what we keep about you.

Gwecode is run by WOM STUDIO LTD, Unit 20, Port Talbot Business Units, Addison Road, Port Talbot, SA12 6HZ, United Kingdom. We decide how your data is used, which makes us its controller. Anything about this notice goes to help@gwecode.com.

Every lesson is open without an account. If you make one, we store:

• your name and email address
• your password as a one-way hash, so nobody here can read it
• when you joined and when you last signed in
• the lessons you start and finish, the level checks you pass, and each quick check answer and whether it was right
• the sites you build: their names, anything you typed to describe them, and every file
• the languages you vote for or suggest
• whether you’ve switched visit tracking off

The people who run Gwecode can open your profile to see these details, your progress and your visits. Each time they do, our admin log notes who opened it and when, so looking at your data always leaves a trace.

We don’t send email at the moment, so your address is only used to sign you in.

what	in detail
Pages	The address of each page, without anything after a question mark.
Time	Counted while the tab is showing and you’ve been active in the last five minutes.
Code runs	The language, whether it worked, and the error’s name or first line, up to 60 characters. Your code isn’t sent, but an error’s first line can quote a little of it.
Country	Looked up from your IP address, then the address is dropped.
Device	Phone, tablet or desktop.
Browser	The name only, such as Firefox.
Where you came from	The name of the site that sent you, such as reddit.com, or the campaign tag in the link. Not the full address.
Joining and signing in	When it happened during the visit.

We don’t record the people who run the site, or bots we can spot.

Our server has to see your IP address to reply to you. For visits, we use it to look up your country and to make the guest code, then drop it. It isn’t stored with your visit.

The lookup happens on our own server, using a copy of the DB-IP country database, so nothing about you goes to DB-IP.

We do store IP addresses in one place: our security log. It records your address when you join and when a sign-in fails, along with a partly hidden email address for failed sign-ins. This is how we spot break-in attempts. Entries are deleted after 90 days.

To slow down password guessing, we also count attempts from each address. The count is saved against a hash of the address and resets within the hour.

Our hosting provider may keep its own server logs, which usually include IP addresses.

If you have an account, switch tracking off in account settings. We stop recording your pages, time and code runs straight away, on every device you’re signed in on, until you switch it back on.

The switch belongs to your account, so it only works while you’re signed in. If you sign out or your session ends, you’re a guest again: visits are saved against a daily code, not your name, and they don’t join your account when you sign back in.

If your browser sends the Global Privacy Control signal, we skip visitor tracking completely: the script doesn’t load and nothing is recorded, signed in or not. Firefox, Brave and DuckDuckGo offer it. Chrome needs an extension.

Neither of these erases visits we’ve already recorded. You can ask us to erase your visit history at any time, as the last section explains.

name	what it does	how long
gwecode_sessioncookie	Keeps you signed in and protects forms from forgery. Everyone gets one, because forms need it. It isn’t used to follow guests.	Until you close your browser. Idle sessions end after two hours.
gwe_localecookie	Remembers your language. Site languages are switched off right now, so this cookie isn’t being set.	One year
gwecode-themebrowser storage	Remembers light or dark mode.	Until you clear it
pg-lang pg-code-* pg-heightbrowser storage	Keeps your playground language, code and panel size. It stays in your browser and isn’t sent to us.	Until you clear it
gwecode-engines-v1browser cache	Keeps downloaded language engines so your code starts faster.	Until you clear it

We don’t use advertising or tracking cookies.

who	what for	what they get
jsDelivr	Delivers some language engines, such as Python, to your browser. It’s a worldwide network, so your request may be handled in another country.	Your browser connects to it directly, so it sees your IP address and browser details. Lesson pages can fetch engines before you press run, and every page opens a connection ahead of time to save waiting. Your code isn’t sent.
DB-IP	Supplies the country lookup database. IP data by DB-IP, licensed under CC BY 4.0.	Nothing about you. Our server downloads the file about once a month and does every lookup itself.

Code you write runs in your browser. If your code loads an image or a script from another website, your browser fetches it and that site sees the request.

Our fonts are on our own server. We’d only hand your data to anyone else if the law required it.

what	how long
Your account, progress, answers and sites	Until your account is deleted.
Visit details	13 months, then deleted.
Daily totals	Kept for good. Visits, pages, countries, devices, browsers, referring sites, code runs and sign-ups are added up into daily figures that don’t name anyone.
Which months and years an account was active	Until your visit history is erased or your account is deleted. We use it to count learners per month and per year.
Security log	Up to 90 days. We delete older entries once a day.
Who opened your profile	Up to 90 days, in the same admin log.

Data protection law asks for a reason behind each use of your data. Ours are:

• Your account, progress and sites: we need them to give you what you signed up for.
• Security log, attempt counts and the record of who opened your profile: our legitimate interest in keeping accounts and the site safe, and in being able to show who looked at your data.
• Visitor tracking: our legitimate interest in seeing which lessons work, where learners get stuck and how people find us.

When this notice changes, we update the date at the top. If a change matters, we’ll say so on the site first.