Privacy Policy

At Python Online ("we", "us", or "our"), your privacy, the security of your proprietary code, and your trust are our highest priorities. This comprehensive Privacy Policy explains how we collect, use, store, share, and protect your information when you access or use our website, Integrated Development Environment (IDE), APIs, and distributed cloud computing infrastructure (collectively, the "Service").

1. Introduction & Scope

This Privacy Policy applies to all users of Python Online, including unauthenticated guests, registered free users, and premium Pro subscribers. By accessing or using our Service, you acknowledge that you have read, understood, and agree to the data practices described in this document.

2. Information We Collect

We believe in data minimization. We only collect the information strictly necessary to provide, secure, and improve our cloud IDE services. The specific data collected depends on your interaction with the platform:

A. Information You Provide

• Account Data: If you register via email, we collect your email address. We utilize Supabase as our secure identity provider and do not store or have access to raw passwords.
• Support Communications: When you open a ticket via our Support Desk or contact us directly, we collect your name, email address, and the contents of your message to provide assistance.
• Billing Information: If you upgrade to a Pro account, your payment is processed by our Merchant of Record, LemonSqueezy. We do not collect, process, or store your full credit card numbers or banking details. We only receive secure webhooks confirming your subscription status, variant IDs, and billing cycle dates to provision your cloud resources.

C. User-Generated Content (Your Code)

To provide a persistent, cloud-based development environment, we must process and store the digital assets you create:

• Project Files & Code: Python scripts, HTML templates, CSS, JSON configurations, and any text files you write within the IDE.
• Data Assets: Any CSVs, SQLite databases, or image files you upload or generate via scripts.
• Installed Libraries: Python packages you install via the IDE are saved to your project's isolated user-space (the `.pypackages` directory).
• Execution Logs: For users utilizing long-running background scripts or scheduled tasks, we temporarily store standard output (stdout/stderr) logs to allow you to review the results of your code. These logs are strictly bound to your project and subject to a maximum 5MB rolling quota to protect storage limits.

Note for Guests: If you use Python Online without creating an account, your code is stored locally in your browser's memory. When you execute a script, the code is temporarily transmitted to an ephemeral Linux container. Once the 60-second execution window completes, the container and its memory are instantly destroyed. We do not permanently store code executed by unauthenticated guests.

D. Automatically Collected Information

When you access the Service, we automatically collect certain technical data to ensure system security and cluster stability:

• Network & Device Data: IP addresses, browser types, and operating system identifiers.
• Usage Metrics: Anonymous telemetry regarding IDE interactions (e.g., clicking "Run", memory usage of your containers, or encountering a 502 Bad Gateway error). This helps our engineering team balance the Elastic Compute Pool and identify infrastructure bottlenecks.

3. How We Use Your Information

We use the data we collect for the following operational purposes:

• Service Provisioning: To authenticate you, load your Virtual File System, and spawn your isolated Docker containers on our execution nodes.
• Resource Management: To automatically calculate and allocate CPU and RAM resources based on your active web apps and background tasks.
• Network Routing: To dynamically route public HTTPS traffic to your deployed web applications via our Edge Router (Traefik).
• Security & Enforcement: To monitor for violations of our Acceptable Use Policy (e.g., detecting cryptocurrency mining or malicious scraping attempts) and to protect our infrastructure from DDoS attacks.
• Customer Support: To resolve technical issues and respond to your inquiries.

Strict Anti-AI Training Guarantee

Your intellectual property belongs to you. Python Online explicitly guarantees that we do not use your private code, data assets, databases, or execution logs to train, fine-tune, or prompt any Artificial Intelligence (AI), Machine Learning (ML), or Large Language Models (LLMs), nor do we sell or license your data to third parties for this purpose.

