Legal

Privacy policy

Last updated 5 October 2026.

PyPath is a free Python learning site. You can browse introductory material without an account; some lessons and classroom features require one. Accounts let you save progress across devices. This notice describes account data, classroom sharing, and information processed when you visit the site.

Who operates PyPath

PyPath is operated by Adam Issac, Saicharan Chowdarapu, and Vihaan Krishna as individuals based in Atlanta, Georgia, United States.

For privacy questions and requests concerning your data, contact Adam Issac at adamissac08@gmail.com. The other operators can be reached at sai.chowdarapu09@gmail.com (Saicharan Chowdarapu) and vvihaankrishna@gmail.com (Vihaan Krishna).

What we store

When you sign up, the following is stored in our database:

Email address — how you sign in, and the only way to reset your password.
Your first and last name — the name shown in the header and on your progress page. It is stored on your own account record only; PyPath keeps no public directory mapping names to accounts, and names are not required to be unique. It is never used in a classroom: a teacher and their class see the username you chose, and the database rules refuse a real-name field in classroom records.
Avatar URL — only if your sign-in provider supplies one.
Course progress — which lessons and units you have completed, and when.
Saved lesson code — the Python you write in lesson exercises, so it is still there when you come back.
Time spent learning — how long you are actively on the site while signed in, and when you were last here. Time counts only while a page is open in front of you and you have interacted with it in the last five minutes, so a tab left open overnight is not recorded as study. We store a running total and a per-day total. Classroom accounts also record lesson activity as described below.

We store no payment details, no analytics profile, and no advertising identifiers. Your code runs in your browser through Pyodide; it is saved as text, never executed on a server.

What never leaves your browser

Device preferences — theme, font scale, sidebar state, and Sandbox projects — are kept in your browser's local storage and are never uploaded, whether you are signed in or not. If you use PyPath without an account, that applies to your progress and lesson code too.

Who processes it

Accounts and stored progress are handled by Google Firebase (Firebase Authentication and Cloud Firestore), acting as our data processor. Data is subject to Google's infrastructure and security practices; see the Firebase privacy documentation. The site itself is served as static files by Vercel, which records standard request logs.

PyPath does not sell personal information or use it for targeted advertising. Classroom data is shared with the teachers of classes you join, as described below. Teachers can download classroom reports; those downloaded copies are outside PyPath’s deletion controls.

Browser storage and external services

PyPath uses local storage and IndexedDB for preferences, saved work, progress, and Firebase session and offline-cache functions. Clearing site data can remove unsynced work; signing out does not necessarily clear every browser cache. On shared devices, sign out and clear site data when finished.

Your browser also contacts Google Fonts, Google's Firebase script servers, and public CDNs such as jsDelivr to load fonts and learning tools. Those services receive network information such as your IP address and request metadata even when you do not create an account. Google or GitHub receives sign-in information when you choose that provider. These providers may process information outside your country.

Do not place passwords, access keys, or sensitive personal information in lesson code, reflections, or classroom names. Python runs locally, but saving work and joining a class can upload that work as described above.

Security rules

Database rules restrict every progress and code document to the account that owns it. No other learner can read your progress, your saved code, or your email address — and that stays true of a classmate even when you are both in the same class. The one exception is a teacher of a class you joined yourself, and only for the separate class copy described under Classroom accounts.

What PyPath staff can see

A small, named group of PyPath staff can see a dashboard listing every account: name, email address, when the account was created, when it was last active, total time spent, how many units are complete, and whether the certificate has been earned. It exists so we can tell how the course is actually being used.

Your saved lesson code is not included, deliberately. The database rules keep code documents readable by their owner alone, with no staff exception, so the staff dashboard does not provide access to your private saved code. These client-access rules do not prevent access by administrators with privileged Firebase infrastructure credentials. Staff access is read-only: the dashboard cannot change your account or your progress. The list of staff accounts is enforced in the database rules themselves, not just in the page.

Classroom accounts

When you sign up you choose whether you are learning on your own, learning in a class, or teaching one. Learning on your own is the default and nothing about it has changed: no other account can see anything of yours, and none of the classroom storage described below is written for you at all.

You are never put in a class without entering a join code yourself. Entering that code is the moment your work becomes visible to that teacher, and nothing is shared before it. The join screen lists exactly what they will be able to see, in the same words as below, before you confirm.

