Last updated 10 September 2026

Privacy policy

Pythonaut is run by Coralia Digital, a sole trader based in the United Kingdom. This explains what we collect, why, and what you can do about it. We have tried to write it so it can actually be read.

The short version

• You can use the free tier without an account and without giving us anything.
• If you make an account we hold your email address and your learning progress. Nothing else.
• We do not sell your data, and we never will.
• Payments go through Stripe. We never see or store your card details.
• Advertising cookies are off unless you switch them on.

Who is responsible for your data

Coralia Digital is the data controller. Contact: coraliadigital@icloud.com. If you need our postal address for a formal request, ask and we will give it.

What we collect, and why

If you never make an account

Your progress, XP, badges and streak are stored in your own browser using local storage. They stay on your device and are never sent to us. Clearing your browser data deletes them.

We count page views anonymously: which page, the site you arrived from, your country, and whether you are on a phone. There is no cookie, no session, no identifier and no IP address stored, so these counts cannot be linked to you or to each other. If your browser sends Do Not Track or Global Privacy Control we do not count the visit at all. The lawful basis is our legitimate interest in knowing which pages are worth keeping.

If you make an account

We store your email address, because a sign-in link has to go somewhere, and your learning progress so it follows you between devices. Sign-in is by emailed link, so we never hold a password. The lawful basis is performance of our contract with you: you asked for an account and this is what running one requires.

If you subscribe

Stripe processes the payment. Your card details go straight to Stripe and never touch our servers. Stripe tells us your customer reference, which plan you bought and when it renews, and we store that so we know to unlock Pro. The lawful basis is again performance of our contract. Stripe keeps records for longer than we do because tax law requires it.

Cookies and similar technology

Local storage holds your progress and your cookie choice. Signing in stores a session so you are not asked every time. These are necessary for things you asked for, so they do not need consent.

Advertising cookies from Reddit only load if you press Accept in the cookie banner, and only when we are actually running ads. Refusing costs you nothing. You can change your mind any time from Cookie settings in the footer.

Who else sees your data

• Supabase hosts the database holding accounts and progress.
• Netlify hosts the site and runs the small server functions.
• Stripe takes payments and holds the billing relationship.
• Resend delivers sign-in emails.
• Reddit receives advertising events, and only if you accepted.

Each of these is a processor acting on our instructions, except Stripe and Reddit, which are also controllers of what they hold. Some are outside the UK, in which case transfers rely on the UK addendum to the standard contractual clauses or an adequacy decision.

How long we keep things

• Account and progress: until you delete your account, then removed.
• Billing records: six years, because HMRC requires it.
• Anonymous page counts: up to a year, and they are not personal data anyway.

Your rights

Under UK GDPR you can ask for a copy of what we hold, ask us to correct or delete it, object to processing, or ask us to restrict it. Email coraliadigital@icloud.com and we will respond within a month. There is nothing to pay.

If you think we have got it wrong, you can complain to the Information Commissioner's Office at ico.org.uk. We would rather you told us first so we can fix it.

Children

Pythonaut is meant for people aged 13 and over. We do not knowingly hold data about younger children. If you believe we have, tell us and we will delete it.

Security

Traffic is encrypted in transit. Database access is restricted by row level security so one account cannot read another's data. We keep no card details, so there are none to lose. No system is perfect, and we will tell you promptly if something happens that affects you.

Changes

If we change anything that matters we will update the date at the top and, for significant changes, tell account holders by email.

Questions about any of this? Email coraliadigital@icloud.com.