Privacy Policy

When you create an account or authenticate on AlgoFlow, we collect only the minimum information necessary to maintain your student identity and provide personalized educational progress tracking:

• Authentication Profile Data: When authenticating via OAuth 2.0 (Google or GitHub), we receive and store your primary email address, your public display name, and your avatar profile URL. We do not store, view, or manage plaintext passwords.
• Practice & Telemetry Data: When authenticated, your learning streaks, daily problem solves, mental math calculation scores, and bookmarked algorithms are stored in your encrypted profile database row to synchronize progress across sessions.
• Anonymous Performance Aggregates: For mental math practice challenges, completed rounds generate aggregate time and accuracy percentiles. These records are stored without exposing personal identity to other students.

AlgoFlow offers seamless, secure single sign-on authentication through trusted OAuth 2.0 identity providers (Google and GitHub). When you choose to authenticate via OAuth:

• We request access strictly to non-sensitive standard identity scopes: email, profile, and openid.
• We receive and store only your email address, chosen public display name, and avatar profile picture provided by the identity provider to instantiate your authenticated student profile.
• We never request, access, read, or store any private external account assets, such as your private GitHub source code repositories, Google Drive files, Gmail messages, or contacts.
• Authentication tokens are securely exchanged directly via Supabase Auth and encrypted over HTTPS TLS 1.3.

Under the EU General Data Protection Regulation (GDPR), we process your data on the following lawful grounds:

• Contractual Necessity: To deliver the core AlgoFlow platform services you request, including maintaining your study account, authenticating your sessions, saving your bookmarks, and rendering your Student Dashboard.
• Legitimate Interests: To protect platform integrity, enforce rate limits against automated scraping, prevent cheating on public daily challenge leaderboards, and ensure high availability across global edge regions.
• User Consent: For client-side optional preferences, such as retaining customized visualizer layout settings in your browser storage.

We implement industry-grade defense-in-depth security measures to protect your information from unauthorized access, alteration, or disclosure:

• PostgreSQL Row-Level Security (RLS): Every database table storing personal user data (profiles, bookmarks, streaks, mental_math_sessions) is fortified with Postgres RLS policies. Your personal data is cryptographically tied to your authenticated user ID and cannot be accessed or modified by other users.
• Public Educational Content Isolation: All 153 algorithm visualizer specifications, step generators, and code templates are statically compiled and completely segregated from user database records, requiring zero authentication or data-collection overhead to run.
• End-to-End Transport Encryption: All communications between your client device, Vercel edge servers, and Supabase database endpoints are strictly encrypted using TLS 1.3.

AlgoFlow maintains a strict Zero-Ad-Tracker policy. We do not use third-party advertising cookies or cross-site tracking beacons.

• Essential Authentication Cookies: Used strictly to verify your logged-in state across Next.js server components and API routes.
• Analytics Cookies (Google Analytics 4): GA4 sets two cookies (_ga and _ga_<container-id>) to collect pseudonymous, aggregate traffic metrics using random client identifiers. GA4 advertising features are disabled; analytics data is never linked to your account identity.
• Browser Local Storage: Used to store your UI preferences (Light/Dark theme, sound toggle, practice session settings) directly on your device without sending unnecessary telemetry to external servers.

For a complete, itemized inventory of all storage keys, session cookies, expiration windows, and security attributes, please read our dedicated Cookie Policy & Storage Inventory.

To provide high-performance, low-latency educational simulations globally, we partner with world-class cloud infrastructure providers:

Regardless of your geographic jurisdiction, we grant all learners universal privacy controls:

• Right to Access & Inspect: You can view all saved sessions, bookmarks, and practice telemetry directly from your Student Dashboard or request a full data export.
• Right to Rectification: You can update your display name, email, and preferences at any time.
• Right to Erasure ("Right to be Forgotten"): You have the absolute right to permanently delete your account and all associated practice data at any time. You can execute an immediate self-service account deletion directly from your Student Dashboard using the "Delete Account" action (which requires typing a double-confirmation phrase) or programmatically via DELETE /api/account/delete with your authenticated session. Upon confirmation, all personal data across our database partitions (including your profile, saved visualizer sessions, bookmarks, streaks, XP, quiz attempts, activity timeline, chapter progress, and authentication credentials) is permanently and irreversibly purged from our live database immediately.
• Right to Restrict or Object: You can opt out of any non-essential processing by browsing in guest mode.

AlgoFlow is designed for computer science learners, students, and professionals. We do not knowingly collect or solicit personal information from children under the age of 13 (or under 16 in the European Economic Area) without parental or educational institution consent.

If we discover that personal data of a minor under 13 has been collected without verifiable parental consent, we will take immediate steps to delete that account and associated records from our database.