Privacy & Terms

1. Information we handle

Google sign-in. Google provides a signed identity response that can include an account identifier, verified email address, name, and profile picture. Exorvio validates that response and uses the Google account identifier to associate your learning with your account. The current account database does not copy your Google email, name, or picture into your public profile. We retain a hash of your verified Google email and its confirmation time to bind parent verification to the adult account giving consent. We do not receive your Google password or request access to Gmail messages, Drive files, contacts, or calendars.

Email accounts. If you register with email, we store your email address, a unique sign-in username, a salted password hash, and the times your account was created and verified. We do not store your password in readable form. Email addresses are private. Verification and recovery links contain random, single-use tokens; only their hashes are stored in our database. For your security, verifying an email or resetting a password requires choosing a password again. Different sign-in providers are not automatically linked; use your original sign-in method to keep accessing existing progress.

Apple sign-in. When enabled, Apple provides a signed account identifier that associates your learning with your account. This integration requests no name or email scope and does not receive your Apple password. Apple sign-in is available on Exorvio.

Learning and preferences. We store your username, course and learning preferences, submitted answers and code, exercise attempts and results, hints used, lesson and practice-session progress, XP, streaks, achievements, and league participation. These records include identifiers and timestamps needed to save progress and prevent duplicate rewards. We also store the Terms of Use version you accepted, the Privacy Policy version shown, and the time of acceptance. This acceptance record is not verified parental consent.

Security and technical information. We store sign-in challenges, hashed session tokens, their creation and expiry times, and records of suspicious or excessive submissions. Short-lived request counters use hashed IP-based identifiers to limit repeated sign-in, email, account, friend and learning requests. Raw IP addresses are not stored in these counters. People sharing a network share these request allowances. Separate account-level code-execution quotas protect the shared runner budget. Hosting and authentication providers may process connection information such as IP addresses, browser details, request times, and error or security logs while delivering and protecting the service.

Messages you send us. If you contact the privacy address, we receive your email address and whatever information you include so we can respond. Avoid adding personal information to exercise answers, public names, or code.

2. Why information is used

We use account information to sign you in, keep your records separate from other learners, save and restore learning progress, provide feedback, recommend practice from your progress, and operate optional leaderboards. Attempt and security records help prevent duplicate XP, abusive submissions, and unauthorized access. Support messages are used to answer requests and resolve problems.

Where applicable law requires a legal basis, processing necessary to provide the account and learning service is based on delivering that requested service; security and abuse prevention serve our legitimate interests in protecting learners and the service, subject to their rights. Consent is used where it is required, and legal obligations may require certain records or disclosures. We do not use learning scores to make employment, credit, or other decisions with legal effects.

The homepage, the CTF map, course introductions, the daily flag preview and policies are public. An eligible account is required for full topics, challenge evidence, flag submissions, rankings and account-saved learning progress. Exorvio does not sell personal information or add advertising trackers or targeted advertisements.

3. What other learners can see

Leaderboard participation is on by default for new adult accounts from 25 September 2026. Existing accounts retain their saved setting. Child accounts remain private and do not participate. You can turn participation off in Preferences or the Friends tab. If you participate, your username, level, weekly XP, rank, and displayed learning language can appear on public rankings. Use a nickname rather than your full name. Your email address and submitted code are not displayed on leaderboards.

Friends. We store the learners you follow and your public username you can edit in the Friends tab once every 30 days. New accounts receive a generated username that can be customized immediately; we store the date of a successful change to enforce this limit. Participating learners can be found by public username; followers can see their username, level, and weekly XP. Following is one-way and does not send notifications. You can choose an earned badge to display beside your name on leaderboards. Your following list is not published to other learners. Opting out removes you from friends search and rankings, while retaining saved follow relationships. You can unfollow learners in the Friends tab.

You can turn off Participate in Leaderboards in Preferences. Your learning progress, XP, and levels continue normally. Other people may retain screenshots of information that was previously public.

4. Service providers and disclosures

Google provides account authentication. The Google sign-in component connects your browser to Google and is also governed by Google’s Privacy Policy.

Apple provides Apple authentication when enabled, under Apple’s Privacy Policy. Resend is the configured delivery integration for verification and password-reset emails; Resend also delivers optional practice reminders and their confirmation emails. Resend processes the recipient email address and message, including its verification or recovery link, to deliver requested emails. See Resend’s Privacy Policy.

