The short version
- Progress and notes stay in your browser unless you sign in.
- An account stores your identity from GitHub, Google, or email, plus synced progress.
- Comments, projects, and profile fields you publish are public.
- We do not sell data, run advertising, or use third-party tracking scripts.
What stays in your browser
Lesson completion, XP, streaks, bookmarks, notes, your last visited lesson, and your theme preference are stored in localStorage. They are not sent to a server while you are signed out. You can clear them at any time through your browser's site-data settings; doing so removes your local progress and notes.
What we store when you sign in
- Account identity: email address, display name, profile image URL, and the provider account id from GitHub or Google. If you use an email sign-in link, we store the email address.
- Session data: a session record with an expiry date so you stay signed in until you sign out or the session expires.
- Synced progress: lesson completion, XP, streak, bookmarks, notes, and your last visited lesson. Sync happens only after you sign in.
- Preferences: theme, preferred track, whether your progress is visible to others, and any legacy email-updates preference saved before the newsletter was paused.
We do not store passwords. Authentication is handled by OAuth providers or a single-use email link.
What is public
Lesson comments, project showcase entries, your display name, profile image, bio, and the profile links you choose to add are visible to anyone. If you turn off Show my learning progress in settings, your XP, completed lessons, streaks, and badges are hidden from other people. Your email address is never shown on a public profile.
Comments and projects can be deleted by their author. Deleting a parent comment also removes its replies.
Newsletter (paused)
Newsletter signup and delivery are currently disabled. Any address submitted before the newsletter was paused remains in the database but will not receive emails. To remove it, use the contact form.
Contact messages
The contact form stores your optional name, email address, topic, message, and the date. Messages are used only to read and respond to you. If the mail server is configured, a notification is emailed to the maintainers; a copy of the message remains in the database until it is resolved or deleted.
Cookies and local storage
- Essential cookies: the NextAuth session cookie (when signed in) and a short-lived CSRF cookie during sign-in. These are required for authentication.
- Local storage: theme, progress, notes, bookmarks, and whether you dismissed the cookie notice. These stay on your device.
- No tracking cookies: this site does not include advertising pixels, third-party analytics, or session-replay scripts.
Outbound links may include UTM campaign parameters that identify Nyxora Sync as the referrer. Those parameters are added to the destination URL; they do not set a cookie on this site or track you across websites.
Service providers
These providers process data on our behalf so the site works:
- Vercel hosts the site and keeps operational logs that may include IP addresses and user agents for security and diagnostics.
- Neon hosts the PostgreSQL database that contains accounts, progress, comments, projects, newsletter subscribers, and contact messages.
- GitHub and Google handle OAuth sign-in when you choose those providers.
- Our email provider delivers sign-in links and, when configured, contact notifications. Newsletter delivery is currently disabled.
These providers may process data in countries other than yours. Their own privacy policies and security terms apply to their processing.
What we do not do
We do not sell personal data, use it for advertising, build advertising profiles, or send your notes and private messages to third parties. Public content is public because you chose to publish it, not because it was harvested.
Retention
- Account data remains until you request deletion.
- Comments and projects remain until you delete them or your account is deleted.
- Newsletter addresses collected before the newsletter was paused remain stored until you request deletion through the contact form.
- Contact messages remain until they are resolved or deleted.
- Hosting logs are retained according to the hosting provider's policy.
Your choices and rights
Depending on where you live, you may have the right to access, correct, export, or delete your personal data, and to object to or restrict certain processing. You can:
- Edit your profile and hide your progress in settings.
- Delete your comments and projects directly on the site.
- Request an account export or deletion through the contact form. We may ask you to verify control of the account first.
- Clear local progress and notes through your browser.
Nothing here limits rights you have under mandatory local law, including the right to complain to your data protection authority.
Security
The site is served over HTTPS. Database access is restricted to the application, and authentication uses OAuth or single-use email links rather than stored passwords. No system is perfectly secure; if you find a vulnerability, please report it privately through the contact page instead of posting details publicly.
Children
The site is intended for learners aged 13 and older, or 16 and older where local law sets a higher age for digital consent. It is not directed at younger children. If we learn that a child below the applicable age created an account, we will delete it.
Changes to this policy
If the data practices change, this page will be updated and the date at the top will change. Material changes that affect existing accounts will be announced on the site before they take effect.
Contact
Privacy questions and requests go through the contact form, choosing the “Privacy or account request” topic.