Privacy

The short version

We store your account details, saved code and learning progress. Your code runs on your own computer or one you have linked. Messages are end-to-end encrypted. We do not sell your data; the services that help operate the site are listed below.

What we collect

When you create an account

• Your email address. Used to sign you in, to send a verification link, to reset a password, and, only if you tick the box in Settings, to send a weekly digest.
• A username, and optionally a display name and avatar. These are public by default on /u/your-username. You can make the profile private in Settings, which also removes you from leaderboards and share cards.
• A password hash (bcrypt), or, if you sign in with Google, an account identifier from Google. We never see or store your Google password.

When you use the site

• Submissions. For signed-in users, we save accepted solutions with the problem, mode and submission time. Benchmarked modes also record available timing data and a device category, such as CPU, CUDA or MPS. These records let you revisit your code, track progress and compare eligible benchmark results.
• Drafts. Autosaved work in progress, plus up to the last twenty revisions of it, per problem and mode. Private to you.
• Attempts. For signed-in users, each recorded run or submission includes the problem, mode, result and time. We use these records for activity counts, streaks and attempt-based reference access.
• Knowledge checks and revealed help. When you are signed in, we save your first answer to each knowledge check, whether it was correct and when you answered. We also remember how many hints and reference-solution lines you have revealed for each problem and mode, so you can return to them later. Revealing a reference marks subsequent solves as assisted.
• Friends and conversations. We store friend requests and accepted friendships, conversation membership, linked messaging browsers and your read position in each conversation. This lets us manage access and show unread-message counts. Message contents are encrypted as described below.
• Squad progress sharing. We store which track a squad follows and whether you share your progress with that squad. Creating a squad enables sharing for its creator; other members choose whether to share. You can stop sharing from the squad’s board. This setting is separate from profile visibility.
• Linked computers. When you link a computer, we store its reported name, platform, runtime version, supported modes and last contact time. We also store a hash of its access token. These details let the site send your code to the computer you choose and show whether it is available.
• Runtime information. The site reads the runtime’s health report to show its connection, available tools and execution device. A device category can be saved with a benchmarked solution, as described above.
• A mode cookie. Remembers which language you are browsing in, so the site works before you have an account. Nothing else is tracked in it.

Where your code runs

The editor sends code to the site as you type so it can prepare Run and Submit requests. Signed-in drafts and accepted solutions are saved as described above.

On the same computer, your browser sends execution requests directly to crackedai-connect. For a linked computer, the site temporarily queues the request until that computer collects it. In both cases, crackedai-connect executes the code on your computer. The website’s server does not execute it.

What we do not collect

• The contents of your messages. Conversations are end-to-end encrypted with MLS, and the keys live in your browser. The server holds ciphertext it has no way to open. It does know who is in a conversation and when messages were sent, because it has to route them.
• Third-party analytics or advertising trackers. There are none.

Who else sees it

The site uses these services for hosting, email delivery and optional sign-in:

• Fly.io hosts the application and its database.
• Resend delivers email and receives its recipient address and message content.
• Google , if and only if you choose to sign in with it, tells us your email address, name and avatar.

Sentry receives crash reports to help us diagnose failures. Reports can include exception details, stack traces, application source context, and request or user identifiers. These are diagnostic reports, not just anonymous counts.

Grafana Cloud stores the site’s logs and performance metrics, which we use to monitor it. Logs can include your account ID, the pages you request and, when abuse protection refuses a request, your username and IP address.

What is encrypted

Reference solutions and stored group names are encrypted at rest with AES-256-GCM. The server can decrypt group names to display them; group names do not have the same end-to-end protection as message contents. Passwords are hashed with bcrypt, so a forgotten password is reset rather than retrieved.

How long we keep it

Your account, your solves and your drafts stay until you ask us to delete them. Draft revisions are pruned to the most recent twenty per problem and mode. Session tokens expire; a "remember me" cookie lasts sixty days.

Encrypted messages are the exception: the server deletes the ciphertext it is holding thirty days after it was sent, whether or not you ask. That is a delivery buffer, not an archive. A device that has already downloaded a message keeps its own copy, and we could not read either one.

What you can do

• See it. Your dashboard and profile show what we hold about your progress; Settings lists the browsers and machines attached to your account.
• Correct it. Whether your profile is public, who may message you, your mode and your email preferences are all in Settings. Your username and display name cannot be edited in Settings yet; to change either, or an avatar that came from Google, use the email address below.
• Stop the email. Untick the digest in Settings, or use the unsubscribe link in any digest. Verification and password-reset mail is transactional and cannot be unsubscribed from, because it only ever arrives when you ask for it.
• Delete it. Email privacy@crackedaicode.com from the address on the account and it is removed, along with everything attached to it. There is no self-service button for this yet, so the mail is the route. Messages already downloaded to somebody else's browser cannot be reached by us, which is a consequence of the encryption rather than a policy.

Cookies

Three, all first-party and all necessary: a signed session cookie, a sixty-day "remember me" cookie, and the mode cookie described above. The "remember me" cookie is set when you tick "Keep me logged in" with a password, and every time you sign in with Google. No advertising or analytics cookies, and therefore no consent banner.

Children

The site is not directed at children under 13 and we do not knowingly collect their data.

Changes

If this policy changes in a way that affects what we collect or who sees it, the date at the top changes and account holders are told by email.