Compile Academy Start learning

Privacy policy

This English version is a courtesy translation. Only the German version is legally binding. Deutsche Fassung

Compile Academy sets only a single cookie – for your choice in the cookie banner –, uses no tracking and no third-party analytics tools, shows no ads and sells no data. Without an account, your progress stays on your device. Data only leaves your device as far as needed for the features you use – which ones those are is described here.

Controller

The controller for data processing is Leander Rothschuh, Obere Wolkenstatt Str. 14, 82549 Königsdorf, Germany, email rothschuhleander225@gmail.com; there is also the contact form in the legal notice. There is no data protection officer, because there is no legal obligation to appoint one.

Visiting the website (hosting)

The website, learning app and Studio are delivered via Cloudflare Pages by Cloudflare, Inc. (USA) (worldwide delivery network). The former address nexcode.web.app and the download packages are still delivered via Firebase Hosting by Google. When you visit, Cloudflare or Google process technically necessary connection data such as IP address, time, requested address and browser identifier to deliver the pages and fend off attacks. The legal basis is the legitimate interest in secure, working delivery (Art. 6 (1) (f) GDPR). Compile Academy does not analyse this connection data.

Platform status and current learning content

When opened, the website, learning app and Studio ask Compile Academy’s server at Supabase (Supabase Inc.; servers in Ireland, EU) – even without signing in – whether areas are available, whether there are notices and which lessons are current. Your IP address is processed technically in doing so; Compile Academy does not store it. Legal basis: Art. 6 (1) (f) GDPR (reliable operation and maintenance notices).

Operational and error signals

When operational monitoring is switched on, the website, learning app and Studio send a few signals to Supabase: area, roughly summarised page, event type (for example page view, code run, error) and time, plus a random session identifier that only lives in memory and disappears when you close the page. For signed-in accounts the user ID is added. To protect against overload, the server derives a daily changing value from your IP address that cannot be reversed; the IP address itself is not stored. Error reports are filtered; passwords, sign-in codes, answers and entered programs are not part of them. Authorised administrators see the last activity, sign-ins and learning progress from this; “online” is a time-limited estimate. Legal basis: Art. 6 (1) (f) GDPR (finding errors, keeping things running). The signals are deleted automatically after 90 days. No advertising or user profiles are created.

Learning without an account

Without signing in, your progress, XP, drafts and settings stay in the storage of your browser or device. You can export or delete this data in the settings.

Optional account and sync

For an account, Supabase (servers in Ireland, EU) processes email address, display name, avatar, learning progress, XP, settings and saved projects on behalf of Compile Academy so that you can keep learning on several devices. The legal basis is the use of your account under the terms of use (Art. 6 (1) (b) GDPR). When you sign in with Google, Google transmits your email address, your name and possibly your profile picture to Supabase; Google’s privacy notices also apply. Compile Academy sends confirmation, sign-in and recovery emails via Google’s Gmail service. Email sign-in codes and related links are valid for ten minutes and can only be used once. If you voluntarily turn on two-factor sign-in, Supabase stores a secret key for your authenticator app; your app generates the six-digit codes and Supabase checks them when you sign in. The key is only shown on your device during setup; the operator sees neither the key nor the codes. You can turn it off at any time on the account page. The guest and every account have separate local storage. Your account data stays stored until you delete your account on the account page; then the account and related data are deleted.

Weekly leaderboard and inbox

With an account you appear in the public weekly leaderboard with your display name, avatar and your XP of this week (restart on Mondays). Email address, user ID and learning history are not shown there. In the settings or on the leaderboard page you can switch on “Hide me in the leaderboard” at any time. Voluntarily you can choose a coarse region (federal state or country) from a fixed list; it is only used for regional leaderboards, which are only shown from ten active learners, is never detected automatically and can be removed at any time. Leagues (pilot) result from the previous week’s placement. Messages from the operator in the inbox are only visible to you or to all learners; whether you have read them is stored. Legal basis: Art. 6 (1) (b) GDPR, for the voluntary region your consent (Art. 6 (1) (a) GDPR).

Learning analytics

For signed-in learners, lesson and task ID, right/wrong, duration and a random learning session ID are stored for at most 30 days to analyse difficult tasks and drop-off estimates and to improve lessons. Answers and entered programs are not transmitted. Legal basis: Art. 6 (1) (f) GDPR.