OpenAI Sites and Cloudflare infrastructure host and deliver the website and its database. They process information needed to provide hosting, storage, networking, and security. See OpenAI’s Privacy Policy and Cloudflare’s Privacy Policy for their own practices.

Code execution. When you choose Run or Submit, your program and exercise inputs are sent to Railway for execution in a temporary isolated environment. Expected answers stay on Exorvio’s server, which compares the returned output and records your result. The execution environment is removed after the run; Railway may retain operational logs under its own policies. We also record execution attempts and timing against your account to enforce usage limits and prevent abuse. Never submit credentials, personal information, or confidential files in practice code.

The operator may access account records to provide support, investigate abuse, and handle privacy requests. Information may also be disclosed where required by a valid legal obligation or necessary to protect rights and safety. We do not publish private submissions as community solutions.

Providers operate internationally, so information may be processed outside your country. Data location and transfer arrangements depend on the provider and service configuration. Contact us with questions about the arrangements relevant to your information.

5. Storage, retention, and security

Account and learning records are retained to maintain your saved workspace until removal is requested and verified. The current service does not automatically erase inactive accounts. When handling a deletion request, we assess any limited records that must be retained for an applicable legal obligation, an unresolved dispute, or a specific security investigation. Hosting logs and backups may follow separate provider retention schedules; deletion from a live database does not necessarily erase every backup immediately.

Sign-in challenges expire after ten minutes. New sign-ins remain valid for 30 days, including between browser visits, unless you sign out, reset your password, or clear the session cookie. Sessions created before 22 September 2026 retain their original seven-day expiry. Expired records are cleaned up when a new sign-in challenge is created. Signing out invalidates the current session immediately. Email verification and password-reset links expire after 30 minutes. Completing either flow invalidates all sessions and outstanding email links for that email account. Request rate-limit counters expire after their action-specific window (one minute, 15 minutes, or one hour). Expired counters are removed during email requests and bounded maintenance. Unverified email registrations with no valid email link are removed by maintenance after seven days. Verified account records remain until deletion.

Exorvio uses HTTPS, server-side identity checks, hashed session tokens, and access checks for private account records. No internet service can promise absolute security. If you believe your account or data is at risk, contact the privacy address promptly.

Optional reminders and usage measurements

Daily practice emails. These are off until you explicitly request them in Preferences and confirm your email address. We store the address, confirmation status, consent version and time, chosen hour and time zone, and delivery scheduling records. Reminders are available only for eligible adult accounts. They contain a generic practice link, not your code, answers or ranking. We skip reminders when you have already submitted an answer or completed a lesson that local day, and attempt at most one reminder per email address in 24 hours. Delivery is best effort and may be limited by email capacity.

Disable daily emails in Preferences or use the unsubscribe link in any reminder without signing in. Turning off emails or requesting account deletion stops future scheduled reminders and cancels pending confirmation links. Signing out does not change an email preference. Confirmation links expire after 24 hours; unconfirmed settings are removed after seven days. The saved preference and consent record remain until account deletion. Pseudonymous delivery-attempt records, which contain a hashed address rather than message content, are retained for up to 32 days to limit duplicate mail and usage; their account link is removed on account deletion. We do not add open or click tracking to these reminders. Email providers may retain their own delivery records under their policies.

If you enable streak reminders, we store your browser push subscription, delivery keys, chosen local hour, time zone and delivery scheduling information. Your browser’s push provider receives an encrypted generic reminder; messages contain no code, answers, rank or account name. Delivery is best effort, at most once per UTC day, and is skipped if your streak is already earned that day. You can turn reminders off in Preferences or browser settings. Signing out or requesting account deletion removes your server subscriptions. Invalid or expired delivery endpoints are removed when the provider reports them.

Cloudflare Web Analytics measures traffic and performance on public learning pages. It does not use analytics cookies or persistent visitor identifiers. It receives technical request information under its own privacy policy. We do not send account identifiers, answers or code to it. Cloudflare retains its analytics data according to its service policy (currently six months).

Exorvio also keeps daily aggregate counts of homepage views, sign-in-page views, completed demos, successful sign-ins and first completed lessons for 90 days. These counters contain no visitor identifier, IP address, answer or submitted code. They measure event volumes, not a tracked individual journey or unique-visitor conversion rate. Ordinary security logs and rate limits remain separate. Public demos do not earn XP or create learning records.

