← back to LevelJar

Privacy policy

Last updated 20 September 2026

In short

You can use LevelJar without an account, in which case your progress stays in your browser and we store nothing about you. If you create one, your email address, your progress and the code you write are stored on a server run for us by Supabase, so that your work follows you from device to device, and the operator can see them. There are no analytics, no advertising and no cookies. The site's fonts and the Python it runs are served from this site itself; the only other server your browser talks to is the one that holds your account and your progress.

Who is responsible

The operator named in the legal notice is the controller under the General Data Protection Regulation (GDPR).

What is stored, and where

Your account

Anyone can create an account with an email address and a password. We send one email to that address with a link confirming it, and the account cannot be used until the link is clicked, so that nobody can sign up with an address that is not theirs. An account holds your email address and your password. The password is stored only in a form from which it cannot be read back, not even by the operator.

Which addresses can create an account

When an account is created, the part of the address after the @ is checked against a list of domains we do not accept, mostly throwaway and disposable mailbox providers. If the domain is on that list, no account is created and the form says so. Nothing about a refused attempt is stored: no address, no domain, no time, no IP. The check happens in our database at the moment of signing up and leaves no record.

Your progress and your code

For each exercise you have opened, LevelJar stores under your account: whether you have passed it, how many times you have run the checks, when you last passed it and when it is next due for review, the code you have written, including code you are still working on, and, in exercises that come with files, the files you have added or changed, with the time of the last change and a random identifier for that version, which tells LevelJar when a change made on another device is about to be replaced. Your browser sends this to the server when you open LevelJar, when you pass an exercise, and when you leave or come back to its tab or window.

The operator can see all of it. The operator administers the database and can read your email address, your learning progress, and all the code and files you have submitted. The operator uses them to run the site and to see how learners are getting on. Other learners cannot see them: the database lets each account read and change only its own records.

Supabase, who stores it for us

Accounts and progress are stored by Supabase Pte. Ltd, 65 Chulia Street #38-02/03, OCBC Centre, Singapore 049513, privacy contact privacy@supabase.io, which processes them on our behalf as our processor (Art. 28 GDPR). Their data processing agreement forms part of their terms of service: accepting those terms has the same effect as signing it, so there is no separately signed document.

The data is stored in Supabase's Central EU region (Frankfurt, eu-central-1) and is primarily processed there. Supabase itself is based in Singapore, outside the European Economic Area, and may access the data from outside the EU. That access is covered by the EU Standard Contractual Clauses, Module Two (controller to processor), which their data processing agreement incorporates.

Your browser connects to Supabase's servers directly, so they also receive your IP address and your browser's name and version with each request. Supabase states in its data processing agreement that it keeps audit logs and traffic flow logs, but gives no retention period for them, and we cannot state one we have not been given.

Without an account

If you choose "Try without an account", nothing about you reaches our server. Your progress and your code are written to your browser's local storage under the name leveljar.progress.v1 and stay on that device. This storage is strictly necessary for the service you asked for, so it needs no consent under § 25 (2) TDDDG. Clearing this site's data in your browser removes it, and so does using a different browser or device. If you later create an account or sign in, what is in that storage is merged into your account and the local copy is cleared.

In your browser

Storing and reading these on your device is strictly necessary to provide what you use the site for, so it needs no consent under § 25 (2) no. 2 TDDDG.

Email about your account

Confirming your address and resetting your password mean sending you an email. Those emails are delivered by Resend, named in full under the contact form below, sending from noreply@leveljar.com. Mail for this domain is sent from Resend's European region in Ireland, although Resend is a company in the United States, so access from there cannot be ruled out; the transfer rests on standard contractual clauses under their terms. Resend receives your email address and the text of those messages. This is necessary to give you an account (Art. 6 (1) (b) GDPR).

We process your account, your progress and your code because that is necessary to provide the service you have an account for (Art. 6 (1) (b) GDPR). Looking at your progress and code to see how learners are getting on is based on our legitimate interest in running the course (Art. 6 (1) (f) GDPR); you can object to it (Art. 21 GDPR). Supabase's request logs serve the security and operation of the service, which is our legitimate interest (Art. 6 (1) (f) GDPR).

