Privacy Policy

This policy explains what data DevCraft collects, why, and the choices you have. We collect the minimum needed to run the platform, teach effectively, and keep accounts secure — we do not sell personal data.

Account data: email, username, display name, hashed password (we never store your plaintext password — see Security below), and optional profile fields like bio and avatar.

Learning activity: lesson progress, XP, streaks, project submissions, code you write in lessons and the playground, quiz answers, and interview-prep responses.

AI feature inputs: the code, questions, and answers you submit to hint, review, explanation, or mock-interview features, which are transmitted to our AI infrastructure provider (OpenRouter) and the underlying model to generate a response. See AI-powered features in our Terms.

Community content: posts, comments, and reactions you create, which are public by design.

Payment data: for Pro and Team subscriptions, payment is processed by our payment provider directly — DevCraft does not store your full card number.

Technical data: IP address (used for rate limiting and abuse prevention, retained briefly), device/browser type, and basic usage analytics.

• Operate core features: track progress, award XP, run code in the sandbox, issue certificates.
• Personalize the AI tutor's hints and recommendations to your track and history.
• Detect and prevent abuse — account lockouts after failed logins, rate limiting, sandbox resource limits.
• Send transactional email (verification, password reset, receipts) and, if you opt in, product updates.
• Improve the curriculum by analyzing aggregate, de-identified completion and drop-off patterns.

We share data only in these circumstances:

• AI providers: content you submit to AI features is sent to OpenRouter and the model provider it routes to, solely to generate your response.
• Service providers: hosting, email delivery, and payment processing vendors, bound by contract to use your data only to provide their service to us.
• Public by your choice: your portfolio (unless set to private), community posts, and issued certificates are visible to anyone with the link — that visibility is the point of those features.
• Legal requirements: if required by valid legal process, or to protect the safety of our users or the public.

We do not sell your personal data to third parties or data brokers.

Passwords are hashed with bcrypt and never stored in plaintext. Refresh tokens are stored as SHA-256 hashes. All traffic is encrypted in transit via TLS. Access to production data is limited to engineers who need it, and administrative actions are logged in an audit trail. No system is perfectly secure — if we discover a breach affecting your data, we will notify you as required by applicable law.

We retain account and learning-activity data for as long as your account is active. If you delete your account, we deactivate and anonymize your login credentials immediately; learning activity tied to an anonymized account ID may be retained in aggregate, de-identified form for curriculum analytics. Backups are retained for up to 30 days before rolling deletion.

Depending on where you live, you may have the right to:

• Access a copy of the personal data we hold about you.
• Correct inaccurate data via your account settings.
• Delete your account and associated personal data.
• Set your portfolio to private, opting out of public visibility.
• Opt out of non-essential product emails at any time via the unsubscribe link.

To exercise any of these rights, contact privacy@devcraft.io or use the account-deletion option in Settings.

We use essential cookies to keep you signed in and remember your theme preference (light/dark). We use a small number of analytics cookies to understand aggregate feature usage; these do not track you across other websites.

DevCraft is not directed at children under 13, and we do not knowingly collect personal data from children under 13. If you believe a child has created an account, contact us at privacy@devcraft.io and we will take appropriate action.

We will post material changes to this policy on our changelog and, where required, notify active users by email before the changes take effect.

Privacy questions can be sent to privacy@devcraft.io or through our contact page.