Privacy Policy

Effective August 30, 2026

This policy describes how cpproad (“we”, “us”) collects and uses information when you use the cpproad website and learning app (the “Service”). It is written to match how the product actually works today.

Related: our Terms of Service. The cpproad source code is open source under the MIT License. Open-sourcing the software does not mean we publish your personal data. Account data, code you write on the hosted Service, and tutor conversations stay in our systems (and with the processors below) unless you choose to share them.

1. Information we collect

We collect the following categories of information. We do not currently offer Sign in with Google; accounts are created with email and password.

  • Account information. Your email address and authentication data. Passwords are handled by our auth provider (Supabase) and are not stored by us in plaintext. We do not receive your password.
  • Profile and onboarding. Display name, experience background, motivation for learning C++, starting point on the curriculum, and weekly lesson goal.
  • Learning data. Lesson progress, exercise and playground source code, compiler/runtime results, concept-check answers and spaced-review schedule, notes, and capstone work.
  • Tutor conversations. Messages you send to the optional AI tutor and the replies we store so the conversation can continue. If you use the tutor, that text is also sent to Google’s Gemini API using your API key.
  • Your Gemini API key (optional). If you enable the tutor, you paste a Google Gemini key. We encrypt it (AES-256-GCM) before storing it and decrypt it only to send tutor requests on your behalf. We do not use a shared operator key. Tutor usage is billed by Google to you.
  • GitHub connection (optional). If you connect GitHub, we store your GitHub username, the target repository, and an encrypted access token so we can commit passed submissions to your public cpproad-submissions repo.
  • Bug reports. Whatever you include when you report a problem.
  • Usage and device data. Product analytics (page views, learning events, feature-flag evaluation) and hosting/performance metrics. Signed-in product analytics are associated with your account; site-wide analytics are typically aggregated.

Some settings (onboarding drafts, playground code, notepad position) are also stored locally in your browser and do not leave your device unless you later save them to the Service.

We do not sell your personal information, and we do not use it to serve third-party ads.

2. How we use information

We use this information to:

  • Create and authenticate your account (email and password).
  • Provide lessons, exercises, review, notes, and the sandboxed compiler.
  • Run the AI tutor using your Gemini key, including sending conversation context to Google’s Gemini API.
  • Sync passed submissions to GitHub when you have connected that feature.
  • Remember progress, goals, and preferences.
  • Keep the Service reliable, debug issues, and understand how the product is used.
  • Protect the Service against abuse of the compiler and other systems.

3. Processors and other services

We rely on other companies to run the Service. They process data only as needed for the purposes above:

  • Supabase — authentication, database, and row-level security for your account and learning data.
  • Vercel — hosting, plus analytics and speed insights on the site.
  • Google — Gemini, only if you paste your own API key for the tutor. We do not currently use Google for sign-in.
  • Judge0 (currently via RapidAPI) — compiling and running C++ you submit. Your source and stdin are sent to that sandbox.
  • Statsig — feature flags and product analytics in the signed-in app.
  • GitHub — only if you connect it; passed submissions are written to a public repo you authorize.

Those providers process data under their own terms and in the regions they operate (often including the United States).

4. Open source

cpproad’s software is publicly available under the MIT License at github.com/1RaghavM/cpp-course. Anyone can inspect, run, or modify that code subject to MIT. That repository does not include your email, progress, submissions, notes, API keys, or other personal information from the hosted Service.

If you self-host cpproad from the source, you are the operator of that instance and this policy does not apply to it.

5. Cookies

We use:

  • Essential cookies to keep you signed in (session cookies from our auth provider).
  • A short-lived cookie during GitHub OAuth to protect the connect flow, if you use it.
  • Analytics from Vercel on the site, and Statsig in the signed-in app.

6. How long we keep data

We keep account and learning data while your account exists. You can delete your account from Profile at any time. Deletion removes your auth user and cascades to user-scoped records (progress, submissions, notes, conversations, API keys, GitHub connection, and similar). Anonymized tutor usage/cost records may remain without your account attached.

Code you chose to publish to GitHub stays on GitHub under your account; deleting cpproad does not automatically delete that public repo.

Local browser storage stays on your device until you clear it.

7. Your choices

  • Update display name and weekly goal in Profile.
  • Add, rotate, or remove your Gemini key in Profile.
  • Connect or disconnect GitHub in Profile.
  • Reset learning progress from Profile.
  • Delete your account from Profile. This cannot be undone.

Depending on where you live, you may also have rights to access, correct, or export personal data, or to object to certain processing. Use account deletion for a full erasure of identified account data, or include a privacy request in an in-app bug report.

8. Children

cpproad is not directed at children under 13, and we do not knowingly collect personal information from them. If you believe a child under 13 has created an account, delete it from Profile or contact us via an in-app bug report so we can remove it.

9. Security

We use HTTPS, encrypted storage for API keys and GitHub tokens, and per-user database policies. Code you run is sent to a third-party sandbox whose isolation and patch level we do not fully control. Do not put secrets, passwords, or production credentials into code you run on cpproad.

No method of transmission or storage is perfectly secure.

10. Changes

We may update this policy as the Service changes. The effective date at the top will change when we do. Continued use after an update means the new policy applies.

11. Contact

For privacy requests, use Profile → Delete account for erasure, or send an in-app bug report describing what you need. Source and license questions can go through the public repository. See also our Terms of Service.