Privacy Policy

1. Information we handle

Google sign-in. Google provides a signed identity response that can include an account identifier, verified email address, name, and profile picture. Exorvio validates that response and uses the Google account identifier to associate your learning with your account. The current account database does not copy your Google email, name, or picture into your public profile. We do not receive your Google password or request access to Gmail messages, Drive files, contacts, or calendars.

Learning and preferences. We store your chosen display name, course and learning preferences, submitted answers and code, exercise attempts and results, hints used, lesson and practice-session progress, XP, streaks, achievements, and league participation. These records include identifiers and timestamps needed to save progress and prevent duplicate rewards. We also store the Terms of Use version you accepted, the Privacy Policy version shown, and the time of acceptance. This acceptance record is not verified parental consent.

Security and technical information. We store sign-in challenges, hashed session tokens, their creation and expiry times, and records of suspicious or excessive submissions. Hosting and authentication providers may process connection information such as IP addresses, browser details, request times, and error or security logs while delivering and protecting the service.

Messages you send us. If you contact the privacy address, we receive your email address and whatever information you include so we can respond. Avoid adding personal information to exercise answers, public names, or code.

2. Why information is used

We use account information to sign you in, keep your records separate from other learners, save and restore learning progress, provide feedback, recommend practice from your progress, and operate optional leaderboards. Attempt and security records help prevent duplicate XP, abusive submissions, and unauthorized access. Support messages are used to answer requests and resolve problems.

Where applicable law requires a legal basis, processing necessary to provide the account and learning service is based on delivering that requested service; security and abuse prevention serve our legitimate interests in protecting learners and the service, subject to their rights. Consent is used where it is required, and legal obligations may require certain records or disclosures. We do not use learning scores to make employment, credit, or other decisions with legal effects.

The homepage and policy pages are public. Google sign-in is required to access lessons, practice, challenges, rankings, and personal learning progress. Exorvio does not sell personal information or add advertising trackers or targeted advertisements.

3. What other learners can see

League participation is off by default for new accounts created from 21 September 2026. Older accounts retain their previous setting until you change it in Preferences. If you participate, your chosen display name, level, weekly XP, rank, and displayed learning language can appear on public rankings. Use a nickname rather than your full name. Your Google email and submitted code are not displayed on leaderboards.

You can turn off Participate in Leaderboards in Preferences. Your learning progress, XP, and levels continue normally. Other people may retain screenshots of information that was previously public.

4. Service providers and disclosures

Google provides account authentication. The Google sign-in component connects your browser to Google and is also governed by Google’s Privacy Policy.

OpenAI Sites and Cloudflare infrastructure host and deliver the website and its database. They process information needed to provide hosting, storage, networking, and security. See OpenAI’s Privacy Policy and Cloudflare’s Privacy Policy for their own practices.

Code execution. A managed code runner is not currently enabled for learner submissions. When one is enabled, code and exercise inputs will be sent to that provider for execution and grading. This policy will be updated to identify the provider before that integration is enabled. Never submit credentials or confidential files in practice code.

The operator may access account records to provide support, investigate abuse, and handle privacy requests. Information may also be disclosed where required by a valid legal obligation or necessary to protect rights and safety. We do not publish private submissions as community solutions.

Providers operate internationally, so information may be processed outside your country. Data location and transfer arrangements depend on the provider and service configuration. Contact us with questions about the arrangements relevant to your information.

5. Storage, retention, and security

Account and learning records are retained to maintain your saved workspace until removal is requested and verified. The current service does not automatically erase inactive accounts. When handling a deletion request, we assess any limited records that must be retained for an applicable legal obligation, an unresolved dispute, or a specific security investigation. Hosting logs and backups may follow separate provider retention schedules; deletion from a live database does not necessarily erase every backup immediately.

Sign-in challenges expire after ten minutes and sessions after seven days. Expired records are cleaned up when a new sign-in challenge is created. Signing out invalidates the current session immediately.

Exorvio uses HTTPS, server-side identity checks, hashed session tokens, and access checks for private account records. No internet service can promise absolute security. If you believe your account or data is at risk, contact the privacy address promptly.

6. Cookies and browser storage

Essential cookies keep you signed in and protect the sign-in flow. Exorvio’s session cookies are secure, HTTP-only, and restricted by same-site settings. Blocking them can prevent sign-in from working.

The current browser tab stores code drafts, CTF notes, and the sample-workspace preference in session storage. Drafts and notes are scoped to the active account and cleared when you sign out through Exorvio. Your browser’s session restoration may preserve tab storage. You can clear site data in your browser settings. Google and hosting providers may use their own cookies or similar mechanisms when you interact with their services.

7. Your choices and rights

You can change your display name and learning preferences, opt out of competition, sign out, and manage Exorvio’s connection in your Google Account. Disconnecting Google does not by itself erase stored Exorvio progress.

To request access to, a copy of, correction of, or deletion of your personal information, email devvik7@gmail.com. You may also ask to restrict processing, object to processing based on legitimate interests, or withdraw consent where consent is the basis. Available rights and exceptions depend on the law that applies to you; withdrawing consent does not change the lawfulness of earlier processing.

We may ask you to verify control of the relevant account before acting, to protect it from unauthorized changes. We will explain any information needed and any applicable exception rather than requesting your password. You may raise a concern with us and, where applicable, with your local data-protection authority.

8. Children and families

Exorvio is intended for learners of all ages, but access to the learning platform requires an account. Children’s personal information can require additional protections, including verified parental or guardian consent, depending on their age and location.

Exorvio does not yet provide a verified parental-consent registration process. Where such consent is required, a child should not create a personal account or submit personal information until that process has been arranged. A Google account, an ordinary email, or a statement that a parent agrees is not automatically proof of legally sufficient parental consent. Parents and guardians can contact the operator before account creation to discuss access and required safeguards.

If you believe a child’s information has been collected without required consent, contact devvik7@gmail.com. The operator will investigate, verify an appropriate parent or guardian request, and remove or restrict the information as required. Children should not put their real name, school, location, contact details, or other identifying information into public names or exercises.

9. Changes to this policy

We will update this page when the service’s data practices change and revise the date above. Material changes will be highlighted in the service where appropriate, and additional notice or consent will be obtained when required. This policy does not waive any privacy rights you have under applicable law.