Last updated 17 October 2026

Privacy policy

Pythonaut is run by Coralia Digital, a sole trader based in the United Kingdom. This policy covers the website at pythonaut.net and the Pythonaut app for iPhone and iPad. It explains what we collect, why, and what you can do about it. We have tried to write it so it can actually be read.

The short version

• You can use the free tier without an account and without giving us anything.
• If you make an account we hold your email address, your learning progress and your email preference. Nothing else.
• We only send tips or reminder emails if you tick the box asking for them.
• We do not sell your data, and we never will.
• Payments go through Stripe on the website and Apple in the app. We never see or store your card details.
• The app has no advertising, no tracking and no analytics.
• Advertising cookies are off unless you switch them on.

Who is responsible for your data

Coralia Digital is the data controller. Contact: coraliadigital@icloud.com. If you need our postal address for a formal request, ask and we will give it.

What we collect, and why

If you never make an account

Your progress, XP, badges and streak are stored in your own browser using local storage. They stay on your device and are never sent to us. Clearing your browser data deletes them.

We count page views anonymously: which page, the site you arrived from, your country, and whether you are on a phone. We also count a few steps anonymously in the same way, such as a challenge being solved or checkout being opened, so we can see where the site confuses people. There is no cookie, no session, no identifier and no IP address stored, so these counts cannot be linked to you or to each other. If your browser sends Do Not Track or Global Privacy Control we do not count the visit at all. The lawful basis is our legitimate interest in knowing which pages are worth keeping.

If you make an account

We store your email address, because a sign-in link has to go somewhere, and your learning progress so it follows you between devices. Sign-in is by emailed link (or Google or GitHub, if you choose), so we never hold a password. The lawful basis is performance of our contract with you: you asked for an account and this is what running one requires.

When you make an account we send one welcome email with ways to get started. That is part of running your account.

Tips and reminder emails

Only if you tick the box asking for them. These are occasional: a nudge if you stop partway through the free lessons, and a reminder if you start a checkout and do not finish it. Every one has an unsubscribe link, and you can switch them off from your account. The lawful basis is your consent, which you can withdraw at any time.

Feedback

If you send feedback through the form, we store what you wrote, the name you gave (if any) and how many lessons you had finished. It is not linked to your account. We only quote it on the site if you ticked the box saying we may, and we may choose not to.

If you subscribe

Stripe processes the payment. Your card details go straight to Stripe and never touch our servers. Stripe tells us your customer reference, which plan you bought and when it renews, and we store that so we know to unlock Pro. The lawful basis is again performance of our contract. Stripe keeps records for longer than we do because tax law requires it.

The Pythonaut app for iPhone and iPad

Without an account the app works fully offline. Your progress, XP, streak and daily challenges are stored on your device only. Python runs on your device too, so the code you write is never sent to us. The Home Screen and Lock Screen widgets read your streak from your device and send nothing anywhere.

If you sign in (with Apple, or with an emailed one-time code) we store the same things as for a website account: your email address, an account ID and your learning progress, so it syncs with pythonaut.net. With Sign in with Apple you can choose to hide your email, in which case we only see Apple's private relay address. We do not ask for or store your name.

In-app purchases are processed by Apple. We never see your payment details. When you buy Pro or the Exam Pass, the app tells us the product, the purchase date and Apple's transaction reference, linked to your account if you are signed in, so we can unlock it in the app and on the website. Apple also tells us about renewals, cancellations and refunds so your access stays correct.

The app contains no advertising, no third-party analytics and no tracking, and does not use your data to track you across other companies' apps or websites. The lawful basis for what we hold is performance of our contract with you.

Deleting your account: in the app, go to Profile, then Delete account. This removes your account and learning progress from our servers. Subscriptions bought through Apple are managed and cancelled in your Apple account settings, not by deleting your Pythonaut account.

Cookies and similar technology

Local storage holds your progress and your cookie choice. Signing in stores a session so you are not asked every time. These are necessary for things you asked for, so they do not need consent.

Advertising cookies from Google Ads and Reddit only load if you press Accept in the cookie banner, and only when we are actually running ads. Refusing costs you nothing. You can change your mind any time from Cookie settings in the footer.

Who else sees your data

• Supabase hosts the database holding accounts and progress.
• Netlify hosts the site and runs the small server functions.
• Stripe takes payments on the website and holds that billing relationship.
• Apple takes payments in the app and provides Sign in with Apple, if you use them. Apple's own privacy policy covers what it holds.
• Resend delivers sign-in and account emails, and tips if you asked for them.
• Google Ads and Reddit receive advertising events, such as a completed purchase, and only if you accepted.

Each of these is a processor acting on our instructions, except Stripe, Apple, Google and Reddit, which are also controllers of what they hold. Some are outside the UK, in which case transfers rely on the UK addendum to the standard contractual clauses or an adequacy decision.

How long we keep things

• Account and progress: until you delete your account, then removed.
• Billing records: six years, because HMRC requires it.
• Anonymous page and step counts: up to a year, and they are not personal data anyway.
• Record of which emails we sent you: kept with your account so you never get the same one twice, and deleted with it.
• Feedback: until you ask us to remove it.

Your rights

Under UK GDPR you can ask for a copy of what we hold, ask us to correct or delete it, object to processing, or ask us to restrict it. Email coraliadigital@icloud.com and we will respond within a month. There is nothing to pay.

If you think we have got it wrong, you can complain to the Information Commissioner's Office at ico.org.uk. We would rather you told us first so we can fix it.

Children

Pythonaut is meant for people aged 13 and over. We do not knowingly hold data about younger children. If you believe we have, tell us and we will delete it.

Security

Traffic is encrypted in transit. Database access is restricted by row level security so one account cannot read another's data. We keep no card details, so there are none to lose. No system is perfect, and we will tell you promptly if something happens that affects you.

Changes

If we change anything that matters we will update the date at the top and, for significant changes, tell account holders by email.

Questions about any of this? Email coraliadigital@icloud.com.