Privacy Policy

• Account details. Your email address, and a display name if you set one. Provided by you, or by the sign-in provider you use — Google or GitHub, which tell us your email address, name and avatar and nothing else.
• Course progress. Which steps you have completed and when, which team and role you joined, and where you left off.
• Your evidence ledger. For each step you verify: whether it matched, how many attempts you made, timestamps, and a SHA-256 hash of the output you pasted. We do not store the output itself — terminal output routinely contains internal IP addresses, hostnames and sometimes credentials, so only the hash leaves your browser.
• Verification stamps and receipts (cloud mode). The platform may issue the short-lived stamp you echo into your output and, when the stamp comes back matched, keep a receipt of the course, task, step, the hash and the token counts — never the pasted text. A receipt records the stamp, not your machine.
• Consent grants and outcomes. Which consents you have turned on or off, and when. If you turn on the outcome grant, the answers you give on the account page about where the work took you. Employer names you type are visible only to you; instructors see counts per status, and only when at least five members of a course have answered.
• Links you create. A frozen copy of the export you chose to share, the link’s expiry, and whether you revoked it. The link itself is shown to you once and is stored only as a hash.
• Evidence file records. Filenames, sizes and SHA-256 hashes of files you hash in the app. The files themselves are never uploaded and stay on your machine.
• Deliverables you write. The content of the report forms you fill in.
• Lab access notes. The IP addresses, checklist and free-text notes you enter in the lab-access panel. See the warning below.

Solely to run the product: to show you your progress across devices, to build the evidence record and portfolio that are the point of the platform, and to let teammates see shared team deliverables. We do not sell your data, we do not use it for advertising, and we do not share it with third parties beyond the infrastructure providers below, except as a consent grant you give or a link you create allows. Nothing is used to train models.

Every grant is off until you turn it on from your account page, and each can be turned off there again; revoking stops any future use. The grants are:

• Share with an employer. Lets you create expiring links to a frozen copy of your own export. Without it no link can be created; with it nothing is shared until you create one.
• Benchmark. Lets your numbers be counted, without your name, in cohort bands that other members and instructors see as counts only. Never a rank.
• Outcomes. Lets you answer the outcome questions on your account page and lets instructors see counts per status for a course, only when at least five members have answered.

A link you create shows a frozen copy of the export you chose, exactly as it was when you created the link, to whoever holds the link, until it expires (at most ninety days) or you revoke it from your account page. The copy is unsigned and says so; it never carries your email address or account id. You are the only one who can create or revoke a link.

• Supabase (database and authentication). Every table is protected by row-level security. Your rows are readable only by you, except: team deliverables, team progress, step evidence records and stuck flags are visible to members of your own team; instructors see the class-wide view of evidence, completions, flags and the acceptance log; blind peer reviewers see submitted documents with your identity removed.
• Your browser. If you use the platform without an account, everything stays in local storage on that device and reaches no server at all.

• Export. Download everything your account holds as JSON, at any time, from your account page.
• Deletion. Delete your account and all its data from your account page. This is immediate and cannot be undone.
• Access and correction. The app shows you your data directly; you can edit or remove most of it in place.
• Consent. Every grant is yours to turn on or off from your account page, and every link you created is listed there with a Revoke control.

We set one kind of cookie: the session cookie that keeps you signed in. There are no advertising or third-party tracking cookies. Your theme preference is kept in local storage, not a cookie.

For any privacy question, or to request deletion if the in-app tool does not work for you, contact the site operator using the address published on the site.