Privacy Policy

Last updated: 18 May 2026

Practice Pack is a local-first coding practice tool. This page describes what data the site handles, where it lives, and what your options are.

The short version

• If you never sign in, nothing leaves your browser. All your progress lives in this browser's IndexedDB.
• If you sign in with GitHub or Google, we receive a small amount of identity data from the provider and store it on Cloudflare so that your progress can sync across devices.
• We do not run analytics, advertising, or third-party trackers. There is no telemetry SDK on the site.
• You can delete your synced data at any time by signing out and asking us to remove the account, or by clearing your browser storage for the anonymous local copy.

What we collect

For anonymous (signed-out) users: nothing. Progress events, journal entries, and settings are written only to your browser's IndexedDB by src/services/storage.ts. No network request carries that data anywhere.

If you sign in with GitHub or Google, the OAuth provider returns the following to us, which we store in our Cloudflare D1 database:

• The provider's account ID for you (so we know who you are next time).
• Your display name and (when the provider supplies it) email and avatar URL.
• A 30-day session cookie (signed JWT) on the code.lywedo.com origin so you stay signed in across visits.

Synced practice data (created only after sign-in, pushed to our backend by src/services/sync.ts):

• Per-attempt metadata: problem id, pass/fail status, start and end timestamps, attempt count, hints revealed, tab-switch count, your Big-O guess, total duration.
• Journal entries: the free-text "hardest bit", "surprise or insight", and "re-drill target" you write at the end of a session.

What we do not collect

• Your code. The text you type into the editor stays in your browser. It is never sent to our backend.
• Browsing history, IP geolocation, fingerprints, cursor heatmaps, or session replays.
• Any data from third-party analytics or advertising SDKs — we have none.

Why we collect what we collect

• Identity data is used solely to sign you in and to display your name and avatar on your own profile and (if you opt in) on the public leaderboard.
• Synced practice metadata is used to power your progress dashboard, your streaks, the re-drill queue, and the leaderboard score.
• The session cookie is used to keep you signed in.

Who we share data with

Nobody. We do not sell, rent, or share your data with third parties. The only third parties involved in our processing are:

• Cloudflare — hosts the static site and the D1 database where synced user data lives.
• GitHub and Google — only at the moment you choose to sign in with them. They share your identity with us; we do not share anything back.

Cookies

We set one cookie: a signed JWT session token, scoped to code.lywedo.com, valid for 30 days, marked HttpOnly, Secure, and SameSite=Lax. It is only set after you sign in. We use no third-party cookies and no analytics cookies.

Your choices

• Stay anonymous. You don't have to sign in to use Practice Pack.
• Hide from the leaderboard. In Settings, toggle "Show me on the leaderboard" off; your synced data stays, but the public board won't list you.
• Sign out. Removes the session cookie. Your synced data remains on our servers until you ask us to delete it.
• Delete the local copy. Clear site data for code.lywedo.com in your browser, or use your browser's "delete site data" tool.
• Delete the synced copy. Email the address below from the account you signed in with and ask for deletion. We will remove your identity row and all events and journal entries linked to it.

Data retention

Synced data is kept for as long as your account exists. Anonymous local data is kept until you clear your browser storage. We do not back up the D1 database to any third-party service beyond Cloudflare's own platform retention.

Children

Practice Pack is not directed at children under 13. We do not knowingly collect data from children. If you believe a child has signed in, please contact us and we will delete the account.

Changes to this policy

If we change what we collect or how we use it, the "Last updated" date at the top will change and the new policy replaces the old one. Material changes will also be called out in the project's CHANGELOG.

Contact

Questions or deletion requests: lywedo@outlook.com.