Privacy Policy

When you create an account or authenticate on Algo Flow, we collect only the minimum information necessary to maintain your student identity and provide personalized educational progress tracking:

• Account Credentials & Identity: Email address, hashed authentication credentials, chosen display username, and avatar URL if authenticated via third-party OAuth.
• Educational & Telemetry Records: Completed algorithm visualizers, topic mastery percentages, study habit streaks, bookmarked algorithms, interactive quiz scores, and practice session completion timestamps.
• Mental Math Calculation Telemetry: Problem solve latency in milliseconds, overall accuracy percentages, calculation speed in questions per minute (QPM), active and maximum streak days, operation mastery breakdowns (Addition, Subtraction, Multiplication, Division across 1- to 4-digit complexities), and verified daily challenge scores with client-side anti-cheat verification.
• Client Preferences: Interface theme preference (Light / Dark), audio sound effects toggle, and code editor preferred programming language (JavaScript, Python, C++, Java).
• Technical & Security Metadata: Standard HTTP request headers, browser user-agent strings, and IP addresses utilized solely for security diagnostics, rate-limiting enforcement, and DDoS mitigation.

Algo Flow offers seamless, secure single sign-on authentication through trusted OAuth 2.0 identity providers (Google and GitHub). When you choose to authenticate via OAuth:

• We request access strictly to non-sensitive standard identity scopes: email, profile, and openid.
• We receive and store only your email address, chosen public display name, and avatar profile picture provided by the identity provider to instantiate your authenticated student profile.
• We never request, access, read, or store any private external account assets, such as your private GitHub source code repositories, Google Drive files, Gmail messages, or contacts.
• Authentication tokens are securely exchanged directly via Supabase Auth and encrypted over HTTPS TLS 1.3.

Under the EU General Data Protection Regulation (GDPR), we process your data on the following lawful grounds:

• Contractual Necessity: To deliver the core Algo Flow platform services you request, including maintaining your study account, authenticating your sessions, saving your bookmarks, and rendering your Student Dashboard.
• Legitimate Interests: To protect platform integrity, enforce rate limits against automated scraping, prevent cheating on public daily challenge leaderboards, and ensure high availability across global edge regions.
• User Consent: For client-side optional preferences, such as retaining customized visualizer layout settings in your browser storage.

We implement industry-grade defense-in-depth security measures to protect your information from unauthorized access, alteration, or disclosure:

• PostgreSQL Row-Level Security (RLS): Every database table storing personal data (profiles, bookmarks, mental_math_sessions) is fortified with Postgres RLS policies. Your data is cryptographically tied to your authenticated user ID and cannot be accessed by other users.
• End-to-End Transport Encryption: All communications between your client device, Vercel edge servers, and Supabase database endpoints are strictly encrypted using TLS 1.3.
• Authentication Cookie Security: Authentication tokens are transmitted in strict HttpOnly, SameSite, Secure cookie payloads, protecting your active session from cross-site scripting (XSS) and CSRF vulnerabilities.

Algo Flow maintains a strict Zero-Ad-Tracker policy. We do not use third-party advertising cookies or cross-site tracking beacons.

• Essential Authentication Cookies: Used strictly to verify your logged-in state across Next.js server components and API routes.
• Browser Local Storage: Used to store your UI preferences (Light/Dark theme, sound toggle, practice session settings) directly on your device without sending unnecessary telemetry to external servers.

For a complete, itemized inventory of all storage keys, session cookies, expiration windows, and security attributes, please read our dedicated Cookie Policy & Storage Inventory.

To provide high-performance, low-latency educational simulations globally, we partner with world-class cloud infrastructure providers:

Regardless of your geographic jurisdiction, we grant all learners universal privacy controls:

• Right to Access & Inspect: You can view all saved sessions, bookmarks, and practice telemetry directly from your Student Dashboard or request a full data export.
• Right to Rectification: You can update your display name, email, and preferences at any time.
• Right to Erasure ("Right to be Forgotten"): You have the absolute right to delete your account and all associated practice history permanently. Deletion removes your records from our live database immediately.
• Right to Restrict or Object: You can opt out of any non-essential processing by browsing in guest mode.

Algo Flow is designed for computer science learners, students, and professionals. We do not knowingly collect or solicit personal information from children under the age of 13 (or under 16 in the European Economic Area) without parental or educational institution consent.

If we discover that personal data of a minor under 13 has been collected without verifiable parental consent, we will take immediate steps to delete that account and associated records from our database.