Privacy policy
The controls this describes live in Settings → Privacy.
Last updated: 23 October 2026
What this is
This policy describes what DOTCODE collects, why, and what you can do about it.
It describes the system as it actually is today, not a system we intend to build. Where something is not in place yet, this page says so rather than leaving the impression that it is.
1. Who we are
DOTCODE is a student coding platform operated from India. It is a small project, not a company with a data protection department, and this policy is written plainly for that reason.
2. What we collect
Things you give us
| Data | Why | Basis |
|---|---|---|
| Name, email, username | Your account, and signing in | Needed to provide the service |
| College or institution, degree, graduation year | Showing your college's contests and quizzes, and your public profile | Needed to provide the service |
| Profile details you choose to add — bio, skills, links, experience, education | Your public profile | Your choice; leave them blank and nothing is stored |
| Code you submit | Running and grading it, and your own history | Needed to provide the service |
| Posts, comments and reactions | Showing them to other students | Needed to provide the service |
| A browser notification address, if you turn notifications on | Sending you notifications when DOTCODE is closed | Your choice; turn it off in Settings → Notifications and it is deleted |
Things collected automatically
| Data | Why |
|---|---|
| IP address | Rate limiting and abuse prevention |
| Basic request information | Security and audit logging |
| The pages you open on the site | Counting visitors (below) |
Counting visitors
DOTCODE counts its own visitors, so that it can say truthfully how many people use it, for example to an investor or a funder. No third party is involved: there is no analytics company, no advertising and no tracking cookie.
For each page you open, once it has been on your screen for a second, we record:
- the page's address, without anything after a "?";
- the time, and how long the page stayed on your screen;
- where you came from: a search engine, a social site, a link with a campaign tag, or nowhere;
- whether you are on a phone, a tablet or a computer, and the browser and system;
- your approximate location, to the city, as our website host works it out from your connection;
- your account, if you are signed in.
To count different people rather than the same person twice, your browser keeps a random ID in its own storage (section 3). It is not your name or your account, and on its own it says nothing about who you are.
Your IP address is not stored for this. It is scrambled with a key that is made fresh each day and destroyed the next night, so the scrambled form lets us count different connections on one day and can never be turned back into the address.
If your browser sends Global Privacy Control, it gets no ID: the pages you open are counted, and you are never counted as a visitor.
Bots and link previews are not counted.
For the days before this count began (20 August to October 2026), the totals come from our API server's own log, and only the daily totals are kept.
We do not run advertising trackers, and there is no third-party analytics script on the site.
3. Cookies and local storage
Your sign-in token is kept in your browser's local storage, not in a cookie.
Two more things are kept there for counting visitors (section 2):
- dotcode_vid, the random ID that lets your browser be counted once a day however many pages it opens. Clear your browser's site data and it is gone; you are then counted as a new visitor.
- dotcode_team, set only on a browser that has signed in as one of DOTCODE's administrators, so that our own team is left out of the count.
Two cookies are used:
- dotcode_signed_in holds the value 1 and nothing else, while you are signed in. It lets the home page open DOTCODE for you instead of the sign-up page. It is not your sign-in token, it contains no personal data, and it is removed when you sign out.
- A referral code, set only if you arrive through an invitation link, so the person who invited you is credited.
There is no cookie consent banner, because there is nothing to consent to: we set no advertising or analytics cookies, and the visitor count uses no cookie and no third party.
4. Who we share it with
Your public profile — name, username, college, and anything you chose to add to it — is visible to anyone, including people without an account. That is what a public profile is for. You control what goes in it.
Beyond that, the only parties involved are the services needed to run the site: hosting, the database, and email delivery for account messages such as verification and password resets. If you turn on browser notifications, your browser's own push service (run by Google, Mozilla or Apple, depending on the browser) carries them to you; the text is encrypted so that service cannot read it.
