Privacy notice

• ·Your account — you sign in with GitHub, so we store your GitHub numeric id, your login, and your avatar URL. There is no password for us to hold. We ask GitHub for no permissions beyond your public profile: we never receive your email, your private repositories, or the ability to act on your behalf. The access token from signing in is used once and never stored.
• ·Your progress — which challenges you enrolled in, which language you picked, and which stages you have passed.
• ·Test runs — a record of each job you start and the log output its tests produced, so you can read the results. The logs are produced on our machines, by your code, and can contain fragments of it or of its output.
• ·Your code— we host a private git repo for each challenge you start, and store what you push to it or save from the browser editor. When a stage passes we also keep a snapshot of that stage's source so you can browse your own solutions later. It is visible only to you, and you can delete it.
• ·Your access token — a secret that authenticates your git pushes. You can rotate it at any time.
• ·Your access pass — which plan you bought and when it expires.
• ·Server logs — ordinary request logs including IP address and timestamps, kept briefly for security and debugging.

Pressing Run sends the code in your project repo to a machine we operate, which compiles it and runs the challenge's tests against it. That is worth stating plainly: your code is executed on our hardware, not only stored there.

Each run happens in a container that is created for it and destroyed afterwards. The container has no network access at all, and nothing it writes is shared with any other run or any other person. What we keep afterwards is the verdict and the log, not the working files.

Runtime Lab sets exactly one cookie: a session cookie that keeps you signed in after you log in. It holds an opaque session identifier — no personal data is encoded in it. It is HTTP-only, so scripts cannot read it, and it is sent only to this site.

There are no advertising cookies, no analytics cookies, and no third-party cookies. Logging out, or clearing your browser's cookies, removes it.

Your card details never touch our servers. Payments are handled by a third-party payment processor on its own hosted checkout page.

When you buy a pass, the processor receives and holds:

• ·your payment details — card or equivalent — which it processes as an independent data controller under its own privacy policy;
• ·your billing name, email address, and the country or address needed to calculate tax;
• ·the amount, currency, and which pass you bought.

What comes back to us is only: which plan was bought, whether the payment succeeded, an opaque transaction reference for reconciliation and refunds, and the email address you gave at checkout so we can send a receipt and answer support questions. We keep those payment records as long as tax and accounting law requires, which is typically several years, even if you later delete your account.

While checkout is handled manually, there is no processor in the loop at all — you email us, and we activate the pass by hand.

Nobody. We do not sell, rent, or share your data with third parties, and there are no trackers embedded in the app. The only external party involved is the payment processor described above, and only when you buy a pass. We use a hosting provider to run the servers, which necessarily stores the data on its infrastructure on our behalf. We will disclose data if a valid legal order compels us to.

Account and progress data is kept while your account exists. Job logs are kept so you can review past runs, and are pruned over time. Server logs are kept briefly. Payment records are kept for the period tax law requires.

You can abandon any challenge from its page, which deletes that enrollment and its progress. You can rotate your access token whenever you like.

To delete your account entirely, email [email protected] from an address you can be reached at, or ask from within the app. We will remove your account, enrollments, progress, job logs, and any git repositories we host for you, normally within 30 days. Payment records are retained where the law requires, stripped of anything not needed for accounting.

You can also ask us for a copy of the data we hold about you, or to correct it. Depending on where you live you may have further rights — including to object to processing or to complain to your local data protection authority — and we will honour those requests regardless of where you are. Deleting your account does not automatically refund an active pass; see the refund policy.

We hold no passwords — GitHub handles sign-in. Session tokens are stored hashed, so a database dump cannot be replayed as live sessions; sessions are opaque and HTTP-only, and traffic is served over HTTPS. No system is perfectly secure; if we ever discover a breach affecting your data, we will tell you promptly and plainly.

If this notice changes, the date at the top changes with it, and anything material will be announced in the app. Questions about privacy go to [email protected].