1. Information We Collect

We collect only the minimum necessary information required to deliver high-quality coding education:

• Authentication Data: Basic profile received via Google OAuth (Name, Email address, Profile avatar URL).
• Learning & Progress Data: Course enrollment, completed lessons, browser playground code execution sessions, and quiz submissions (multiple-choice, short-answer, and descriptive answers).
• Certificate Ledger Data: Issued certificate unique identifiers, recipient name, completion hash, and verification timestamps.
• Technical & Log Information: IP address, device/OS type, browser information, service access timestamps, and error diagnostics.

2. Purpose of Processing

We process collected data strictly for the following purposes:

• User identity verification, authentication, and secure account management.
• Real-time interactive AI tutoring and personalized learning feedback (Gemini via Genkit).
• Tracking curriculum milestones and cryptographic verification of course certificates.
• Delivering critical service notices, curriculum updates, and customer support via email (Gmail SMTP).
• Service performance optimization, error troubleshooting, and defense against abusive traffic.

3. Retention, Backups, and Destruction

We retain personal data only for the duration necessary to provide the Service or comply with statutory requirements:

• Account Deletion: Upon voluntary account deletion or written deletion request, user data is deleted without undue delay, except where statutory retention obligations apply.
• Certificate Verification Ledger: Preserved to guarantee permanent authenticity verification for learners and employers, unless deletion is requested by the recipient.
• Database PITR (Point-in-Time Recovery): Firestore transaction logs are retained for 7 days for disaster recovery and continuously purged.
• Cold Backup Storage (SPEC-BACKUP-001): Encrypted daily snapshots stored in Google Cloud Storage Coldline buckets are permanently purged after a 365-day lifecycle retention period.
• Access & Audit Logs: Access logs are retained up to 30 days; security authentication audit logs are retained up to 90 days.

4. Subprocessors & Data Transfers

We partner with trusted infrastructure providers subject to strict confidentiality and data protection agreements:

• Google Cloud Platform (Google LLC): Multi-region Firestore data storage, Cloud Functions execution, and Google Cloud Storage encrypted backup cold archive.
• Google AI (Google LLC): Gemini models via Genkit for interactive AI tutor explanations and rubric-based quiz evaluation.
• Google Workspace (Gmail SMTP): Transmission of service notifications and verification emails.
• Firebase Hosting / Global CDN: Secure, low-latency edge delivery and TLS 1.3 encryption in transit.
• Upstash Redis: High-performance distributed rate limiting and transient caching (no personal data indexed).

5. Cookies and Local Storage

We use strictly necessary cookies to maintain secure Google OAuth sessions and safeguard against CSRF vulnerabilities. We also utilize browser localStorage for client-side progress caching. Optional analytics and AI tutoring features may process session context to assist learning.

6. Security Measures

We employ industry-standard technical and organizational safeguards: end-to-end TLS 1.3 encryption in transit, AES-256 encryption at rest, least-privilege IAM access policies, multi-region database redundancy (Firestore Paxos consensus), and automated daily backup verification.

7. Your Rights and Contact Information

You hold the right to access, inspect, rectify, or request deletion of your personal data at any time. To exercise these rights, or for inquiries regarding data protection, please contact our Privacy Team: