DataArena

Privacy Policy

Last updated: November 15, 2026 (2027 Edition)

This Privacy Policy explains how DataArena (“we”, “us”, or “our”) handles information when you visit dataarena.dev and use our PySpark, Cloud Lakehouse, Website Audit, and AI Engineering playgrounds.

The short version: you can learn, solve problems, and run custom PySpark pipelines without an account. If you do not create an optional Cloud Copy, we do not collect your email or store your code on our servers. Code execution runs inside a Pyodide WebAssembly Web Worker on your device, and BYOD local folder sync uses your browser’s native File System Access API locked strictly to the single folder you pick — never uploaded to our servers.

1. Information We Collect

  • Zero mandatory identity data: Solving coding problems, reading lessons, running the 4-cloud incident simulator, and practising in BYOD Studio require no name, email, phone number, or password.
  • Email address (optional Cloud Copy only): Provided only when you choose to create or recover a cross-device Cloud Copy on the Account page. Used solely to deliver a single-use verification or recovery link — never for marketing emails or newsletters.
  • Cloud Copy & hashed credentials: When enabled, we store an anonymous user ID, a random display name (such as Learner 7K2M), a cryptographic hash of your sync code, hashed session tokens, your problem submissions/status/runtime, streak count, and a JSON progress blob. Because only hashes are saved, we cannot read or recover your raw sync code.
  • Automatic server & security logs: Standard edge HTTP logs (IP address, user agent, timestamps retained for up to 30 days) and hashed IP/address counters used strictly for abuse prevention and email rate limiting.

2. Local Browser Storage, Audit/AI Simulators & BYOD Local Folder Access

  • PySpark browser execution: PySpark and Spark SQL challenges execute locally inside an isolated Pyodide WebAssembly Web Worker on your CPU. Code you write never runs on a remote server.
  • Audit & AI sandbox execution: Website Audit comparisons (Good Site vs Bad Site), 24 DSA visualizers, 24-week AI roadmap progress, Prompt Lab evaluations, Plan vs Act terminal sandboxing, and Model Context Protocol (MCP) walkthroughs execute strictly inside deterministic client-side JavaScript in your browser tab. Prompts, generated .cursorrules configs, or test scripts are not uploaded to external LLM providers or DataArena backend servers.
  • Scoped File System Access API (showDirectoryPicker): In BYOD Studio, clicking Sync from Local Folder opens your operating system’s native folder selector. Browser security grants DataArena access strictly to the single folder handle you approve inside your browser tab (cached locally in IndexedDB so you can reconnect easily). DataArena cannot browse, index, or read sibling folders, Desktop, Documents, OS system directories, or browser profiles, and local CSV/JSON/Parquet/Delta files are never transmitted to our backend servers.
  • On-device persistence, 30-day ad-unlock receipts & SHA-256 progress export: Progress across PySpark, Audit, and AI, code drafts, and 30-day device-only sponsored ad-unlock receipts stay in your browser’s localStorage and IndexedDB. When you download a backup (databench-progress.json), DataArena attaches a client-side SHA-256 integrity seal (_integrity) so imported files cannot have locked interviews forged manually. Ad-unlock timers are stored exclusively on your device and are never uploaded or synced via Cloud Copy. You may wipe all locally stored DataArena state immediately using the controls below or your browser settings.
  • Feedback & bug reports via Contact (/contact): Submitting the feedback form calls our /api/contact endpoint and sends the message you enter (along with an optional reply address if you provide one) directly to our configured support mailbox via our transactional email provider. Messages are used strictly to investigate bug reports, update curriculum pages, or reply when requested.
Data on this device
Your code, drafts, progress, ad unlocks and the arena save game live in this browser. One click removes all of them.
Save in my folder
Keep a copy of your progress and drafts in a file you choose. If the browser cache is cleared, import that file and carry on exactly where you stopped.
Cloud copy (optional)
A cloud copy is only made if you ask for one. It holds your progress as one JSON blob and is linked to your email address only so we can send an approval or recovery link. There is no password.

There is no cloud copy yet. Use "Save or import" in the header and then "Save to the cloud" to create one. You confirm your email address once; after that the sync code is the only credential.

Your account
Deleting the cloud copy removes your progress, your streak, your submissions, your sync code, your sessions and your email address from our servers, and signs you out on every device.

You have no cloud copy, so there is nothing to delete.

3. How We Use Information

  • To keep your optional Cloud Copy signed in across devices and calculate streaks and leaderboards (only your random display name and solve counts appear on public leaderboards — never emails or source code).
  • To deliver requested single-use verification or recovery emails.
  • To enforce rate limits and defend the platform against automated abuse or denial-of-service floods.

4. Third-Party Services & Google AdSense

We rely on a small set of third-party infrastructure and monetization providers:

  • Google AdSense (Advertising): Google serves display advertisements on supported pages. Third-party vendors, including Google, use cookies or device identifiers to serve ads based on a user’s prior visits to this website or other websites. Google’s use of advertising cookies enables it and its partners to serve ads based on your visit to DataArena and/or other sites across the Internet. You can opt out of personalized advertising by visiting Google My Ad Center or aboutads.info, and review Google’s Advertising Privacy Policy.
  • Cloudflare (Workers, D1 Database & Edge Delivery): Hosts our optional Cloud Copy account API and D1 database under processor terms.
  • Email Delivery Provider (Resend / configured SMTP): Receives your email address solely when sending your requested sign-in or recovery email.
  • Cloudflare Web Analytics: Cookie-free aggregate page view analytics recording no personal identifiers and setting no cross-site tracking cookies.

5. Cookies & Consent Management

First-party cookies: DataArena sets zero advertising, analytics, or cross-site tracking cookies of its own. When you explicitly create or open an optional Cloud Copy, we set only one strictly necessary session cookie: da_session (HttpOnly, Secure, SameSite=Lax, 30-day expiry), containing an opaque session token with no embedded personal data. It is cleared immediately when you sign out or delete your Cloud Copy.

Third-party advertising cookies & regional consent: When Google AdSense serves display ads, Google may use advertising cookies or device identifiers depending on your region. For visitors in the European Economic Area (EEA), the UK, and Switzerland, Google’s certified Privacy & Messaging Consent Management Platform (CMP) presents Accept / Manage / Consent options before personalized ads load. Visitors anywhere in the world can also opt out of personalized ads via Google My Ad Center or browser cookie controls.

6. Data Retention & Deletion

Local data stays on your device until you clear it. Optional Cloud Copy records persist until you click Delete my account in the controls above or on the Account page, which immediately deletes your email record, hashed sync code, session hashes, submissions, and streak. Verification links expire after 24 hours (new accounts) or 1 hour (recovery). Standard edge logs roll off within 30 days.

7. Your Privacy Rights (DPDP Act 2023, GDPR & CCPA)

Regardless of region — including rights under India’s Digital Personal Data Protection (DPDP) Act 2023, the EU/UK GDPR, and US state privacy laws — you may request access, correction, export, or deletion of any personal email record via our Contact page. Verified deletion requests are completed within 30 days.

8. Children’s Privacy

DataArena is not intended for children under 13 (or the applicable minimum digital consent age in your country). Contact us if a minor has submitted an email address for Cloud Copy sync so we can erase it promptly.

9. Updates & Contact

Material updates to this policy will be reflected in the revision date above and surfaced in the site interface. Reach us anytime on the Contact page.