The short version
- CodeLA is a private learning space for a small, invited study group. We collect only what the site needs to work: your account, your learning progress and the work you choose to submit.
- There are no adverts, no analytics, no tracking pixels and no third-party scripts, fonts or embeds. Your browser talks only to this website.
- We never sell your data or share it with anyone for marketing.
- Project submissions are private to you and staff unless you choose to share them, and you can stop sharing at any time.
- You can download a copy of your data and delete your account yourself, at any time.
Who is responsible
The organiser of CodeLA runs CodeLA and decides how your data is used. In data protection law this makes the organiser the controller of your personal data. To ask anything about this policy, contact the organiser of CodeLA as described on the contact page.
What we collect and why
Everything below is something you type, choose or do on the site. We do not buy data or collect it from anywhere else.
The “legal basis” column uses the terms of the EU and UK GDPR. Where the law requires consent for this kind of processing (for example India’s Digital Personal Data Protection Act), we rely on the consent you give with the separate “I consent to my personal data being processed” box when you ask to join. You can withdraw it at any time by deleting your account; optional details and sharing can be withdrawn on their own, as described under your rights.
Your account
| What | Why | Legal basis |
|---|---|---|
| Username | To sign you in and to show who wrote what. | Needed to provide the service you asked to join (contract) |
| Password | To sign you in. It is stored only as a salted, one-way hash; nobody, including staff, can read it. | Contract |
| Display name, last name (both optional) | Shown to other members instead of your username, if you add them. | Your choice (consent); remove them at any time |
| Email address (optional) | Only so the organiser of CodeLA can contact you about your account, for example about approval or a password reset. Never shown to other members and never used for newsletters or marketing. | Your choice (consent) |
| Age confirmation and agreement record | That you confirmed you are at least 16, agreed to the Terms and consented to the processing described in this Privacy Policy (two separate boxes), and the date, time and version of the policies when you asked to join. | Legitimate interests: being able to show what you agreed to |
| Account dates and status | When you joined, when you last signed in, whether your account is approved or suspended, and whether you are staff. | Contract and legitimate interests (keeping the site secure) |
| Bio and GitHub username (both optional) | Shown on your community profile; the GitHub username becomes a link to your GitHub profile. | Your choice (consent) |
| Dashboard layout | The order you arranged your dashboard cards in. | Contract |
Your learning
| What | Why | Legal basis |
|---|---|---|
| Lesson progress | When you started each lesson, passed its knowledge check and completed it, and where to resume. | Contract |
| Practice and knowledge-check answers | The answer you chose or wrote, whether it was correct, and when. Used to unlock projects and show your progress. | Contract |
| Project submissions | Your GitHub repository or commit links, an uploaded file (with its original file name), pasted code, a demo link, and your written approach, what you learned and what was difficult. Every version is kept so reviewers can see your progress. | Contract |
| Reviews | Feedback and decisions that staff write about your submissions. | Contract |
| Questions, answers and comments | What you post in the community area and on shared submissions. | Contract |
| Activity record | A short entry each time you start a lesson, pass a check, complete a lesson, submit work, have work approved, ask, answer or comment (and, for staff, each review you write). It powers your activity chart and streak and, for public entries, the community feed. | Contract |
| Deadlines | Project deadlines that staff set for you or for the whole group. | Contract |
Please don’t include health information, passwords, API keys or other people’s personal details in your submissions, reflections or posts. The site doesn’t need them.
