Privacy policy

Who we are

Lighthouse Code runs this site ("Lighthouse Code"). For privacy questions, write to hello@example.com and a human will answer.

What we collect

Only these things, and only for the reasons listed:

• Email address — to identify your account, let you log in and reset your password.
• Display name — shown to you in the app. Use a nickname if you prefer.
• Password — stored only as a bcrypt hash. We never see, log or store the password itself, and we cannot recover it for you.
• Learning progress — which lessons you finished, which challenges you passed, XP, streak, badges and your point balance and transactions.
• Messages you send to the AI tutor — your question, and where relevant the lesson you are on and the code in your editor. These are sent to our AI provider to produce an answer, and stored so you can see your own history.
• Payment records — if you buy points, we store the order, amount and status. Card numbers never touch our servers; they go directly to the payment processor.
• Basic technical logs — IP address, browser user agent and timestamps, kept for security, abuse prevention and rate limiting.

What we do not collect

No location tracking, no contacts, no microphone or camera, no cross-site behavioural profiles built by us, and no selling or renting of personal data to anyone, ever.

Cookies

We use a small number of cookies, and we group them honestly:

• Essential — your login session, a CSRF token, your language preference and your cookie choice itself. The site cannot work without these, so they are always set.
• Advertising and analytics — set by Google when advertising is enabled. These are only loaded after you press "Accept all". If you choose "Essential only", the ad scripts are never added to the page.

Who else processes your data

We keep the list of third parties as short as we can. Today it is:

• Our AI provider — receives your question, the current lesson context and any code you chose to attach, in order to generate an answer.
• Google AdSense / Google Ad Manager — serves ads and reward ads, and may set cookies once you accept. See Google's own privacy policy for what they do with that.
• Our payment processor — handles checkout and card data if you buy points, and tells us only that an order succeeded.
• Our hosting and email providers — run the servers and deliver transactional email such as password resets.

Legal bases (GDPR)

• Contract — running your account, saving progress, spending and granting points, delivering purchases.
• Legitimate interests — keeping the service secure, preventing abuse, and basic aggregate usage understanding.
• Consent — advertising and analytics cookies. You give it with the banner and can withdraw it any time via "Manage cookies" in the footer.
• Legal obligation — keeping payment and tax records for as long as the law requires.

Your rights

Wherever you live, you can ask us to show you your data, correct it, or delete it. If you are in the EEA or UK, you also have the rights to restrict or object to processing, to data portability, and to complain to your local data protection authority. If you are in California, you have the rights to know, delete, correct, and to opt out of "sale" or "sharing" of personal information — we do not sell or share it, and choosing "Essential only" also opts you out of personalised advertising here.

To exercise any of this, email hello@example.com from the address on your account. We answer within 30 days. We will never charge you for it and never make the service worse because you asked.

How long we keep things

• Account and learning data — while your account exists, then deleted within 30 days of a deletion request.
• AI conversations — kept so you can review them; deleted with your account.
• Password reset tokens — 60 minutes, then invalid; the row is cleaned up afterwards.
• Payment records — kept as long as accounting and tax law requires, even after account deletion.
• Technical logs — a short rolling window, typically weeks, not years.

Deleting your account

Email hello@example.com with the subject "Delete my account". We will confirm, then remove your account, progress, AI conversations and point balance. Unused points have no cash value and are not refundable on deletion.

Children

This site is not directed at children under 13 (or under 16 in the EEA, where local law says so). If you believe a child has created an account, tell us and we will delete it.

International transfers

Our servers and some processors are located outside your country, including in the United States. Where required, transfers rely on the European Commission's standard contractual clauses.

Changes

If we change this policy in a way that matters, we will update the date at the top and, for significant changes, tell you in the app. Continuing to use the site after that means you accept the new version.