Privacy Policy

• Your identity, from Google or LinkedIn. When you sign in we receive your email address, your display name and your profile picture. We never receive your password, because you never give us one.
• What you do here. Which chapters you have read, which exercises you have attempted, and where you are in a track.
• What you submit. The models, SQL, Python and written answers you produce, and the reviews generated from them.
• Billing facts, not billing details. Your plan, your subscription status and its renewal date. We store an identifier that points at your customer record with our payment provider. We never see or store card numbers.
• Basic technical data that any web service receives in order to function, such as your IP address in request logs.

To run the service you asked for: to know who you are, to remember your progress, to decide what your plan gives you access to, to produce your reviews, and to take payment. We also use aggregate patterns — which chapters people finish, where they stall — to decide what to build next.

We do not sell your data, and we do not share it with advertisers.

Running this requires a handful of services, each doing one job:

• Supabase — authentication and the sign-in handshake.
• Railway — hosting for the application and its database.
• Dodo Payments — payments, as merchant of record. They collect and hold your payment details under their own privacy policy; we receive only the subscription status.
• An AI provider — the text of a submission is sent to a third-party language model service to produce a review. It is sent for that purpose alone.

These providers operate in various countries, so your information may be processed outside the one you live in.

We use what is needed to keep you signed in, and local storage on your device to hold progress and preferences — including progress made before you had an account, so that it is not lost when you create one. There are no advertising or cross-site tracking cookies.

Your account and its work stay while the account exists. Records we are required to keep for tax and accounting — the fact of a payment, not a card — are kept as long as the law requires. Ask us to delete your account and we remove your personal data and your submissions, apart from those records.

You can ask for a copy of what we hold, ask us to correct it, or ask us to delete it. Email support@d8loop.com from the address on the account and we will act within 30 days. Depending on where you live you may also have the right to object to certain processing, or to complain to your data protection authority.

Account deletion is handled by email today rather than by a button in the product. That is a gap we intend to close, and until we do, a request by email is answered by a person.

Traffic is encrypted in transit. Access to the production database is restricted to those who need it to operate the service. No system is perfect: if a breach affects you, we will tell you and the relevant authority as the law requires.

D8Loop is not intended for anyone under 16. We do not knowingly collect their data, and will delete it if we learn we have.

When this policy changes we update the date at the top. If a change materially affects how your information is used, we will email you before it takes effect.