Privacy and security

What we store

Your profile

Name, email and avatar from GitHub or Google. We never see or store a password.

Course progress

Which weeks you completed and when.

Quiz attempts

Your answers, score and time for each attempt, so you can see your best score.

Project work

Your requirement checklist, repo link, live link, notes, and the grade and feedback from your reviewer.

We don't sell data, show ads or use tracking cookies. Your reviewer sees your name, email, links and notes for the projects you submit. Nobody else sees your progress.

How it's protected

• Sign-in through GitHub or Google

  OAuth means your password stays with them. Sessions are signed, HttpOnly, Secure cookies that JavaScript on the page can't read.

• Every action is checked on the server

  Quizzes, checklists, submissions and reviews run as server actions that confirm who you are first. Your user id comes from the signed session, never from the browser, so you can only change your own records.

• Reviewers are an allowlist

  Only email addresses the site owner lists can open the review dashboard. Everyone else gets a not-found page.

• Quizzes are graded on the server

  The page only receives questions and options. Correct answers and explanations come back after you submit.

• Input is validated

  Links must be a real GitHub repo and an https site, notes and feedback have length limits, and every value is checked against the course content.

• Abuse limits

  At most 10 quiz attempts per lesson per hour, and a short cool-down between project resubmissions.

• Browser protections

  A strict Content Security Policy, HSTS, no framing (clickjacking protection), no MIME sniffing, and a limited referrer.

• Database

  Postgres on Neon, encrypted in transit and at rest. Queries are parameterised by the ORM, so input can't change SQL. Schema changes ship as reviewed migrations.

• Secrets

  API keys and database credentials live only in server environment variables, never in the code or the browser.