Legal

Privacy policy

Last updated 19 August 2026.

PyPath is a free Python course you can use without an account. Creating an account is optional; it exists so your progress follows you between devices. This page explains exactly what an account stores.

What we store

When you sign up, the following is stored in our database:

Email address — how you sign in, and the only way to reset your password.
Your first and last name — the name shown in the header and on your progress page. It is stored on your own account record only; PyPath keeps no public directory mapping names to accounts, and names are not required to be unique. It is never used in a classroom: a teacher and their class see the username you chose, and the database rules refuse a real-name field in classroom records.
Avatar URL — only if your sign-in provider supplies one.
Course progress — which lessons and units you have completed, and when.
Saved lesson code — the Python you write in lesson exercises, so it is still there when you come back.
Time spent learning — how long you are actively on the site while signed in, and when you were last here. Time counts only while a page is open in front of you and you have interacted with it in the last five minutes, so a tab left open overnight is not recorded as study. We store a running total and a per-day total, never a log of which pages you visited or when.

We store no payment details, no analytics profile, and no advertising identifiers. Your code runs in your browser through Pyodide; it is saved as text, never executed on a server.

What never leaves your browser

Device preferences — theme, font scale, sidebar state, and Sandbox projects — are kept in your browser's local storage and are never uploaded, whether you are signed in or not. If you use PyPath without an account, that applies to your progress and lesson code too.

Who processes it

Accounts and stored progress are handled by Google Firebase (Firebase Authentication and Cloud Firestore), acting as our data processor. Data is subject to Google's infrastructure and security practices; see the Firebase privacy documentation. The site itself is served as static files by Vercel, which records standard request logs.

We do not sell your data and we do not share it with third parties beyond the processors named above.

Security rules

Database rules restrict every progress and code document to the account that owns it. No other learner can read your progress, your saved code, or your email address — and that stays true of a classmate even when you are both in the same class. The one exception is a teacher of a class you joined yourself, and only for the separate class copy described under Classroom accounts.

What PyPath staff can see

A small, named group of PyPath staff can see a dashboard listing every account: name, email address, when the account was created, when it was last active, total time spent, how many units are complete, and whether the certificate has been earned. It exists so we can tell how the course is actually being used.

Your saved lesson code is not included, deliberately. The database rules keep code documents readable by their owner alone, with no staff exception, so nobody at PyPath can read the Python you write. Staff access is read-only: the dashboard cannot change your account or your progress. The list of staff accounts is enforced in the database rules themselves, not just in the page.

Classroom accounts

When you sign up you choose whether you are learning on your own, learning in a class, or teaching one. Learning on your own is the default and nothing about it has changed: no other account can see anything of yours, and none of the classroom storage described below is written for you at all.

You are never put in a class without entering a join code yourself. Entering that code is the moment your work becomes visible to that teacher, and nothing is shared before it. The join screen lists exactly what they will be able to see, in the same words as below, before you confirm.

What a teacher of your class can see

Which lessons you have opened, and when.
Which exercises you have attempted, and how many attempts each took.
Which checks your code passed, and your end-of-unit test scores.
The code you write in lesson exercises, including a short history of how you wrote it — up to 20 saved states per editor, captured when you run your code and when you stop typing, never as you type.
The written answers you save to reflection questions.
The username you chose, and when you were last active.

This is a change from what this page previously said. Until the classroom feature existed, we said a teacher could never see the Python you write. That is no longer true for a class you have joined: seeing a student’s actual code is how a teacher can help with it. It remains true everywhere else. Your private copy of your code, the one that syncs between your own devices, is still readable by you alone, with no exception for teachers or for PyPath staff. What a teacher reads is a separate copy that only exists for the class you joined, and it is deleted when you leave.

What a teacher cannot see

Your email address.
Your legal name. Classroom records store the username you chose and nothing else; the database rules refuse a name or email field outright rather than relying on the page to leave it off screen.
Anything you do outside their class.
Anything at all, until you enter their join code yourself.

Your teacher also decides whether your certificate is issued once you finish all ten units, and can see when you asked for it. Your teacher can remove you from their class, and can share the class with a second teacher, who sees exactly the same things and nothing more. A teacher can never change your work: the database rules refuse every write from a teacher to a student’s progress, code or activity record, so a record of what you did cannot be edited by someone else.

You can leave a class at any time from your account page. Leaving stops your teacher seeing anything further and deletes the class copy of your work — your activity record, your mirrored code and answers, and your code history. Your own progress and your own saved code are untouched.

If you are a teacher, your join code is what identifies your class. Anyone with the code can join it, so treat it like a class password and issue a new one from your classroom page if it spreads further than you meant.

How long classroom data is kept

Not indefinitely. Under the amended COPPA rule that reached full compliance on 22 April 2026, children’s data may not be kept for longer than it is needed, and a retention period has to be stated rather than left open.

Activity records and code history are deleted after 180 days.
Code history is also capped as it is written: 20 states per editor and 64KB per lesson, oldest discarded first.
An archived class and everything in it is purged after one year. A teacher can carry that out from their classroom page; the database rules allow it only for a class that has been archived and only for records already older than the year, and never for a class that is still running.
Leaving a class deletes your class records straight away, without waiting for any of the above.

Deleting your account

You can clear device-local data at any time from Settings. To delete your account and everything stored against it, contact us using the address below and we will remove the account, its progress, and its saved code. Deletion is permanent.

Children

PyPath is not directed at children under 13, and accounts should not be created for them without a parent or guardian.

Changes

If this policy changes in a way that affects what we store, we will update the date at the top of this page.

Contact

For privacy questions or a deletion request, open an issue on the project repository or contact the maintainer through their GitHub profile.