Privacy Policy
- Last updated
- 3 October 2026
- Applies to
- Visitors and account holders
- Questions
- Please write to us.
The short version. You can use the whole site without an account, and then we collect nothing about you. If you create an account, we keep your email address and your learning progress — and nothing else. No ads, no analytics, no tracking, and we never sell or share your information.
#1. Who is responsible for your information
Sulba, an independent studio based in Toronto, Ontario, Canada, decides how the information described here is used and is responsible for it (the “controller”). You can reach us any time: please write to us.
#2. If you just visit
We collect nothing about you. The site has no analytics, no advertising, no tracking pixels and no social-media plugins, and its fonts are served from the site itself rather than from a third party.
The site is hosted on Cloudflare Pages, run by Cloudflare, Inc. Like any web host, Cloudflare receives the technical details every browser sends when it asks for a page — such as your IP address — and uses them to deliver the site and protect it from attacks. We do not see or receive that information. See Cloudflare’s Privacy Policy.
Your browser also keeps a few small things on your own device so the site works — your progress, the code language you chose. These never leave your device unless you sign in. The Cookies & Storage page lists every one.
If you write to us through the site’s form, we receive what you put in it — your name if you give it, your email address and your message — and the address of the page you wrote from. A short step on Cloudflare’s network receives it, runs the same security check described below, and hands it to Resend, which delivers it to our mailbox as an email we can answer. We use it only to answer you, and we keep it as long as that takes.
#3. If you create an account
An account is optional. If you create one, this is everything we hold:
| What | Where it comes from | Why we need it |
|---|---|---|
| Your email address | You, or Google or GitHub when you sign in with them | To sign you in and identify your account |
| Your name and profile picture address | Google or GitHub, only if you sign in with them | Sent to us by them automatically; we do not display or use it |
| An account ID, and when the account was created and last signed in | Created when you first sign in | To run your account |
| Technical sign-in records: IP address, browser type, time | Your browser, when you sign in | Security: to detect and stop abuse |
| Your progress: which problems and lessons you opened and when, which you marked understood, and the last one you had open | You, as you learn | To keep your progress the same on every device |
| The days you studied | You, as you learn | To show your streak |
| Which version of the Terms and this policy you agreed to, and when | You, when you sign in | To keep a record of your agreement |
If you ask for a sign-in link by email, or write to us through the site’s form, a security check — Cloudflare Turnstile — runs in your browser first, to stop automated abuse such as bots sending sign-in emails to strangers or flooding us with messages. It sends Cloudflare technical information about your browser and device, such as your IP address, and usually passes without asking you anything. We, and Supabase for a sign-in, receive only whether it passed. Signing in with Google or GitHub does not use it.
We do not ask for, and do not hold, a password, your phone number, your location, payment details, or anything else. We do not use your information to make automated decisions about you, to profile you, or to show you ads.
#4. Our legal basis
- To provide your account (signing in, keeping your progress): because you asked for it — to perform our agreement with you, and with your consent, which you give when you sign up.
- To keep the Service secure (sign-in records, and the security check before a sign-in email): our legitimate interest in protecting the Service and its users.
- To keep a record of your agreement: our legitimate interest, and to meet legal obligations.
- To answer you when you write to us: because you asked us to — our legitimate interest in answering, and your request.
In Canada we rely on your consent, given when you create an account; you can withdraw it at any time by deleting your account.
#5. Who processes it for us
We use a small number of service providers. Each processes your information only to provide its service to us, under its own data-protection terms:
| Provider | What it does | Where |
|---|---|---|
| Supabase, Inc. | Runs sign-in, sends sign-in emails, and stores your account and progress | United States (Amazon Web Services, us-east-1) |
| GitHub, Inc. | Runs “Continue with GitHub”, if you use it | United States |
| Google LLC | Runs “Continue with Google”, if you use it | United States and elsewhere |
| Cloudflare, Inc. | Hosts the website; runs the security check (Turnstile) before a sign-in email or a message to us is sent, and the short step that receives your message and hands it to Resend | Cloudflare’s global network |
| Resend, Inc. | Delivers the messages you send us through the site’s form to our mailbox | United States |
We do not sell your personal information, and we do not share it for advertising. We would disclose it only if the law required us to, or to protect the rights, safety or property of our users, the public or ourselves.
#6. International transfers
Your account information is stored in the United States. Where the law where you live requires it (for example, in the European Economic Area, the United Kingdom or Switzerland), transfers are protected by our providers’ standard contractual clauses or an equivalent safeguard. Information stored outside Canada may be accessible to the courts and authorities of the country where it is kept.
#7. How long we keep it
- Your account and progress: until you delete your account. Deleting it removes your account and all of your progress from our database at once.
- Technical sign-in records: kept by Supabase for a limited time for security, then deleted on its schedule.
- If you write to us: as long as needed to answer you.
- We may delete accounts that have been unused for a long time.
#8. How we protect it
- Every connection to the site and to our database is encrypted (HTTPS).
- The database lets each account read and change only its own rows; this is enforced by the database itself, not just by the website.
- There are no passwords to leak: you sign in with a single-use email link, or through Google or GitHub.
- No method of storing or sending information is perfectly secure, so we cannot guarantee absolute security — but if we ever learn of a breach that puts you at real risk, we will tell you and the authorities as the law requires.
#9. Your rights
Depending on where you live, you have the right to:
- Access the information we hold about you, and get a copy of it in a portable form;
- Correct it if it is wrong;
- Delete it — you can do this yourself at any time with “Delete account” on the account card;
- Withdraw consent, object to or restrict our use of it;
- Complain to a data-protection authority — in Canada, the Office of the Privacy Commissioner of Canada; in the EU or UK, your local authority.
To use any of these rights, please write to us. We will answer within 30 days, and we will never charge you or treat you differently for asking. If you live in California or another US state with a privacy law: we do not sell or share personal information, or use it for targeted advertising, and these rights apply to you too.
Do Not Track and Global Privacy Control
We do not track you across sites or sell your information, so there is nothing for these signals to switch off; we honour them by default.
#10. Children
The Service can be used by anyone without an account. Accounts are for people aged 13 and over, with a parent’s or guardian’s permission where the law requires it (see the Terms). We do not knowingly collect personal information from children under 13. If you believe a child under 13 has created an account, please write to us and we will delete it.
#11. Changes to this policy
If we change what we collect or how we use it, we will update this policy and the date at the top, and account holders will be asked to agree to the new version the next time they sign in.
#12. Contact
For anything about your privacy, please write to us. Sulba, Toronto, Ontario, Canada.