Privacy Policy

Account Information

When you create an account, we collect:

• Registration details: First name, last name, email address, display handle (username), date of birth, and password
• Signup consent record: The date and policy version recorded when you accept our Terms of Service and acknowledge this Privacy Policy
• Google Sign-In: If you sign in with Google, we receive your name, email address, and profile picture from Google. We do not receive or store your Google password.
• Profile information: Optional profile picture you choose to upload

Usage Data

We automatically collect information about how you use the platform:

• Learning progress: Courses enrolled, lessons completed, coding problem attempts and results, recall card interactions, and bookmarks
• Code submissions: When you submit code for grading, your solution is saved to your account so you can review your submission history. Python code is additionally sent to our secure execution service for grading (see Section 3). SQL code executes entirely in your browser.
• Engagement data: Likes, feedback, and feature usage patterns

AI Assistant Interactions

When you use the AI tutoring assistant (LDS Mentor), we collect:

• Messages and learning context: We process your message and the LDS material needed to answer it. Depending on the learning surface, this may include a bounded portion of recent conversation context, the current course, module, section, problem prompt, visible interaction, code, execution output or error, hints already viewed, and quiz or practice attempt state.
• Course Mentor history: When you are signed in, your learner-visible questions, Mentor replies, LDS citation links, and course, module, and page context are stored with your account in our Supabase-hosted course database so your conversations can continue across devices. A bounded browser cache supports continuity and retry. If you paste code or other information into a message, it becomes part of that stored message.
• Excluded from Course Mentor history: We do not add system instructions, retrieved LDS source text, hidden tests, protected answer keys, or automatically captured editor, execution, hint, or quiz snapshots to your saved Course Mentor transcript. That live learning context may still be processed transiently for the current response as described above.
• Structured learning memory: If you choose to save a learning goal, preference, or note, that bounded record is stored separately with your account until you delete it or it expires.
• Coding Mentor records: Coding-problem Mentor sessions and messages are stored with your account so the feature can maintain session history, measure usage, investigate errors, and operate safely.
• Usage and reliability metrics: We record content-free request metadata, token counts, cost estimates, timing, provider status, and safety or error codes to enforce limits, prevent abuse, monitor reliability, and control costs.

Device & Log Data

• Device information: Browser type, operating system, screen resolution, and device identifiers
• Log data: IP address, access timestamps, pages viewed, referring URLs, and session duration

Payment Information

If you subscribe to a paid plan, your payment is processed by Razorpay, our payment processor. Razorpay collects your card number, UPI ID, or other payment details directly. We never receive, store, or have access to your full card number. We only receive:

• Subscription status (active, cancelled, etc.)
• Billing interval (monthly or annual)
• Currency preference (INR or USD)
• Razorpay subscription and payment identifiers

We use the information we collect to:

• Provide, maintain, and improve the platform and its features
• Create and manage your account
• Track your learning progress across courses, coding problems, and recall cards
• Process subscription payments and manage billing
• Send important account-related communications (e.g., subscription confirmations, billing notices)
• Respond to your support requests and feedback
• Monitor usage patterns to improve the learning experience
• Power the AI tutoring assistant (LDS Mentor): your messages and code are processed to generate real-time tutoring responses
• Track AI usage metrics per account to enforce fair-use limits
• Enforce rate limits to prevent abuse and ensure fair access
• Detect, prevent, and address security threats and technical issues
• Comply with legal obligations

We display advertising on parts of the Services to keep content free. Ezoic, Google Ad Manager, and participating advertising partners provide ad delivery, auctioning, measurement, fraud prevention, and personalization where permitted. Ezoic's Gatekeeper consent interface controls consent-dependent advertising and analytics technologies according to the visitor's region and choices. More detail appears in Sections 4 and 5.

We do not use your personal data for automated decision-making that produces legal or similarly significant effects. We do not sell your personal information. If any of these practices change, we will update this policy and notify you in advance.

• SQL execution: SQL queries run directly in your web browser using a built-in database engine. Your SQL code and query results stay on your device and are never transmitted to our servers.
• Python execution: Python code primarily runs in your browser. For certain grading operations, Python code may be sent to our secure execution service for evaluation. Code sent for grading is processed in an isolated sandbox and is not stored after grading is complete.
• Visualization: SQL and Python visualizations are generated entirely in your browser.

AI Tutoring Assistant (LDS Mentor)

When you interact with LDS Mentor, the bounded information described in Section 1 is transmitted to our servers and forwarded to one of our contracted AI infrastructure providers to generate a tutoring response. We may use a fallback provider when the primary service is unavailable. This processing cannot happen entirely in your browser.

