Privacy Policy

uByte (“we”, “our”) operates the website at ubyte.dev — a free interactive platform for learning the Go programming language. This policy explains exactly what data we collect, why, and how long we keep it.

Questions? Email us at privacy@ubyte.dev.

You must be at least 13 years old to create an account or use uByte. We do not knowingly collect data from children under 13. If you believe a child under 13 has created an account, please contact us and we will delete it promptly.

Account data — when you sign up: your name, email address, and a bcrypt hash of your password (we never store your raw password). If you sign up with Google, we receive your Google ID, name, and email from Google OAuth.

Learning data — the tutorials you have completed, your XP points, streak count, bookmarks (tutorial slug + code snippet + optional note), and any achievements unlocked.

Playground snippets — code you share via the Playground “Share” button is stored so others can view it via the share link. Snippets are associated with your account if you are logged in.

Anonymous visitor tracking — if you browse without an account, a random visitor_id UUID is stored in a cookie to count page views (we limit free access to 20 unique tutorial pages). No personal information is in this ID.

IP addresses — we log your IP address transiently for rate limiting (e.g. preventing brute-force login attempts). IP-based records are deleted within 24 hours.

Activity log — we keep a log of significant account actions (e.g. progress reset, password change) for security auditing. Logs are retained for 90 days.

Vercel Analytics — we use Vercel's built-in analytics for anonymous usage statistics (page views, country). No cookies are set by Vercel Analytics; data is aggregated and not linked to individuals.

Resend — transactional email (email verification, password reset). Resend receives your email address to deliver messages. See Resend's Privacy Policy.

Google OAuth — if you choose “Continue with Google”, Google handles authentication and shares your name and email with us. See Google's Privacy Policy.

Piston API — code you run in the interactive steps is sent to the Piston API (emkc.org), an open-source code execution API. Do not submit sensitive information in code you run.

We use your data only to operate the service: authenticating you, saving your progress, displaying leaderboard rankings (name and XP, visible to other logged-in users), sending transactional emails you explicitly request, and preventing abuse via rate limiting.

We do not sell your data, share it with advertisers, or use it for purposes beyond operating uByte.

Account data is kept until you delete your account (Settings → Delete Account). Deleted accounts are removed immediately and cascaded — all progress, bookmarks, and achievements are deleted.

Anonymous page-view data is kept for 365 days. Rate-limit records are kept for up to 24 hours. Email verification tokens are cleared on use or overwritten on re-request.

Export — download all your data as JSON from your profile settings or via /api/profile/export.

Delete — delete your account and all associated data from Profile → Settings → Delete Account.

Correct — update your name, bio, and avatar from Profile → Settings.

If you need help exercising any of these rights, email us at privacy@ubyte.dev.

Passwords are hashed with bcrypt (cost 10). Auth tokens are stored in HttpOnly cookies not accessible to JavaScript. All communication uses HTTPS. We implement CSRF protection, account lockout after repeated failures, and token versioning to invalidate all sessions on logout.

We will post any changes here and update the “Last updated” date. Continued use of uByte after changes constitutes acceptance.