This policy explains how Kodivo, the programming learning service at kodivo.dev, handles personal data.
Controller and contact
The controller is Jakub Lipiński, operating a Polish unregistered business. Contact: [email protected].
Data and purposes
- Account: your name, email, securely stored password, email verification and optional two-factor authentication and passkeys. These create and protect your account.
- Learning: technology and experience preferences, settings, lesson progress, reading position, answers and whether a solution was used. These provide and personalise learning.
- Age and terms: your declaration that you are at least 16, and the date and version of accepted terms. These apply access rules. We do not collect new birth dates or guardian details.
- Contact and security: correspondence, technical and security logs, including IP addresses where recorded by the server, and session information.
- Optional analytics: with your permission, visit and usage information processed using Google Analytics 4.
- Support: amount, currency, contribution status, Stripe payment and event identifiers and payer email where provided during checkout. These support payment processing, confirmation, refunds, security and accounting. We do not store card numbers or CVC codes.
If you choose GitHub or Google sign-in, we receive your provider user ID, name, email address and email-verification information. We store the provider and user ID to connect your Kodivo account. Pending registration details expire after 10 minutes. We do not store provider access tokens, request repository access or load tracking scripts for social sign-in. The provider receives the authorization request and handles sign-in under its own privacy policy: GitHub or Google. Their services may process data outside the EEA. Connected identities are deleted with your Kodivo account.
Legal grounds
Providing accounts and learning relies on performance of a contract or pre-contractual steps (GDPR Article 6(1)(b)). Security, correspondence, establishing or defending claims rely on legitimate interests (Article 6(1)(f)). Where a legal obligation applies, Article 6(1)(c) applies. Optional analytics uses consent (Article 6(1)(a)) and applicable rules on access to information on your device.
Accepting terms is not blanket permission for marketing or all processing. Age 16 is Kodivo's access policy. GDPR Article 8 concerns certain services offered to children when processing relies on consent; it does not set the contractual age for every online service.
Processing your voluntary contribution relies on GDPR Article 6(1)(b), accounting obligations on Article 6(1)(c), and fraud prevention and claims on Article 6(1)(f). We do not publish a list of individual contributors.
Providers and location
The service uses Hostinger VPS infrastructure in Frankfurt, Germany. The operator runs its own mail server. Infrastructure providers may process data needed to operate the service. With analytics permission, Google, including Google Ireland Limited and associated entities, receives analytics data.
Google services may involve processing outside the EEA, including the United States. Depending on the recipient and service, transfer mechanisms include applicable adequacy decisions or standard contractual clauses. See Google's privacy policy and transfer frameworks.
Stripe processes payments and receives the information needed to complete payments and prevent fraud. Stripe may act as a separate controller for its own obligations. Its services may involve transfers outside the EEA under the safeguards described in Stripe’s privacy policy.
Retention
Account and learning data is kept while the account is maintained. Linked guardian requests are deleted with the account; outdated unresolved requests may be removed earlier during housekeeping. Correspondence and necessary dispute evidence is kept until the matter is resolved and, where justified, the applicable limitation period expires. Logs are retained as needed for diagnostics and security. Backups rotate according to server settings; deleted data may remain in a backup until it is overwritten and is not used for ordinary account operations.
Birth dates from the previous model are cleared when the new terms are accepted. Historical guardian requests no longer control access or send new invitations. They remain linked to the account only as needed for previous matters or claims and are deleted with the account. Contribution records are retained for the periods needed for accounting and establishing or defending claims, independently of a learner account.
Your rights
You may request access, correction, deletion or restriction and, where applicable, data portability. You may object to legitimate-interest processing and withdraw consent for processing based on consent. Contact [email protected]. Account deletion is also available in settings. You may complain to the Polish supervisory authority, the President of UODO (uodo.gov.pl), or another competent supervisory authority.
Age and optional information
Accounts are available from age 16 based on the learner’s declaration, without additional guardian confirmation. New users do not provide birth dates. Analytics and financial support are optional and never required for learning. Contributions are for adults.
Optional AI application connections
If you connect your own AI application through MCP, we make published lessons and your learning preferences, lesson position, completion history and check state available to that application. It can save learning activity and submit answers on your behalf. We record AI assistance separately from independent check outcomes. Learning tools do not expose your email, password, payment details or other learners' data.
We process the learning data needed to provide the integration you request on the basis of performance of the service agreement (Article 6(1)(b) GDPR). Connection security and necessary technical logs rely on our legitimate interest in protecting accounts (Article 6(1)(f)). Browser authorization lets a named application act for your account; it is not general consent to unrelated processing. You can use Kodivo without connecting AI.
We store application identifiers, authorization codes, access and refresh token records, requested permissions, expiry/revocation state and the time of the last successful learning-tool request. Access tokens last up to one hour; refresh tokens last up to 30 days and may be replaced when used. Expired or revoked credentials are removed by scheduled maintenance; expired records are retained for up to eight additional days after the associated refresh authorization expires. Learning progress and assistance markers follow the account-data retention period. Account deletion removes associated connection records. Kodivo does not store your external AI conversations or local project files through this integration.
The recipient is the application you authorize and, depending on its setup, its AI or infrastructure provider. For the supported clients, see the OpenAI privacy policy and Anthropic privacy policy. Their roles, retention, model-training settings and any processing outside the EEA depend on your selected service, account and settings. Before connecting, review its applicable terms, privacy information and transfer safeguards. Kodivo does not guarantee a provider's retention or training practices.
You can revoke an application's access in Learn with AI. This prevents further authorized access and preserves your Kodivo progress. It does not erase copies already received by an external provider; use that provider's controls or contact it to exercise the relevant rights.
Daily goals and requested email reminders
If you configure a daily goal, we store the selected number of lessons, your timezone and when preferences were saved. When you save the form with email reminders selected, you request reminders about that goal. The reminder option is selected by default in onboarding and can be deselected before saving. Existing accounts are invited to configure the feature; reminders are not automatically enabled for them. These are learning service messages, not a subscription to promotional campaigns.
Reminders are scheduled for 18:00 in your saved timezone while the daily goal remains unfinished and another published lesson is available. We use your lesson completion dates and last authenticated app visit to decide whether a reminder is needed. We pause after 5 reminders without a return visit and resume after you return while reminders remain enabled. We do not use email-open tracking pixels to measure return visits.
We process goal preferences and requested reminders to provide the optional service you choose (Article 6(1)(b) GDPR). We keep the current reminder setting, its latest enabling/disabling timestamps, timezone, last app visit and delivery records showing the local day, target, attempt time, status and send time. Delivery records help prevent duplicate emails, apply the inactivity limit and investigate problems; this operational processing relies on our legitimate interest in reliable delivery (Article 6(1)(f)). We do not retain full reminder content in those records. A send record means acceptance by our mail transport, not confirmed inbox delivery.
The mail delivery provider configured for Kodivo receives your email address and the reminder content as needed to send it. Goal, preference and delivery records remain linked to your account and are deleted when your account is deleted. Disable reminders in settings or through the unsubscribe link in any reminder. Turning them off stops future reminders, including pending messages not already handed to the provider, and preserves your goal and learning progress. Ordinary verification, password-reset and other necessary account messages are separate.