AI support

Before you write to Koda for the first time, Compile Academy asks for your consent once per device. When you use the AI support Koda (in the learning app or on the website, with or without an account), your chat messages and the chat so far (at most the last twelve messages) are sent via a Compile Academy server at Supabase to the service OpenRouter (OpenRouter, Inc., USA) and from there to the respective AI provider to generate an answer. The AI providers can be located worldwide; an equivalent level of data protection is not guaranteed there. With free models, OpenRouter or the provider may store inputs or use them to improve their models depending on their terms; their privacy policies also apply. So please do not enter passwords or personal data. The legal basis is your consent (Art. 6 (1) (a) and Art. 49 (1) (a) GDPR); you can withdraw it at any time for the future by no longer using Koda. If you are under 16, ask your parents first. Compile Academy does not store chat content, only counters per request (time, model, length, duration, success) for daily limits and analyses – with an account linked to your user ID, without an account linked to a daily changing value that the server derives from your IP address and a secret key; the IP address itself is not stored and cannot be calculated back from the value. The counters are deleted after 90 days. The chat history stays on your device and can be deleted with “New chat”. Whatever you explicitly choose to “Send to the team” ends up in the operators’ inbox.

Learning reminders (notifications)

Only if you turn on reminders yourself (in the settings or after a lesson) and your browser allows it does your device subscribe to web push messages. For this, Compile Academy stores at Supabase (Ireland, EU) your browser’s push address and keys, language, time zone, preferred time, your last learning day and the length of your streak – with an account also your user ID. From this the server recognises whether you have already learned today; only if not does it send at most two short messages a day, and none after 14 days without learning. They are delivered via your browser’s push service (for example Google, Apple, Mozilla or Microsoft), which receives the encrypted message and your push address for this. The legal basis is your consent (Art. 6 (1) (a) GDPR, § 25 (1) TDDDG); you can withdraw it at any time by turning the reminder off in the settings or blocking notifications in your browser. Turning it off deletes the subscription, as does the push service reporting it as expired or your device not checking in for 90 days. The dot on the app icon is set only by your device itself.

Contact form and email

If you write via the contact form, Compile Academy stores your message, your email address for the reply and – if given – your name at Supabase (Ireland, EU); they appear in the operator’s inbox in the Command Center. Against spam, the server derives a daily changing value from your IP address that cannot be reversed and uses it to limit the number of messages; the IP address itself is not stored. Replies and emails to the operator go via Google’s Gmail. Legal basis: Art. 6 (1) (f) GDPR (answering your request), for questions about your account Art. 6 (1) (b) GDPR. Handled requests are deleted automatically after 12 months; this also applies to “Send to the team” and “Give feedback”.

Compilers and additional runtimes

Many languages run directly in your browser. Some features need third-party services; they are only contacted when you start the feature yourself. The respective provider then receives your IP address and – when running – your code with inputs and settings. So don’t write personal data or passwords into programs you run online. The legal basis is the execution you requested (Art. 6 (1) (b) and (f) GDPR), for OneCompiler your explicit consent (Art. 6 (1) (a) GDPR). For providers outside the EU, an equivalent level of data protection is not always guaranteed; their privacy policies also apply. In detail:

  • Compiler Explorer (godbolt.org, Compiler Explorer LLC, USA) – Studio: compiles and runs C, C++, Java, C#, Go, Rust and other compiled languages and receives your code for that. Studio shows a notice when sending.
  • Kotlin Playground (api.kotlinlang.org, JetBrains s.r.o., Czech Republic) – Studio: runs Kotlin code.
  • OneCompiler (onecompiler.com, provider outside the EU) – learning app: external online compiler, only after your explicit consent.
  • jsDelivr (cdn.jsdelivr.net, worldwide delivery network) – learning app and Studio: loads the Python runtime and tools as soon as you start Python or certain languages; your code is not transmitted.
  • PyPI (pypi.org and files.pythonhosted.org, Python Software Foundation, USA) – loads Python packages that you import or install.
  • esm.sh and the npm registry (registry.npmjs.org, npm, Inc., USA) – Studio: load JavaScript packages that you add.
  • webR (webr.r-wasm.org) – Studio: loads the R runtime when you start R.
  • Signed-in Studio projects are synced with your account at Supabase.

Cookies and browser storage

On your first visit to the website, a cookie banner asks for your choice. It is stored in Compile Academy’s only cookie (“nexcode_consent”, 12 months, then the banner asks again) and also applies to the learning app and Studio. You can change it at any time via “Cookie settings” in the footer of every website page. In addition, Compile Academy stores data in your browser’s storage (localStorage, sessionStorage, IndexedDB and the service worker’s file cache). Necessary and without consent (§ 25 (2) no. 2 TDDDG): progress, sign-in, language choice, your consent for Koda, dismissed announcements, the service worker and the choice cookie. Only with your consent via “Accept all” or “Comfort” (§ 25 (1) TDDDG, Art. 6 (1) (a) GDPR) does Compile Academy remember power-saving measurement, glass guard, last platform status, loading screen and seen notices – without consent they only apply for the moment. None of this is used for advertising, analytics or recognition on other sites, and nothing leaves your device on its own. You can delete everything in the learning app (settings) or via “Clear site data” in your browser. In detail:

  • Progress, XP, settings, drafts and Studio projects – so you can continue where you left off (separately for guest and every account).
  • Sign-in session – only if you sign in, so you stay signed in.
  • