Privacy Policy

Codingo collects the minimum needed to run a learning app. Everything below is provided by you or generated by your learning activity:

• Account data: name, username, email, and password (stored hashed — we never see it). With Google sign-in we receive your name, verified email, and profile picture.
• Learning data: lesson progress, XP, streaks, badges, and onboarding answers (age, country, language) used to personalize your path.
• Community data: threads, replies, and votes you post. Public profiles show your name, stats, and badges unless your profile is private.
• AI helper data: questions you ask the AI doubt helper, stored briefly with rate-limit counters to control cost and abuse.
• Technical data: the login cookie described below, plus basic rate-limit counters that keep auth and AI endpoints safe.

Your data runs the app: authentication, saving progress, streaks, community threads, and the AI helper. In aggregate it helps us see which lessons confuse learners so we can fix them.

What we never do: sell your data, show ads, or share your email and password with anyone. That is the whole business model — there isn't one beyond keeping Codingo free and useful.

Codingo uses one strictly-necessary cookie, codingo_token, that keeps you logged in for 7 days. It is httpOnly, so page scripts cannot read it, and it uses SameSite=None with Secure on the production domain so login works across the frontend and backend.

Without this cookie the app cannot remember you — logging out clears it immediately.

A few trusted providers help Codingo run. Each only receives what it needs:

• MongoDB Atlas hosts our database (accounts, progress, threads).
• Google verifies Google sign-ins — see Google's own privacy policy for that flow.
• Appwrite stores avatar uploads when enabled.
• Our AI providers (Groq, with OpenRouter as fallback) receive your helper question plus lesson context to generate an answer — never your password.
• Code you write runs entirely in your own browser (Pyodide and Web Workers), so practice code never touches our servers.

We keep your account and learning data while your account is active, so your streak and progress are waiting when you return. AI helper logs are kept only briefly for abuse control and cost tracking.

Protection in place: hashed passwords, httpOnly login cookies, input validation, rate limiting on auth and AI endpoints, and sandboxed in-browser code execution. No system is perfect — if you suspect a security issue, report it through the GitHub repository so it can be fixed quickly.

Your data stays under your control:

• Set your profile to private in Settings to hide your stats from the public showcase.
• Log out any time to clear your session cookie on that device.
• To download or delete your account and data, reach out through the GitHub repository — deletion removes your account, progress, and posts.

Codingo is for ages 13 and up and is not directed at younger children. If you believe a child under 13 has created an account, contact us through the GitHub repository and the account and its data will be removed.

As Codingo grows, this policy may be updated — new features sometimes need new data practices. The latest version always lives on this page with its update date, and continued use after changes means you accept the updated policy.