Privacy

The short version

We store the account you create, the code you submit, and how you did on it. We do not run your code, we cannot read your messages, and we do not sell, rent or share any of it with anyone.

What we collect

When you create an account

Your email address. Used to sign you in, to send a verification link, to reset a password, and, only if you tick the box in Settings, to send a weekly digest.
A username, and optionally a display name and avatar. These are public by default on /u/your-username. You can make the profile private in Settings, which also removes you from leaderboards and share cards.
A password hash (bcrypt), or, if you sign in with Google, an account identifier from Google. We never see or store your Google password.

When you use the site

Submissions. The code that passed, the mode it passed in, when, and how it timed against the reference. Stored so you can read your own work back and so the leaderboard has something to rank.
Drafts. Autosaved work in progress, plus up to the last twenty revisions of it, per problem and mode. Private to you.
Attempts. A count of runs and submissions per day, which is what draws the activity heatmap and the streak.
A mode cookie. Remembers which language you are browsing in, so the site works before you have an account. Nothing else is tracked in it.

What we do not collect

Your code, at the moment you run it. Run and Submit send your code to crackedai-connect on your own machine over loopback. It is not executed here and it does not reach this server as part of running it. Autosaved drafts are a separate thing and are stored, as listed above.
The contents of your messages. Conversations are end-to-end encrypted with MLS, and the keys live in your browser. The server holds ciphertext it has no way to open. It does know who is in a conversation and when messages were sent, because it has to route them.
Anything about your machine beyond what the runtime reports. The site reads your runtime's /health endpoint to know which languages it can run and which GPU it found, so it can tell you before you waste a submission. That is read live and not stored.
Third-party analytics or advertising trackers. There are none.

Who else sees it

Three services touch your data because the site cannot run without them, and each sees only what it needs:

Fly.io hosts the application and its database.
Resend delivers email. It sees the address a message is going to.
Google , if and only if you choose to sign in with it, tells us your email address, name and avatar.

Errors are reported to Sentry with identifiers rather than content. Nobody buys this data from us, because we do not sell it.

What is encrypted

Reference solutions and stored group names are encrypted at rest with AES-256-GCM. Passwords are hashed with bcrypt and are not recoverable, which is why a forgotten one is reset rather than retrieved.

How long we keep it

Your account, your solves and your drafts stay until you ask us to delete them. Draft revisions are pruned to the most recent twenty per problem. Session tokens expire; a "remember me" cookie lasts sixty days.

Encrypted messages are the exception: the server deletes the ciphertext it is holding thirty days after it was sent, whether or not you ask. That is a delivery buffer, not an archive. A device that has already downloaded a message keeps its own copy, and we could not read either one.

What you can do

See it. Your dashboard and profile show what we hold about your progress; Settings lists the browsers and machines attached to your account.
Correct it. Whether your profile is public, who may message you, your mode and your email preferences are all in Settings. Your username is fixed once the account exists; to change it, or a display name or avatar that came from Google, use the email address below.
Stop the email. Untick the digest in Settings, or use the unsubscribe link in any digest. Verification and password-reset mail is transactional and cannot be unsubscribed from, because it only ever arrives when you ask for it.
Delete it. Email privacy@crackedaicode.com from the address on the account and it is removed, along with everything attached to it. There is no self-service button for this yet, so the mail is the route. Messages already downloaded to somebody else's browser cannot be reached by us, which is a consequence of the encryption rather than a policy.

Cookies

Three, all first-party and all necessary: a signed session cookie, an optional sixty-day "remember me" cookie, and the mode cookie described above. No advertising or analytics cookies, and therefore no consent banner.

Children

The site is not directed at children under 13 and we do not knowingly collect their data.

Changes

If this policy changes in a way that affects what we collect or who sees it, the date at the top changes and account holders are told by email.