Privacy Policy · AlgoNur

The short version

Browsing and the free lessons need no account. The handbook needs your email address, and enrolling stores your email and progress so it follows you across devices. We never sell your data and there are no ads. To access, export, correct or delete your data, email [email protected].

1. What we collect

For your account we store your email address and, if you provide one, your display name (this is often empty for email sign-ins). We also store your role, your language and theme preference, your sessions (a random token, its expiry, and the IP address and browser user-agent of the sign-in), your enrollments, lessons completed, problems solved, saved and shared Lab designs, and bookmarks. For the newsletter and the handbook we store your email address, language, the source page and the confirmation time; sign-up is double opt-in, so we email you a confirmation link first. We keep a log of handbook emails sent and downloads. Administrators have an audit log of admin actions.

2. How we use it

To run your account, save your progress and course list; to show anonymous totals such as engineers enrolled; to improve lessons; to send sign-in links and, if you opt in, newsletter and handbook emails; and to keep the site secure.

3. Who we share it with

We never sell or rent your data, and there is no advertising. These services handle data for us. Contabo hosts our server, with the data centre in Mumbai, India, where our PostgreSQL database and the app run. Cloudflare provides DNS, CDN, DDoS protection, TLS and encrypted backup storage in R2. Resend sends sign-in links and newsletter and handbook emails. Cloudflare Email Routing and a self-hosted inbox handle mail sent to [email protected]. Sentry collects error reports in the EU region and is configured to strip cookies, authorization headers and URL query strings, with no session replay. PostHog provides optional product analytics only if it is enabled. We link out to YouTube with no embedded player and no tracking from us. Google and GitHub are used only if you choose them to sign in. We also disclose data where the law requires it.

4. Cookies and local storage

We use one first-party session cookie for sign-in. It is HttpOnly, Secure and lasts about 7 days. Browser local storage keeps your theme, language and your progress and Lab drafts while you are signed out; this is merged into your account when you sign in. Optional product analytics (PostHog, only if enabled) uses a random id kept in sessionStorage for the tab, honours Do Not Track and Global Privacy Control, sets no analytics cookie and records no personal data in event names. Cloudflare, which protects and serves the site, may set its own security cookies and may run its cookieless web analytics. Blocking the sign-in cookie will break sign-in.

5. How long we keep it

We keep your data while your account is active. After you delete your account we remove or anonymise it in the live database within 30 days, except records we must keep by law. We take encrypted database backups every night. They are kept 7 days on the server and up to 14 daily plus 8 weekly copies in Cloudflare R2, so deleted data can remain in backups for up to about 8 weeks before it ages out.

6. Your choices and rights

Self-service delete and export are not built yet. To access, export, correct or delete your data, email [email protected] from the address on the account and we act within 30 days. You can unsubscribe from newsletter emails with the link in every email, and you can sign out and clear your browser storage at any time.

7. Children

AlgoNur is not for children under 13 and we do not knowingly collect their data. If you are under the age of majority, a guardian must agree for you. Tell us and we will delete the account.

8. Security and international transfers

We use encryption in transit (HTTPS), access controls and role-based admin access, though no service is perfectly secure and we promise no perfect security. Your data may be stored outside Bangladesh, for example in India or in the EU or US for some processors, under those providers' own safeguards.

9. Changes and contact

We update this policy when our practices change and show the new date at the top; significant changes are announced on the site or by email. Contact [email protected] · [LEGAL NAME], [ADDRESS], Bangladesh.