The installed app does not cache private pages or account responses for offline access. It needs a connection to load your workspace. Installing the app does not enable notifications automatically.

6. Cookies and browser storage

The guest first lesson keeps your language, experience level, daily goal and checkpoint answers in local storage on this browser. They remain until you clear site data or save them to an account. Guest answers are sent to our server for checking but are not stored in the account database before sign-in. After sign-in, choosing “Save this progress to my account” checks those answers again and records accepted learning activity under that account. Do not enter personal information in guest answers.

Essential cookies keep you signed in and protect the sign-in flow. Exorvio’s session cookies are secure, HTTP-only, and restricted by same-site settings. Blocking them can prevent sign-in from working.

The current browser tab stores code drafts, saved notes, the sample-workspace preference, and recently shown public preview question identifiers in session storage. Preview identifiers help vary the examples on repeat visits; preview answers are not saved to your learning account. Drafts and notes are scoped to the active account and cleared when you sign out through Exorvio. Your browser’s session restoration may preserve tab storage. You can clear site data in your browser settings. Google and hosting providers may use their own cookies or similar mechanisms when you interact with their services.

7. Your choices and rights

Use Account and data to download your account records as a JSON file or schedule deletion. Sensitive actions require a sign-in within the last ten minutes. Deletion immediately signs out all sessions, pauses learning, and hides your ranking. You have seven days to sign back in and cancel; after that, the next maintenance run permanently removes the active account, answers, and progress. Anonymous runner usage totals remain to enforce the shared execution budget. Separately retained hosting backups expire under the provider’s retention policy and are not used for normal access; a recovery must reapply deletion requests before reopening the service.

You can change your username once every 30 days and update learning preferences, opt out of competition, sign out, and manage Exorvio’s connection in your Google Account. Disconnecting Google does not by itself erase stored Exorvio progress.

To request access to, a copy of, correction of, or deletion of your personal information, email support@exorvio.com. You may also ask to restrict processing, object to processing based on legitimate interests, or withdraw consent where consent is the basis. Available rights and exceptions depend on the law that applies to you; withdrawing consent does not change the lawfulness of earlier processing.

We may ask you to verify control of the relevant account before acting, to protect it from unauthorized changes. We will explain any information needed and any applicable exception rather than requesting your password. You may raise a concern with us and, where applicable, with your local data-protection authority.

8. Children and families

Our parental notice describes KWS verification, the managed-account data collected after consent, service providers, retention and parental controls. Child accounts are private and cannot join public leagues, friends or email/push reminders. Parents can export data, reset passwords and withdraw consent through Family accounts. Withdrawal stops access and schedules deletion after seven days.

Public introductions, demos, the first guest lesson and daily challenge preview can be explored without an account. Independent saved accounts are restricted to learners aged 18 or over. Parent-managed accounts for younger learners require automated adult verification, explicit guardian consent and provider approval before activation. Until that flow opens, younger learners cannot create saved accounts. We ask a neutral age question before loading sign-in providers or email registration fields. The server enforces the result. Exact ages and dates of birth are not stored; we keep a temporary eligibility result and, after sign-in, the adult self-declaration policy and confirmation time.

The eligibility cookie and its hashed server record expire after 30 minutes for an eligible visitor or 24 hours for a preview-only visitor. A preview-only answer cannot immediately be changed in the same browser. Self-declaration does not verify identity and cannot prevent every false answer. A parent’s checkbox, an ordinary email, a Google account or a teacher’s informal permission is not verified parental consent. Parent-managed accounts use the separate verification and consent process described in our parental notice; ordinary sign-in acceptance alone is insufficient. No classroom consent arrangement is currently offered. See information for families and teachers.

If you believe a child’s information has been collected without required consent, contact support@exorvio.com. The operator will investigate, verify an appropriate parent or guardian request, and remove or restrict the information as required. Children should not put their real name, school, location, contact details, or other identifying information into public names or exercises.

9. Changes to this policy

We will update this page when the service’s data practices change and revise the date above. Material changes will be highlighted in the service where appropriate, and additional notice or consent will be obtained when required. This policy does not waive any privacy rights you have under applicable law.

