Legal
Privacy policy
Last updated 21 October 2026
The short version: no adverts, no analytics, no tracking cookies, and nothing is ever sold.
Most of what this site remembers (your study progress, preferences and caches) stays in your own browser. The only things stored on my server belong to the optional Code accounts, and you can ask me to delete yours at any time.
Who runs this site
drew-gnr.xyz ("Drew's Realm", including Atlas, the Catalogue and Code) is a personal, non-commercial site run by Drew, an individual based in the UK. I'm responsible for the personal data described here. You can contact me through the Message me bubble in the bottom-right corner of every page, or on Discord.
This policy covers drew-gnr.xyz. Other tools linked from the Catalogue (for example on other drew-gnr.xyz subdomains), GitHub and Discord handle data in their own ways.
What happens when you visit
Cloudflare
The site is delivered through Cloudflare, which sits between your browser and my server to keep it fast and protected from attacks. Cloudflare processes connection details such as your IP address, browser and the pages you request, and may set strictly necessary security cookies. See Cloudflare's privacy policy.
Server logs
My web server keeps basic request logs (time, page requested and technical details of the request) for a limited time to spot faults and abuse. They aren't used to profile anyone.
Things your browser loads from other services
Some pages ask your browser to fetch content directly from other companies, which means they receive your IP address and normal browser information:
- Google Fonts supplies the site's fonts (Google's privacy policy).
- GitHub: the home page shows my recent public GitHub activity by asking GitHub's API from your browser (GitHub's privacy statement).
- jsDelivr supplies the Python and PHP engines the first time you open a lesson that needs them (jsDelivr's privacy policy).
What's kept in your own browser
Atlas (quiz and flashcard progress), Code (lesson progress, XP, streaks, achievements and settings) and the home page (a short-lived cache of my GitHub activity) save data in your browser's local storage. It stays on your device and isn't sent to me, unless you sign in to a Code account, which syncs your Code progress. Clearing your browser's site data removes it.
The code you write in lessons and the Playground runs entirely in your browser and is never uploaded.
Code accounts (optional)
You can use everything without an account. If you create one, I store:
| Data | Why |
|---|---|
| Username | To identify your account. It's shown publicly on the leaderboard and your profile. |
| Password | To sign you in. Only a bcrypt hash is stored, never the password itself. |
| Session cookie | A strictly necessary cookie that keeps you signed in. It lasts 30 days or until you log out. |
| Progress | Your lessons, XP, streaks and achievements, so they follow you between devices. |
| Problem reports | If you report a problem with a lesson: the course, lesson and your message, plus your username if you're signed in. |
What's public: the leaderboard shows usernames and XP. Each account also has a public profile showing its username, join date, XP, longest streak, lessons completed and mastered, and achievements. Choose a username you're happy to be seen publicly.
No email address is collected. To stop automated sign-ups, registration uses Cloudflare Turnstile, which checks your browser for signs of a bot. Sign-ups, sign-ins, reports and messages are also rate-limited by IP address. The address and a counter are kept in the database only until the limit window ends, usually 15 to 60 minutes.
Messages you send me
The Message me bubble lets you contact me without either of us sharing an email address up front. When you send a message, I receive:
- your message;
- how to reply, if you choose to give it (for example an email address or Discord username);
- the page you sent it from, and the time.
The message is delivered to my personal email inbox, which is hosted by Google (Google's privacy policy). It isn't stored on the website's server. The bubble uses Cloudflare Turnstile to block spam bots, and Turnstile only loads once you open the bubble. Please don't send passwords or other sensitive information.
Why I use it (legal basis)
- Delivering and securing the site, and its logs: my legitimate interest in running a working, safe website.
- Code accounts, progress and reports: providing the account you asked for.
- Messages: my legitimate interest in reading and replying to people who contact me.
I don't use your data for marketing, profiling or automated decisions about you.
Who else sees it
Only the services named above, for the purposes described. I don't sell or share your data with anyone else, unless the law requires it.
The site and accounts are hosted on my own server in the UK. Cloudflare, Google, GitHub and jsDelivr may process data in other countries under their own safeguards.
How long it's kept
- Accounts and progress: until you ask me to delete them, or I close the service.
- Sessions: until they expire (30 days) or you log out.
- Problem reports: until the problem has been dealt with.
- Messages: in my inbox for as long as they're needed to deal with what you asked, then deleted.
- Server logs: a limited time, then deleted or overwritten.
Your rights
Under UK data protection law (the UK GDPR and Data Protection Act 2018) you can ask to see, correct or delete your data, to receive a copy of it, or object to or restrict how it's used. There's no self-service account deletion yet, so send a request through the Message me bubble in the bottom-right corner of every page. Tell me your username and how to reply, and I'll delete your account, progress and reports. I'll reply within one month.
If you're unhappy with how I've handled your data, you can complain to the Information Commissioner's Office, though I'd appreciate the chance to sort it out first.
Children
Everything on the site works without an account. If you're under 13, please ask a parent or guardian before creating a Code account.
Changes
If this policy changes, the new version will be posted here with a new "last updated" date.
See also the terms of service.