How long it is kept

Your account, your progress and your code are kept for as long as your account exists. When the account is deleted, everything stored under it on the server is deleted with it. The plan this project runs on includes no database backups, so deleted data cannot be restored from a backup afterwards.

Deleting your data

You can delete your account yourself: open the account menu in the app and choose "Delete account". Your account, your progress and your code are removed from the server straight away, and this cannot be undone, since the plan this project runs on keeps no backups. Messages you have sent through the contact form are not deleted with it, because they are kept for the separate purpose described below. You can also write to the operator using the contact details in the legal notice, from the address the account uses, and we delete it without undue delay and within one month at the latest (Art. 12 (3) GDPR). The copy in your browser goes when you sign out, or at any time by clearing this site's data in your browser's settings.

If you write to us through the contact form

The contact form is open to anyone, with or without an account. It is a separate purpose from running the course, so it is described separately here.

What is stored: the name, email address and message you type, the time you sent it, your browser's name and version, and a one-way fingerprint of your IP address. The fingerprint exists only to stop the form being used for floods of mail; it cannot be turned back into your address, and it is erased within 24 hours. The message itself is stored in the same database as accounts and progress, where only the operator can read it, and is also sent to the operator by email.

Legal basis: answering an enquiry you chose to send is our legitimate interest and yours (Art. 6 (1) (f) GDPR); if your message is about a contract or a possible one, Art. 6 (1) (b) GDPR applies instead. You are not obliged to use the form: the legal notice gives an email address that reaches the same person.

How long it is kept: until the exchange is finished and then no longer than needed to understand it later, and in any case no longer than 12 months, after which the message is deleted. You can ask for your message to be deleted sooner, and it will be.

Who sends the email: Plus Five Five, Inc., trading as Resend, 2261 Market Street #5039, San Francisco, CA 94114, USA, privacy contact privacy@resend.com, which delivers the notification to the operator's mailbox and is our processor for that (Art. 28 GDPR). Their data processing addendum forms part of their terms of service rather than being signed separately. Delivery takes place in the United States. Resend states that it is certified under the EU-U.S. Data Privacy Framework, and its addendum also incorporates the EU Standard Contractual Clauses (Commission Decision 2021/914), which apply if the Framework ceases to. No confirmation email is sent to you, so the address you type is never used to send you anything unless the operator writes back.

What LevelJar does not do

Hosting

This site is hosted by Render Services, Inc., 525 Brannan St, San Francisco, CA 94131, USA, privacy contact privacy@render.com. Like any web server, the host's servers receive the technical information your browser sends when it requests a page: your IP address, the date and time, the address of the file requested, and your browser's name and version. This is needed to deliver the site to you and to keep it secure, which is our legitimate interest under Art. 6 (1) (f) GDPR. We do not combine it with any other data, and we do not use it to identify visitors.

Render processes this as our processor (Art. 28 GDPR). Their data processing agreement forms part of their terms of service rather than being signed separately. Render does not state a period for which these server logs are kept: their agreement says usage data is processed for as long as it is needed to provide the service.

Processing takes place primarily in the United States. That transfer is covered by the EU-U.S. Data Privacy Framework, and by the EU Standard Contractual Clauses should the Framework cease to apply, both set out in Render's data processing agreement.

Your rights

Under the GDPR you have the right to access the personal data held about you (Art. 15), to have it corrected (Art. 16) or erased (Art. 17), to restrict its processing (Art. 18), to data portability (Art. 20), and to object to processing based on legitimate interests (Art. 21). To exercise any of these, contact the operator using the details in the legal notice.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). Ours is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen, Kavalleriestraße 2-4, 40213 Düsseldorf. You may also complain to the supervisory authority in the country where you live.

Changes

If LevelJar starts storing or processing anything new, this policy will be updated before that happens, and the date at the top will change.