Private by design.

Last updated: October 2026. No analytics, advertising or trackers — ever. You can use the whole free part of the lab with no account: challenges, the practice terminal and answer checking run inside your browser. Extra data is processed only if you choose to create an account or buy the lifetime unlock, as described below.

Who is responsible

Anmol Sharma, Berlin, Germany · [email protected]

Hosting and security (Cloudflare)

The site and its backend run on Cloudflare, Inc. (CDN, Pages Functions and the D1 database), which processes technical data such as your IP address and requested pages to deliver and protect the Service. Legal basis: Art. 6(1)(f) GDPR. Cloudflare is certified under the EU-US Data Privacy Framework.

Your progress

While signed out, solved challenges, hints, points and settings are stored only in your browser's local storage and never leave your device. If you sign in, your solved-challenge list, points and streak are also stored in our database so your progress follows you across devices (Art. 6(1)(b) GDPR). We do not store your actual answers.

Accounts and sign-in

Sign-in is passwordless: you give an email address and we send a one-time link. We store your email address, whether you have purchased, and timestamps. A single strictly-necessary cookie (as_sid) keeps you signed in; it is HttpOnly, Secure and used for no other purpose, so no consent banner is required. Delete your account and data any time by emailing us.

Email delivery

Sign-in links are sent via a transactional email provider (currently Resend), acting as our processor, which handles your email address solely to deliver that message. Legal basis: Art. 6(1)(b)/(f) GDPR.

Payments (Stripe)

The one-time unlock is processed by Stripe Payments Europe, Ltd. as an independent controller/processor. You enter your payment details on Stripe's hosted page — we never receive or store your card data; we only learn that a payment succeeded and the associated email. Legal basis: Art. 6(1)(b) GDPR. See Stripe's privacy policy for its processing.

Retention

Account and progress data are kept while your account exists; sign-in links expire within 15 minutes. Payment records are retained as required by tax/commercial law. On deletion we remove your account and progress.

Your rights

You have the rights under Art. 15–21 GDPR (access, rectification, erasure, portability, objection) and may complain to a supervisory authority, e.g. the Berlin Commissioner for Data Protection and Freedom of Information. See also our Terms & refund policy.