What a teacher of your class can see

Which lessons you have opened, and when.
Which exercises you have attempted, and how many attempts each took.
Which checks your code passed, and your end-of-unit test scores.
The code you write in lesson exercises, including a short history of how you wrote it — up to 20 saved states per editor, captured when you run your code and when you stop typing, never as you type.
The written answers you save to reflection questions.
The username you chose, and when you were last active.

This is a change from what this page previously said. Until the classroom feature existed, we said a teacher could never see the Python you write. That is no longer true for a class you have joined: seeing a student’s actual code is how a teacher can help with it. It remains true everywhere else. Your private copy of your code, the one that syncs between your own devices, is still readable by you alone, with no exception for teachers or for PyPath staff. What a teacher reads is a separate copy that only exists for the class you joined, and it is deleted when you leave.

What a teacher cannot see

Your email address.
Your legal name. Classroom records store the username you chose and nothing else; the database rules refuse a name or email field outright rather than relying on the page to leave it off screen.
Anything you do outside their class.
Anything at all, until you enter their join code yourself.

Your teacher also decides whether your certificate is issued once you finish all ten units, and can see when you asked for it. Your teacher can remove you from their class, and can share the class with a second teacher, who sees exactly the same things and nothing more. A teacher can never change your work: the database rules refuse every write from a teacher to a student’s progress, code or activity record, so a record of what you did cannot be edited by someone else.

You can leave a class at any time from your account page. Leaving stops your teacher seeing anything further and deletes the class copy of your work — your activity record, your mirrored code and answers, and your code history. Your own progress and your own saved code are untouched.

If you are a teacher, your join code is what identifies your class. Anyone with the code can join it, so treat it like a class password and issue a new one from your classroom page if it spreads further than you meant.

How long classroom data is kept

Classroom event cleanup targets records older than 180 days. It runs from a signed-in student's browser. It is not a scheduled server deletion: records can remain longer if the student does not return or cleanup fails.

Code history is capped at 20 states per editor and 64KB per lesson, with the oldest states discarded first. These size caps are not a time-based deletion guarantee.
Teachers can purge eligible records from an archived class after one year. This requires a teacher action; archiving alone does not delete the records.
Leaving a class requests deletion of its class copies. Contact us if leaving fails or you need help removing records.

Account profiles, private progress, and saved code remain until removed; there is currently no automatic inactive-account deletion. Device storage remains until you clear it. Hosting and authentication providers apply their own log and backup retention. We have not verified a fixed deletion period for those provider records.

Deleting your account

You can clear device-local data at any time from Settings. To delete your account and everything stored against it, send a private deletion request to the contact address below. Account deletion is currently handled manually, not through a self-service button. We may need to verify ownership before acting. Ask us to include classroom copies as well as your profile, progress, and saved code; copies already downloaded by a teacher must be addressed with that teacher or school. Deletion is permanent.

Teacher verification requests

If you request teacher verification, we store your submitted name, account email, check timestamps, directory and institution-record links, and match results. We confirm the institution using a restricted US k12 domain, an active educational institution in the Research Organization Registry (ROR), or an NCES school or district directory record. Registry requests contain domain names or the public record link, not your name or full email. We then visit official school pages to match your account email, name, and teaching role in the same staff entry. You can provide a direct staff-page link when your school uses a different website. An incomplete match is not a finding that you are not a teacher. Verified results expire after 30 days and are rechecked when you next use the verification feature. This affiliation check does not establish school authorization for children’s data or enable under-13 enrollment. Requests remain stored until removed; there is not yet an automatic deletion schedule. Contact us for access, correction, or deletion. Do not include student information.

Children

Self-service accounts are for people aged 13 and older. We are preparing a school-authorized route for younger learners, but under-13 account creation is not yet open. Children under 13 must not create a regular account or use an adult’s account. The school-code check sends only the code to our server, alongside ordinary network request information. A successful check does not create an account or establish parental consent; it indicates that a school authorization review is on file. Our signup form asks for an age range before enabling account details or provider signup; we do not ask for a date of birth. This is self-reported eligibility, not verified identity or parental consent. If you believe we hold personal information about a child under 13, contact adamissac08@gmail.com privately so we can investigate and arrange removal. Do not post the child's information in a public issue.

Changes

If this policy changes in a way that affects what we store, we will update the date at the top of this page.

Contact

For privacy questions, access, correction, or deletion requests, email adamissac08@gmail.com, the contact also listed in our Terms. Do not post account information in public GitHub issues. Never send your password. Depending on where you live, you may have additional rights, including objection, restriction, portability, and the right to complain to your local privacy regulator.