• Data minimization: We do not intentionally send your email address, account identifier, subscription status, quota state, hidden tests, server credentials, or protected answer keys to the AI provider.
• Provider use: We use DeepInfra and Google as AI processing providers. We do not publish or expose the model selected for an individual request. For the paid or business API routes we use, provider terms state that API inputs and outputs are not used to train or improve their general-purpose models. Security, abuse-monitoring, reliability, and legal-compliance processing still applies.
• Provider retention: DeepInfra states that standard inference inputs and outputs are held in memory for the request and are not stored on disk, although a small portion of requests may be logged when needed for debugging or security. Google states that prompts, contextual information, and outputs may be retained for up to 55 days for abuse monitoring and may be reviewed by authorized personnel.
• Your responsibility: Do not submit passwords, access keys, financial account details, health information, government identifiers, employer secrets, or other personal, confidential, proprietary, regulated, or security-sensitive information.

We share data only with trusted service providers who help us operate the platform:

We may also share information in the following circumstances:

• Legal requirements: When required by law, court order, or governmental authority
• Safety: To protect the rights, property, or safety of our users or the public
• Business transfers: In connection with a merger, acquisition, or sale of assets, in which case you will be notified
• With your consent: When you explicitly authorize sharing

We use cookies and similar technologies for essential functions, analytics, and advertising. When Ezoic advertising is enabled, Ezoic Gatekeeper is our single visible consent-management platform. It applies the consent flow appropriate to the visitor's region and communicates the resulting choice to participating advertising and analytics vendors.

Essential Technologies

• Authentication: Secure session cookies keep signed-in users authenticated.
• Consent records: The consent platform stores the choices needed to apply and demonstrate your privacy decision.
• Preferences and security: Local settings and protective technologies support site operation and abuse prevention.

Analytics and Advertising

Google Analytics, Ezoic, and participating vendors may process standard device, network, page, and interaction data. Cookies or advertising identifiers are used only when permitted by applicable law and the consent choice recorded by the CMP. If personalized advertising is declined, contextual or non-personalized ads may still appear.

We use Google Consent Mode so Google services receive the applicable consent state. When storage is denied, Google may receive limited cookieless signals for aggregate measurement rather than setting analytics or advertising cookies.

Your Privacy Choices

Use “Cookie preferences” in the footer to change analytics and Google advertising signals at any time. Ezoic's certified consent panel presents the ad-vendor choices required for your region, including an opt-out of sale or sharing where applicable. You may separately control Google ad personalization at adssettings.google.com. Disabling essential technologies may prevent authentication or other core functions from working.

Ezoic Advertising Disclosures

The following disclosure is maintained by Ezoic and lists the advertising partners, processing purposes, and cookies or similar technologies currently associated with Ezoic's services on this site.

To view or request deletion of data held by Ezoic, use Ezoic's Personal Data Protection tool. This data-rights tool is separate from this site's cookie preferences.

We implement appropriate technical and organizational measures to protect your data:

• Encryption in transit: All data is transmitted over HTTPS/TLS
• Encryption at rest: Database data is encrypted at rest using AES-256 encryption
• Password security: Passwords are securely hashed using industry-standard cryptographic algorithms. We never store or have access to plaintext passwords.
• Access controls: Database access policies ensure users can only access their own data
• Rate limiting: API endpoints are protected by rate limiting to prevent abuse
• Payment security: Payment data is processed by Razorpay, which is PCI-DSS Level 1 compliant. We never handle raw card data.

While we take reasonable precautions, no method of transmission over the Internet or electronic storage is 100% secure. We cannot guarantee absolute security.

Regardless of your location, you have the following rights:

For India Residents (DPDP Act, 2023)

We are incorporated in India and process digital personal data in accordance with the Digital Personal Data Protection Act, 2023 (“DPDP Act”). As a Data Principal under the DPDP Act, you have the right to:

• Access: Request a summary of the personal data we process about you and the processing activities we undertake with it
• Correction and erasure: Have inaccurate or incomplete personal data corrected or updated, and have personal data erased when it is no longer necessary for the purpose it was collected (or after you withdraw consent), unless retention is required by law
• Withdraw consent: Withdraw consent at any time through the site's privacy choices, your account settings, or by emailing us
• Grievance redressal: Raise a grievance about how your personal data is handled and have it addressed (see below)
• Nominate: Nominate another individual to exercise these rights on your behalf in the event of death or incapacity

Grievance redressal: To raise a grievance or exercise any DPDP Act right, email us at [email protected] with the subject line “Grievance”. We will acknowledge and respond within a reasonable period, and in any case within 30 days. If you are not satisfied with our response, you may escalate your complaint to the Data Protection Board of India.

For EU/EEA Residents (GDPR)

If you are located in the European Union or European Economic Area, you have additional rights under the General Data Protection Regulation (GDPR), including the right to data portability, the right to restrict processing, and the right to object to processing based on legitimate interests. Our legal basis for processing your data includes: performance of a contract (providing the Services), legitimate interests (improving and securing the platform), and consent (analytics cookies). You may also lodge a complaint with your local data protection authority.

For California Residents (CCPA / CPRA)

Under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (collectively, “CCPA”), California residents have the right to know what personal information is collected, request correction or deletion, limit the use of sensitive personal information, and opt out of the sale or sharing of personal information.

We do not sell personal information for money. Advertising technologies may constitute “sharing” for cross-context behavioral advertising under CPRA. You have the right to opt out of this sharing at any time.

