Privacy Policy

1. Who we are

QuestCode (“we,” “our,” or “us”) is an online learning platform at questcode.app. We provide interactive coding challenges themed around popular TV shows and films to help people learn programming languages including Python, JavaScript, Java, SQL, and Go.

2. Information we collect

2.1 Information you provide

• Email address — required to create an account and log in.
• Password — stored as a secure hash via Supabase Auth. We never see your plain-text password.
• Payment information — if you subscribe to a paid plan, your card details are handled exclusively by Stripe. QuestCode does not store or have access to your full card number, CVV, or expiration date.
• Access codes — if you use a beta or promotional access code to create an account, we log that the code was used.

2.2 Information collected automatically

• Challenge progress — which challenges you have completed, your selected theme, and your selected language.
• Usage data — pages visited, time spent, and general interaction patterns within the app. This is collected in aggregate to help us improve the product.
• Device and browser information — basic technical data (browser type, operating system, viewport size) used for debugging and compatibility.
• IP address — logged by our infrastructure for security and abuse prevention. Not used for advertising or tracking.

2.3 Cookies and local storage

We use session cookies to keep you logged in. Supabase Auth sets an authentication token in your browser's local storage. We do not use third-party advertising cookies or cross-site trackers.

3. How we use your information

• To create and manage your account.
• To save your progress and preferences across sessions.
• To process subscription payments via Stripe.
• To send transactional emails (account creation confirmation, password reset). We do not send marketing emails without explicit opt-in.
• To improve QuestCode — understanding which challenges are most completed, where users get stuck, and which features are most used.
• To detect and prevent fraud, abuse, and security vulnerabilities.

4. How we share your information

We do not sell, rent, or trade your personal information to third parties. We share data only in the following limited circumstances:

• Supabase — our authentication and database provider. Your email, hashed password, and progress data are stored on Supabase infrastructure. Supabase is GDPR-compliant.
• Stripe — our payment processor. Stripe handles all payment card data under PCI DSS compliance. We receive only a customer ID and subscription status from Stripe.
• Vercel — our hosting provider. Vercel processes requests to our servers and may log IP addresses and request metadata.
• Legal requirements — we may disclose information if required to do so by law, court order, or governmental authority.

5. Data retention

We retain your account data for as long as your account is active. If you delete your account, we will delete your personal information within 30 days, except where retention is required by law (e.g., payment records for tax purposes, which are retained for 7 years in accordance with applicable regulations).

Aggregated, anonymised usage data (with no link to individual users) may be retained indefinitely for product analytics.

6. Your rights

Depending on where you are located, you may have the following rights:

• Access — request a copy of the personal data we hold about you.
• Correction — ask us to correct inaccurate or incomplete data.
• Deletion — request that we delete your account and associated personal data.
• Portability — request your data in a structured, machine-readable format.
• Objection — object to certain types of processing, including profiling.
• Withdrawal of consent — where processing is based on consent, you may withdraw it at any time.

To exercise any of these rights, email us at privacy@questcode.app. We will respond within 30 days.

7. Children's privacy

QuestCode is not directed at children under 13 years of age. We do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, please contact us and we will delete it promptly.

8. Security

We take reasonable technical and organisational measures to protect your personal data, including TLS encryption in transit, secure password hashing, and environment variable management for secret keys. However, no method of transmission over the internet is 100% secure. We encourage you to use a strong, unique password for your QuestCode account.

9. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will update the “Last updated” date at the top of this page. For material changes, we will notify you by email (if you have an account) or by posting a notice on the site. Your continued use of QuestCode after changes take effect constitutes acceptance of the updated policy.

10. Contact

Questions about this Privacy Policy? We're happy to help.