Legal
Privacy Policy
Last updated 15 September 2026
We do not sell your personal data, and we never will. There is no advertising and no analytics on this site. Without an account we collect nothing about you. With one, we hold your email, your name and a record of what you have completed, so your work is not lost. The code you write never leaves your browser.
Information We Collect
Almost nothing, and nothing at all unless you choose to create an account.
Without an account. You can read every lesson, run code, take practice tests and build projects without telling us who you are. Your progress is written to your own browser's local storage and stays on that device. We never receive it.
With an account. Creating one stores three things: the email address you sign up with, the display name you choose, and your password, which is hashed by our authentication provider and is never visible to us in readable form. Alongside that we store your learning record, described under Learning Data below.
If you contribute financially. Payments are handled entirely by Stripe on Stripe's own pages. Our server sends Stripe an amount and whether the contribution is one time or monthly. That is all it sends. Card numbers, billing addresses and names never touch our servers and we never see them.
Server logs. Our host records standard web server requests, which include IP addresses, for the operational and security reasons every web server does. We do not build profiles from them and do not combine them with your account.
How We Use Information
For one purpose: so your work is not lost. Your email identifies your account and lets us send a password reset. Your name appears on your certificate and in the interface. Your learning record restores your progress on any device you sign in to.
That is the complete list. We do not use your information for advertising, we do not profile you, we do not score you, and we do not share it with anyone for their own purposes.
We do not sell your personal data. Not to advertisers, not to data brokers, not to recruiters, not to anyone, and not in any form, aggregated or otherwise. There is no future version of this platform where that changes. If Sankofa Code ever could not continue, the answer would be to delete the data, not to sell it.
There is no advertising on this site and no analytics of any kind. We do not measure how long you spend on a page, where you came from, or what you click. We removed the one performance measurement tool this site previously used, because keeping it would have contradicted this paragraph.
Learning Data
Your learning record is the progress the platform keeps so the work follows you. It holds which lessons you have completed and when, your best score on each practice test, which project steps and daily challenges you have finished, your final exam result if you have taken it, the name and issue date on your certificate if you have earned one, the days you were active so a streak can be counted, and the last lesson you were on.
It does not contain anything you wrote. It is a record of completion, not of work.
Without an account this record exists only in your browser. Clearing your browser data erases it, and we have no copy. With an account it is stored against your user identifier so it can be restored when you sign in elsewhere.
Teachers using the classroom view can keep private notes on their cohorts. Those notes are stored only in the teacher's own browser and are never sent to us.
User Content
The code you write is never sent to us. Every exercise, challenge and project in this curriculum runs inside your own browser. JavaScript and TypeScript run in your browser's engine, Python runs in a WebAssembly build of Python, SQL runs against a database that exists only in the page, and React previews render in a sandboxed frame. Your code is not transmitted, not logged, and not stored on any server we control.
Grading works the same way. When a check runs against your code, it runs on your machine. We receive the outcome only as a completion marker in your learning record, and only if you have an account.
What you build is yours. See the Terms for the plain statement of that: you build it, you own it.
Third-Party Services
Four companies are involved in running this site. None of them is an advertiser or a data broker.
- Vercel hosts the site. They handle the request when you load a page and keep standard server logs.
- Supabase provides accounts and stores the learning record for signed-in learners. If you never create an account, Supabase holds nothing about you.
- Stripe processes voluntary contributions on their own pages, and only if you choose to make one.
- jsDelivr, a public open-source code delivery network, serves some of the software the lessons run on, including the Python runtime, the TypeScript compiler, React and the code editor. Loading a file from any network means that network sees your IP address and browser, which is true of every site that loads a library this way. We send them nothing about you beyond the request for the file itself.
We do not use Google Analytics, Meta pixels, advertising networks, session recording, heatmaps, or any similar tool. The fonts on this site are served from our own domain rather than from a font provider, so no third party is notified when you read a page.
Children's Privacy
Accounts are for people aged 13 and over. We do not knowingly create accounts for children under 13, and we do not knowingly collect personal information from them.
Children under 13 can still use this curriculum. Every lesson, exercise and project works without an account, and using the platform that way transmits no personal information at all. Their progress stays in the browser on the device they are using.
If you believe a child under 13 has created an account, email us and we will delete it and everything attached to it. We will not ask for proof beyond what is needed to find the account.
Schools and teachers: the classroom view is designed to work without collecting anything about individual children. If your district requires a signed agreement before using an online tool, write to us and we will work through it with you.
Data Retention
We keep your account and learning record for as long as your account exists, because the entire purpose of the record is that it is still there when you come back after a long gap. We do not expire accounts for inactivity, and we do not delete unfinished work to save space.
When you ask us to delete your account, we delete the account and the learning record attached to it. Backups held by our providers roll off on their own schedule, within 30 days.
Server logs are kept only as long as our host keeps them for operational purposes.
Security
Everything is served over HTTPS. Passwords are hashed by our authentication provider and we never store or see them in readable form. Access to the learning record is enforced at the database level by row level security, so one learner's row cannot be read by another learner even if the application had a bug.
Our payment secret key exists only on the server and never reaches the browser, which is why contributions are started by a server route rather than in the page.
A fuller description, and how to report a vulnerability you find, is on the Security page.
No system is perfect and it would be dishonest to claim otherwise. If a breach ever affected your information, we would tell you what happened, what was exposed and what to do, and we would tell you promptly rather than quietly.
Your Privacy Rights
Wherever you live, you can ask us for a copy of everything we hold about you, ask us to correct it, or ask us to delete it. We will not charge you, we will not make you create a support ticket, and we will not ask why.
If you are in the European Economic Area or the United Kingdom, this covers your rights of access, rectification, erasure, restriction, portability and objection under the GDPR. If you are in California, it covers your rights to know, delete, correct and to opt out of sale or sharing under the CCPA as amended. The opt out is already the permanent state of this platform: there is nothing to opt out of, because we neither sell nor share personal information.
We will not discriminate against you for exercising any of these rights. There is no paid tier to lose.
Email us and a person will answer. We aim to respond within 30 days and usually much sooner.
Account Deletion
Email us from the address on the account, or from any address if you tell us which account you mean, and ask for it to be deleted. We will delete the account and the learning record attached to it, and confirm when it is done.
There is no self-service delete button in the interface yet. Building one is on the list. Until it exists, a person will do it for you, which we would rather admit than pretend.
If you only want to clear the progress held on your own device, clearing your browser's site data for this site removes it immediately and completely, with no involvement from us.
Changes to This Policy
If this policy changes, the date at the top changes with it. Changes that affect what we collect or who we share it with will be described here rather than absorbed quietly into the text.
The commitment not to sell your personal data is not subject to change.
Contact
Privacy questions, a request for your data, a deletion request, or a correction to this page go to hello@sankofacode.org. There is one person here and they answer their own mail.
Questions about this policy go to hello@sankofacode.org. Every message gets a personal reply.
All policies