How to opt out of sharing:

• Use the Gatekeeper notice's opt-out control when it is presented in your region.
• Use “Privacy choices” in the footer or email us at [email protected].
• Enable Global Privacy Control in a supported browser or privacy extension.

California residents may also exercise these rights by emailing us at the address in Section 12. We will not discriminate against you for exercising any of these rights.

For Other US State Residents

If you reside in a state with a comprehensive consumer privacy law (including Colorado, Connecticut, Oregon, Texas, Virginia, and others), you have similar rights to access, correct, delete, and opt out of targeted advertising. The Global Privacy Control mechanism described above applies to all such states that recognize it. To exercise state-specific rights, contact us at the address in Section 12.

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days.

• Account data: Retained for as long as your account is active. If you request deletion, we remove or anonymize your personal data within 30 days.
• Learning progress: Retained with your account. Deleted when your account is deleted.
• Payment records: Subscription and transaction records are retained for 7 years after the last transaction to comply with Indian tax and accounting regulations.
• Webhook event logs: Payment webhook events are retained for 1 year for debugging and dispute resolution.
• Course Mentor conversations: Signed-in conversation history is retained with your account until you delete an individual conversation or delete your account, subject to limited backup, security, fraud-prevention, or legal retention. Deleting a conversation removes its messages and descriptive context. To stop an old device from restoring the deleted chat, we may retain a content-free deletion marker containing the conversation identifier, account link, and deletion timestamps until the account is deleted. A bounded browser cache remains until the conversation is deleted, your account history is synchronized, or you clear browser storage.
• Coding Mentor conversations: Session and message records are retained with your account and deleted when your account is deleted, subject to limited backup, security, fraud-prevention, or legal retention.
• Structured learning memory: Retained until you delete it, it expires, or your account is deleted.
• AI provider copies: DeepInfra states that standard inference content is held in memory for the request, with limited logging possible for debugging or security. Google may retain prompts, contextual information, and outputs for up to 55 days for abuse monitoring.
• AI usage metrics: Content-free request, token, cost, timing, and outcome metadata is retained as needed for quota enforcement, billing controls, security, reliability, and legal compliance, then deleted or anonymized under our retention practices.
• Server logs: Automatically purged after 30 days.

Our Services are not intended for children under 13 years of age. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided us with personal data, please contact us at [email protected] and we will promptly delete it.

We ask for a date of birth when an account is created so we can enforce the minimum account age. This information is private, is not displayed to other users, and is used for account eligibility, safety, and legal compliance.

LDS Mentor is currently available only to account holders age 18 or older because age-related requirements apply to the external AI services that power it. We use the stored date of birth to enforce this Mentor-only restriction. Learners age 13 through 17 may continue to use courses, practice tools, and the other features included with their plan.

Our Services are hosted on a global edge network, our database is managed by a cloud infrastructure provider, and AI requests may be processed by providers operating in the United States or other countries. Your data may therefore be transferred to and processed outside your country of residence, including in the United States and India. These countries may have different data protection laws than your jurisdiction.

We ensure that any international data transfers comply with applicable laws and that appropriate safeguards are in place, including our service providers' commitments to data protection standards.

Our free daily News Games can be played as a guest or with an account. When you play signed in, we process additional information to run fair leaderboards and, where offered, monthly prizes.

What we process

For each game attempt we record your account identifier, the game and edition played, your answers and server-computed score, timing derived from our servers (never from your browser), a count of your in-game actions, and whether hints were used. To protect prize integrity, we also derive pseudonymous integrity signals: one-way hashed representations of your device characteristics, network address, and browser user agent, together with automated risk flags (for example, unusually fast or uniform play patterns). We do not store your raw IP address or raw browser fingerprint in our game records. We keep only keyed one-way hashes that cannot be reversed into the original values.

Why we process it

We use this information to compute scores and rankings server-side; to prevent and detect automated play, multiple-account abuse, and other conduct prohibited by the Official Prize Rules; to review prize candidates before any award; and to keep an auditable record of prize decisions. If you rank highly in a prize month, a human reviewer examines your play patterns and the integrity signals above before any prize is awarded, and records an approval or disqualification decision with a reason.

What is public

Leaderboards display only your chosen display name, rank, and aggregate play statistics (such as active days, games completed, and total score). We never publish your email, device, network, or timing details. If you win, we may announce your display name; anything more requires your consent.

Retention and your choices

Game attempts, results, and integrity signals are retained while your account is active and for as long as needed for prize audit and legal compliance. If you delete your account, your data is handled as described in Sections 7 and 8; frozen prize-period records are retained in pseudonymous form as required for contest integrity. You can always play every game as a guest without an account. Guest play is not entered into leaderboards or prizes and is not linked to an account identity.

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email (if you have an account) or by posting a notice on the platform. The "Last updated" date at the top reflects when the policy was most recently revised. We encourage you to review this page periodically.

If you have questions about this Privacy Policy or wish to exercise your data rights, contact us:

This address also serves as our grievance contact under India's Digital Personal Data Protection Act, 2023. We respond to data-rights requests and grievances within 30 days.