Technical data
| What | Why | Legal basis |
|---|---|---|
| Session and security cookies | To keep you signed in and protect forms from forgery. Listed in full in the cookie policy. | Strictly necessary; contract and legitimate interests |
| Session record on the server | Links your sign-in cookie to your account. It expires after 14 days or when you sign out. | Contract |
| Web server logs | CodeLA itself keeps no record of the pages you visit. The server or hosting provider that runs it may keep standard request logs (IP address, date and time, page requested, browser type) to keep the service secure and fix faults. What is kept, and for how long, depends on the host; ask the organiser of CodeLA for details. | Legitimate interests (security) |
| Failed sign-in and join-request counts | To slow down password guessing and spam, the site briefly counts failed sign-ins per IP address and per username, and join requests per IP address. The counts are kept in the server’s temporary cache and expire after 15 minutes (sign-in) or one hour (join requests). | Legitimate interests (security) |
| Admin change history | When staff change something in the admin panel, the site records who changed which record and when. This can include your username as the name of the record. | Legitimate interests (accountability) |
What we never collect
- No analytics or visitor statistics, no advertising, no tracking pixels, no fingerprinting and no social-media buttons.
- No location, contacts, camera, microphone or device identifiers.
- No payment details: CodeLA is free (see the refund policy).
- No sign-in with Google, GitHub or other accounts, so those companies learn nothing from you using this site.
- Every font, icon, image and script is served from this website. Nothing is loaded from other companies’ servers.
Because nothing is tracked, the site works the same way whether or not your browser sends a “Do Not Track” or Global Privacy Control signal.
Who can see what
| Who | What they can see |
|---|---|
| Anyone on the internet | Only the public pages: the home page (which lists course stages and lesson counts, never members), these policies and the contact page. Nothing about you. |
| Other signed-in members | Your display name or username, bio and GitHub username; your community profile with the number of lessons you have completed and your public activity (the community page also lists every approved member with that number); the questions, answers and comments you post; and any submission version you chose to share with the community, including its links, uploaded file, pasted code, your notes, its status, the reviews staff wrote about it and its comments. Public activity means starting a lesson, passing a knowledge check, completing a lesson, and asking or answering a question, plus submissions, approvals and comments on submissions that are shared; it appears in the community feed with your name. Group progress pages show counts for the whole group (for example how many members started or completed each lesson, and weekly activity totals) and recent public milestones. In a very small group, other members may be able to work out one person’s progress from these counts. |
| Only you and staff | Submissions you did not share (the default) and their uploaded files and reviews; your practice answers; your detailed progress; your email address; your agreement record. Your day-by-day activity chart is shown only to you. |
| Staff | Staff are people the organiser of CodeLA has chosen to review work and run the group. They can see everything above in the admin panel, so that they can approve accounts, review work and moderate posts. |
Sharing is chosen for each version of a submission and is off by default. When you share a version, the matching entries in the community feed become visible too. You can take it back at any time with the “Stop sharing this version” button on the submission page: the version and its feed entries become private again straight away, although members who already opened or downloaded it may have kept a copy. Moderators can hide questions, answers and comments that break the terms.
Sharing and hosting
We do not sell, rent or trade personal data, and we do not share it for advertising. Under US state privacy laws such as California’s, we do not “sell” or “share” personal information.
The only other organisations that handle your data are the ones that run the site for us, such as the hosting provider whose servers store the database and uploaded files. They act only on the organiser of CodeLA’s instructions (as processors). The organiser of CodeLA will tell you who they are and where their servers are if you ask.
If those servers are in a different country from you, your data is transferred there. Where the GDPR or UK GDPR applies, the organiser of CodeLA must make sure the transfer is protected, for example by choosing a country with an adequacy decision or by using standard contractual clauses.
We may disclose data if the law requires it, for example in response to a valid court order.
How long we keep it
- Your account and everything linked to it are kept for as long as you have an account.
- When you delete your account, your account, profile, agreement record, progress, practice and check answers, submissions (including uploaded files and their reviews), comments, questions, answers and activity are deleted straight away from the live site, deadlines set only for you are deleted, and you are removed from deadlines shared with others. Answers other members wrote to your questions, comments they wrote on your submissions, and the activity entries that point to your questions and submissions (including reviewers’ entries about your work) are deleted with them. If you are staff, reviews you wrote stay with the member they were written for, without your name. The admin change history can still show your username as the name of a record that staff changed.
- Requests to join that are not approved stay until the organiser of CodeLA approves or deletes them. You can ask for yours to be deleted at any time.