1. Accounts and families

You can sign in with Google or Apple, and with an email account when email sign-in is available. When you choose a sign-in option or submit an account form on a screen displaying the agreement notice, you agree to these Terms of Use and acknowledge the Privacy Policy. There is no separate acceptance checkbox. We record the document versions and acceptance time when you successfully sign in or finish creating an account. This is not consent to advertising, public rankings, or unrelated use of your data.

The homepage, the CTF map, course introductions, the daily flag preview and policies are available without an account. Full topics, challenge evidence, flag submissions, rankings and account-saved progress require an account. Independent saved accounts are available only to people aged 18 or over. A younger learner may use a separate parent-managed account only after our automated verification flow is available and their verified parent or legal guardian explicitly consents. We ask your age before sign-in. This is a product eligibility rule, not a claim that self-declared age verifies identity. The parent-managed flow remains unavailable until provider approval and activation. Parents must use that flow, not register an adult account for a child or bypass the age screen. No classroom process is offered. See information for parents and teachers.

Use an account you are entitled to use. Keep access secure, sign out on shared devices, and report suspected misuse. Choose a nickname and avoid including your school, address, phone number, or other identifying information in names, code, answers, and notes.

2. What the service provides

Exorvio provides lessons, exercises, feedback, progress tracking, and optional competition. It is an educational practice tool. Completion, XP, and rankings are not accredited qualifications, professional certifications, or promises of employment or exam results.

Content and automated feedback can contain mistakes. Test and review anything you plan to use in real projects. Features can be unavailable during maintenance or outages.

Exorvio currently does not charge learners or require payment details. Any future paid service will need separate, clear pricing and your explicit agreement before charging you.

3. Acceptable use

Use the service lawfully and respect other people’s privacy and rights. Do not impersonate others, harass people, submit unlawful material, copy content you have no right to submit, access another learner’s private records, or interfere with the service.

Do not exploit the website or runner, evade resource limits, distribute malware, mine cryptocurrency, or send spam. Do not automate submissions to fabricate progress, replay rewards, or manipulate XP or rankings. Good-faith security reports are welcome at the contact address; stop testing when you encounter private data and report the issue without copying or exposing it.

4. Your code and learning materials

You retain your rights in code and other material you submit. You give Exorvio permission to store and process it only as needed to deliver, secure, and support the features you request, as explained in the Privacy Policy. Private submissions are not published as community solutions. Do not submit confidential business information, credentials, or other people’s personal data.

You may use Exorvio’s examples and learning materials for your own learning and practice. Do not redistribute the course library or claim it as your own without permission. Third-party tools and materials remain subject to their applicable licenses. Contact the operator with a specific rights complaint, identifying the material and your basis for the complaint; do not include unnecessary sensitive information.

5. Progress and optional rankings

New adult accounts start with leaderboard participation turned on. Child accounts do not participate. You can join or leave in Preferences or the Friends tab. Joining makes your username and displayed learning statistics visible to other learners. Existing accounts retain their previous setting until changed. Leaving competition does not remove earned progress or XP.

XP and ranks have no monetary value. Invalid or duplicated rewards may be corrected. If you think a correction is wrong, contact the operator so it can be reviewed.

6. Account restrictions, changes, and leaving

We may restrict access when reasonably necessary to address a material breach of these terms, a security issue, or a legal requirement. Where practical and lawful, we will explain the reason and give you an opportunity to resolve the issue. Urgent protection of users or the service may require immediate action. You can contact the operator to request a review.

You may stop using the service at any time. Contact the operator to request an account-data copy or deletion; verification of account control may be needed. Retention and privacy rights are explained in the Privacy Policy.

We will explain material changes to these terms and ask you to accept a new version before continuing account use. Changes do not retroactively remove accrued rights. Where practical, we will give notice of a service closure or change that materially affects access to saved progress.

7. Responsibility and your rights

We aim to provide the service with reasonable care and to correct reported problems. We do not promise uninterrupted access, error-free content, or a particular learning outcome. Keep your own copy of work that matters to you.

These terms do not exclude responsibility for fraud, deliberate misconduct, injury or death caused by negligence, or other liability that cannot lawfully be excluded. They do not remove mandatory consumer or privacy rights, restrict your right to complain to a regulator, or prevent you from bringing a legal claim. They do not require binding arbitration or waive collective-action rights.

If a problem arises, please contact the operator with the relevant details so we can try to resolve it. You are not required to give up any applicable legal remedy to use that support process. If a provision is unenforceable, that does not remove the remaining lawful provisions or your mandatory rights.