We may show totals from the visitor count to investors and funders: how many visitors came each day, and how many by state, city, device and where they came from. These never include a person, an account, an email address or the pages any one person opened.
We do not sell personal data, and we do not share it with advertisers.
5. Your rights, and where to exercise them
These are not requests you have to send anywhere. They are controls in the product:
| Right | Where |
|---|---|
| See everything we hold about you | Settings → Privacy → Download my data. Produces a JSON file immediately, including the pages you opened while signed in |
| Correct it | Settings — your profile is editable |
| Delete your account | Settings → Privacy → Delete my account. Requires your password |
| Control what your profile shows | Settings → Privacy — the toggles for your email address and your problem activity |
What deletion actually does
Deleting your account removes your account and deactivates your access immediately, and the deletion is recorded in our audit log.
The pages you opened while signed in stay in the visitor count, with their link to your account removed.
We do not currently run an automated purge of every associated record on a fixed schedule. An earlier version of this policy promised a complete purge within 30 days; no such job exists, so the promise has been removed rather than left standing.
If you want your identity erased as well, ask. An administrator then removes your name, email address, username, profile, linked coding accounts, experience and education, sign-in sessions and notification addresses, your name on any certificate, and what you sent with an ambassador or job application (your note, CV and links), in one step that cannot be undone.
What you posted stays, without your name on it. Your posts, comments, submissions and contest or quiz results remain, so that discussions and leaderboards still make sense, and they are shown as written by "Deleted user". None of it is linked to your name, email address or profile any more. Anything you wrote yourself, such as the text of a post or a file you uploaded, stays as you wrote it, so if you want a post or comment gone entirely, delete it yourself before you delete your account.
6. How long we keep things
| Data | Kept |
|---|---|
| Account and profile | Until you delete your account |
| Your submissions and posts | Kept after you delete your account, and shown as "Deleted user" once your identity is erased. Delete a post or comment yourself first if you want it gone |
| Audit and security logs | Retained for security purposes, including after account deletion |
| IP addresses and device details | 90 days on sign-in sessions and referral-link clicks; 180 days on audit and security logs. After that they are removed automatically each day; the log entry itself is kept, without them |
| Pages opened on the site (the visitor count) | 13 months, then removed automatically each night |
| The daily key that scrambles IP addresses for the count | Destroyed the night after the day it was made |
| Daily visitor totals | Kept. They are numbers only, with no person in them |
7. Security
What is actually in place:
- HTTPS everywhere. Traffic to the site and the API is encrypted in transit.
- Passwords are hashed with bcrypt and never stored in readable form.
- Two-factor authentication is available on your account.
- Rate limiting on the API.
- Audit logging of security-relevant events.
- Code you run in a lesson executes inside your own browser, sandboxed by the browser itself, and is not sent to a server to run.
What is not in place, stated plainly because a security section that lists aspirations is worse than one that lists nothing:
- We do not currently operate a web application firewall.
- We do not have a formal schedule of external security assessments.
- Database storage is not separately encrypted at rest beyond what the hosting provider does by default.
No system is perfectly secure. Use a password you do not use elsewhere.
8. Where your data is
The database and API are hosted in India. The website is served from a global content network, and account email is delivered by a third-party provider, so some data transits servers outside India.
9. Age
DOTCODE is intended for students in school, college and beyond. It is not intended for children under 13, and we do not knowingly collect their data.
10. Changes
If this policy changes materially, the date at the top changes and the change is noted here.
- 23 October 2026: DOTCODE began counting its own visitors (section 2) on the day this version of the policy was published. This policy said "we do not run analytics", which was true until then.
- Before that, this policy replaced one that described features the platform did not have — a cookie consent banner, a web application firewall, a machine readable policy endpoint, and a 30-day purge — none of which existed.
11. Contact
The controls in section 5 handle access, correction and deletion directly, and are the fastest route for all three.
For anything they do not cover, or to raise a concern, use the contact route published on the site. If you are in India, you may also approach the Data Protection Board.