Privacy Policy

• Your email address, and a display name and username you choose.
• If you sign in with Google: your Google account identifier, email, name and profile picture. We never receive your Google password.
• Code you submit, the results of running it, and your solving history.
• Support tickets you raise, including any file you attach.
• Basic technical information needed to operate the service, such as sign-in times.

We do not collect card details. Payments are handled by Razorpay, and card data goes to them directly and never passes through our servers.

• To run your code and show you the result.
• To keep you signed in and protect your account.
• To track your progress, streaks and position on the leaderboard.
• To answer support tickets.
• To send email you have asked for, and the transactional email an account needs, such as password resets and sign-in codes.

Daily practice reminders and the weekly progress report are part of Pro, and are off until you turn them on in your settings. Product updates are controlled there too. Transactional email goes to every account, free or Pro, and cannot be turned off while you have one, because it is what keeps the account usable and secure: address confirmation, password resets, sign-in codes and replies to your support tickets.

We share data only with the services needed to run CodexBash:

• Razorpay, to take payments.
• Our email provider, to deliver messages to you.
• Google, if you choose to sign in with Google.
• Our hosting and database providers, who store the data on our behalf.
• Google AdSense, which shows the ads on free accounts. See Advertising below.

We do not sell personal data. We never send Google your email address, the code you submit or your solving history.

Free accounts and visitors see ads, served by Google AdSense. That is what pays for the site staying free. Google may use cookies and device identifiers, and your approximate location, to choose ads and measure them, under its own policy on how it uses data from sites that use its services.

You can change how ads are personalised in your Google ad settings. Pro removes ads entirely, along with the advertising cookies that come with them. Visitors in the European Economic Area, the United Kingdom and Switzerland are asked for consent before any advertising cookie is set.

We keep your account data while your account exists. Delete your account and we remove your personal data within thirty days, except where we must keep records for legal or accounting reasons, such as payment records.

• Ask for a copy of the data we hold about you.
• Ask us to correct anything that is wrong.
• Ask us to delete your account and its data.
• Withdraw consent for optional email at any time, in your settings.

Raise any of these through the help centre and we will action it.

Passwords are stored hashed, never in a readable form. Session tokens are kept in cookies the page cannot read, so a scripting flaw cannot steal them. Two factor sign-in and passkeys are available in your settings. Submitted code runs in an isolated container with no network access.

Our own cookies only keep you signed in and remember your theme: cb_at and cb_rt hold your session, cb_sess and cb_resumed let a session be picked back up after the access cookie expires, and none of them can be read by the page.

Free accounts and visitors also get advertising cookies, set by Google on its own domains rather than by us, as described under Advertising. Pro accounts get none.

Under India's Digital Personal Data Protection Act you may raise a grievance about how your data is handled. Raise it through the contact form, which works whether or not you can sign in, with the category set to Account, and it reaches the person responsible for data protection. We acknowledge within two working days.