PRIVACY_POLICY.md
Last Updated: July 2026 // Transparent & Privacy-First Data Practices
okpython is an independent, open-source educational project developed and maintained by a solo developer for learning purposes. It is not a commercial enterprise or registered legal corporation. We prioritize transparency and collect only the minimum data required to power your learning experience.
1. Information We Collect
We collect data strictly to provide user authentication, track learning progress, issue verifiable certificates, and protect platform security. We do NOT run tracking cookies, advertising scripts, or data brokers.
- Authentication Data: When you sign in via Google OAuth or Magic Link, we store your email address, display name, user ID, and avatar image URL.
- Learning & Course Progress: Module completion timestamps, problem challenge pass counts, quiz scores, active coding streak dates, and earned badge definitions.
- Verified Certificates: Unique certificate ID, recipient name, course version, and issue timestamp.
- AI Tutor Interactions: Code snippets and student questions submitted to Pydude (processed via Google Gemini API).
- Security & Technical Logs: IP addresses are processed in-memory for sliding-window rate limiting and security alert logging to prevent abuse.
2. Third-Party Infrastructure & Sub-Processors
We rely on trusted third-party providers to host and operate the platform:
Google OAuth & Gemini AI
Handles secure OAuth login authentication and processes AI tutor doubt explanations.
Neon PostgreSQL
Encrypted PostgreSQL cloud database storing accounts, course progress, and certificate hashes.
Vercel Inc.
Serverless web hosting, Global Edge CDN delivery, and SSL certificate termination.
Pyodide (CPython WASM)
Client-side WebAssembly Python execution running 100% locally inside your browser.
3. Your Data Rights & Account Deletion
You have total control over your data. We provide an instant, self-serve account deletion tool:
Self-Serve Deletion Flow:
You can trigger account deletion at any time via Profile Settings → Danger Zone. Executing account deletion instantly hard-deletes your user profile, OAuth links, active sessions, and course progress. Any certificates issued are anonymized to "Former Developer" to maintain public verification link integrity while removing all personal data.
4. Global Compliance (GDPR, DPDP Act 2023, CCPA)
Regardless of your geographical location (European Union, India, United States, or worldwide), you enjoy the right to:
- Request a copy of the personal data held about you.
- Correct or update inaccurate account information.
- Request permanent erasure of your personal data without hassle.
- Opt out of any future communications.
5. Contact & Privacy Inquiries
If you have questions, privacy requests, or security disclosures, please reach out directly via email: