS with modern TLS cipher suites. Client-forwarded IP headers are untrusted; edge WAF protects against abuse.
4. Cookies & Session Management
Minimal, first-party functional cookies with zero advertising tracking:
- • Session Cookie: Host-only, Secure, HttpOnly, SameSite=Lax token for authenticated access.
- • Theme Preference: Stores your chosen theme (light or dark) locally.
- • Accessibility & Font Size: Stores your text zoom scaling factor in localStorage and syncs to your account so pages render at your preferred comfortable reading size.
- • Sign-Out Invalidation: Signing out revokes tokens immediately; "Sign out all devices" revokes all bearer sessions.
- • No Marketing Pixels: Zero Facebook, Google Ads, TikTok, or Twitter tracking tags.
- • No Cross-Site Profiling: We do not track what you do on external websites or apps.
- • No Fingerprinting: We do not construct hardware or canvas device fingerprint profiles.
5. Your Data Rights & Self-Service Erasure
You retain complete ownership over your files, personal notes, and account:
Download all your Python scripts, notes, and datasets from PyLabs Drive whenever you need offline backups.
Update your display name, username, security questions, or linked OAuth identity at any time in Account Settings.
Delete your account in Account Settings with recent authentication. Permanently erases your profile, progress, certs, and queues files for R2 purge.
6. Data Retention & Recovery Lifecycle
Automated lifecycle jobs ensure stale data is continuously expunged:
User feedback submissions and attached screenshots are automatically deleted after 30 days by a scheduled background sweeper. Account-linked feedback is purged immediately upon account deletion.
Runtime failure event logs contain only anonymous release IDs and error types (no user code, inputs, or URLs) and automatically expire after 7 days.
Progress records, earned XP, and certificates remain intact while your account is active. Public verification records show only recipient name, course, issue date, and hash.
Database recovery snapshots expire under deployment retention policies. When a database restore is rehearsed, user erasure records are reapplied before making any restored database live.
7. Providers & Age Eligibility
Our trusted infrastructure processors and learner age requirements:
Infrastructure Providers
- • Cloudflare: Edge Workers, D1 database, R2 file storage, static assets, and optional cookieless Web Analytics (performance beacon only, no advertising identifiers).
- • Google OAuth (Optional): Only when you choose to connect Google sign-in.
- • SMS Gateway (Optional): Receives phone numbers solely to transmit password reset OTPs.
- • WhatsApp Support: Directly handles learner inquiries when initiated.
Supported Learner Ages
- • Adults (18+): Full self-service account registration.
- • Teens (13–17): Permitted with appropriate parent or guardian authorization.
- • Under 13: Accounts for children under 13 are not supported; we do not provide verified parental consent workflows.
- • Schools & Institutions: Must contact the platform operator prior to uploading student rosters.
8. Contact & Privacy Requests
Have questions or need assistance with your data? Reach out directly:
Contact Mahadi Hasan, the platform administrator, through WhatsApp Support. This support channel remains available after you delete your account. You can also use the feedback widget while using the site. Send a brief description of your request; never send passwords, SMS codes or identity documents through feedback. Support will explain any identity verification needed through an appropriate channel.