4. How We Share and Disclose Data

We do not sell, rent, or lease your personal information or proprietary code to third parties. We only share data with trusted third-party service providers acting as our sub-processors to operate the infrastructure. These providers are bound by strict data processing agreements:

• Supabase: Provides our secure authentication infrastructure and PostgreSQL database hosting.
• LemonSqueezy: Acts as our Merchant of Record to process subscriptions, handle tax compliance, and manage billing.
• Cloudflare: Provides DNS routing, Content Delivery Network (CDN) caching, DDoS mitigation, and automated SSL certificate generation.
• Resend: An email API used strictly for delivering transactional emails, such as password resets and Support Desk replies.

Legal Compliance: We may disclose your information if required to do so by law, court order, or in response to valid requests by public authorities (e.g., law enforcement) to comply with legal obligations or protect the rights and safety of Python Online and its users.

5. Data Security & Architecture

Because Python Online is designed to execute arbitrary code, our architecture implements security at the kernel level:

• Distributed Mesh Isolation: All communication between our central database (the Brain) and remote compute workers (the Muscle) occurs over a private, encrypted WireGuard VPN tunnel. Internal infrastructure services (like Docker APIs and NFS storage) are entirely shielded from the public internet.
• Container Namespaces: Your code runs inside isolated Linux namespaces. Processes are sandboxed and cannot break out of their container to access the host operating system or the data of other users on the same node.
• Network Firewalls: For Free tier users, outbound network requests are forced through a strict Zero-Trust Squid proxy whitelist to prevent malicious external connections and botnet behavior.
• Data Encryption: All data transmitted between your browser and our servers is encrypted in transit using Transport Layer Security (TLS/SSL).

6. Data Retention

We retain your personal data and project files only for as long as your account is active or as necessary to fulfill the purposes outlined in this policy.

• Active Accounts: Your code, packages, and databases remain persistently stored on our federated disk drives as long as you maintain a Registered Account (Free or Pro).
• Dormant Free Accounts: To preserve server storage capacity, we reserve the right to prune the `.pypackages` dependencies of Free tier accounts that have been completely inactive for over 30 days. Your core project code remains untouched.

7. Your Privacy Rights (GDPR & CCPA)

Depending on your location, you may have specific rights regarding your personal data under regulations like the General Data Protection Regulation (GDPR) or the California Consumer Privacy Act (CCPA). Python Online grants these rights to all users globally:

• Right to Access: You can view your account details and current subscription status via the Account Dashboard.
• Right to Data Portability: We enforce a strict "No Lock-In" policy. You can download a complete ZIP archive of your entire workspace, code, and data at any time directly from the IDE Explorer interface.
• Right to Erasure ("Right to be Forgotten"): You have the right to request the complete and permanent deletion of your data. You can instantly execute this using the "Delete Account" button in the IDE Account Dashboard. Upon confirmation, the system will execute a cascading purge—immediately eradicating your user record, active Docker containers, Traefik routing configurations, databases, scheduled tasks, and recursively destroying your isolated storage directory from the physical disk. This action cannot be undone.

8. International Data Transfers

Python Online operates a distributed cloud infrastructure. Your information, including Personal Data and project files, may be transferred to—and maintained on—computers located outside of your state, province, country, or other governmental jurisdiction where data protection laws may differ from those of your jurisdiction. By using the Service, you consent to this transfer. We take all reasonable steps to ensure that your data is treated securely and in accordance with this Privacy Policy regardless of where the physical compute nodes reside.

9. Children's Privacy

Our Service is intended for developers, students, and professionals. It does not address anyone under the age of 13 (or 16 in certain European jurisdictions). We do not knowingly collect personally identifiable information from children. If you are a parent or guardian and you are aware that your child has provided us with Personal Data without your consent, please contact us so that we can take necessary actions to remove that information from our servers.

10. Changes to this Privacy Policy

We may update our Privacy Policy periodically to reflect architectural upgrades, new features, or changes in legal regulations. We will notify you of significant changes by posting the new Privacy Policy on this page and updating the "Last Updated" date at the top of this document. We encourage you to review this Privacy Policy periodically for any changes.

11. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy, our data practices, or our handling of Google OAuth data, please reach out to us:

• Via the IDE: Open a ticket in the Support Desk panel.
• Via Email: Visit our Contact Page to submit an inquiry.