- Sign-in sessions expire after 14 days.
- Backups and server logs: if the host keeps backups or logs, deleted data can remain in them until they are replaced in the host’s normal cycle. Ask the organiser of CodeLA how long that is.
Your rights
Depending on where you live (for example under the EU or UK GDPR, or India’s Digital Personal Data Protection Act 2023), you have these rights. Several you can use yourself, straight away:
| Right | How |
|---|---|
| See and get a copy of your data (access and portability) | Download my data gives you a JSON file with your account, profile, agreement record, progress, answers, submissions and their reviews, posts, deadlines and activity. Uploaded files are listed by name; download them from each submission page. For anything else, such as server logs, ask the organiser of CodeLA. |
| Correct your data | Change your name, email, bio and GitHub username on your profile. To change your username, ask the organiser of CodeLA. |
| Delete your data | Delete account removes your account and everything linked to it. You will be asked for your password. |
| Withdraw consent | Remove optional details from your profile, or press “Stop sharing this version” on any submission you shared. Withdrawing consent does not affect what happened before. |
| Object, or ask us to restrict use | contact the organiser of CodeLA as described on the contact page. |
| Nominate someone to act for you (India) | Tell the organiser of CodeLA who should exercise your rights if you die or cannot do so yourself. |
We will reply within one month. We may need to check it is really you, for example by asking you to write from the email address on your account.
If you are unhappy with how your data is handled, please tell us first. You also have the right to complain to a data protection authority, for example the authority in the EU country where you live (listed by the European Data Protection Board), the Information Commissioner’s Office in the UK, or the Data Protection Board of India.
Age limit and children
You must be at least 16 years old to have an account, and you confirm this when you ask to join. We do not knowingly hold data about anyone younger. If we learn that someone under 16 has an account, we will delete it; if you think this has happened, contact the organiser of CodeLA as described on the contact page.
The age at which young people can agree to online services on their own differs by country: between 13 and 16 in the EU, 13 in the UK and the United States, and 18 in India. CodeLA has no way to record a parent’s or guardian’s consent, so if the law where you live requires that consent for someone of your age, please don’t ask to join.
Security
We protect your data with these measures:
- Passwords are stored only as salted hashes, and weak or very common passwords are refused.
- New accounts cannot sign in until the organiser of CodeLA approves them, and every staff action is checked on the server.
- Repeated failed sign-ins and join requests are temporarily blocked.
- Everything except the public pages requires you to be signed in.
- When the site runs in production mode, it requires HTTPS (and tells browsers to keep using it), cookies are only sent over HTTPS, and the sign-in cookie cannot be read by scripts.
- Forms are protected against cross-site request forgery, and pages cannot be framed by other sites.
- Every page sends a strict Content Security Policy, so your browser only runs scripts, and only loads styles, fonts and images, that come from this website. This makes it much harder for injected code to run.
- Uploaded files are limited in size and type, stored under random names outside the public part of the website, never run by the site, and only ever sent as downloads to people allowed to see them.
- No third-party scripts run on any page.
No system is perfectly secure. If a breach is likely to put you at risk, we will tell you, and the authorities where the law requires it, without undue delay.
Automatic marking
Multiple-choice answers are marked automatically. The result decides whether you have passed a lesson’s knowledge check, which unlocks its project and counts towards completing the lesson. You can try again as often as you like, and nothing else depends on it. Project submissions are always reviewed by a person. We do no other profiling or automated decision-making.
Links to other websites
Lessons link to outside resources such as the official Python documentation, and submissions can link to GitHub. CodeLA doesn’t contact those sites on your behalf, and your browser is told not to send them the address of the page you came from. When you follow a link, you leave this site and the other site’s own privacy policy applies.
Changes to this policy
When this policy changes, we update the date at the top of this page. For important changes we will tell members on the dashboard before they take effect. The version you agreed to when you joined is recorded on your account and shown on your profile; the current version is shown at the top of this page.
Questions and complaints
For any privacy question or request, contact the organiser of CodeLA as described on the contact page.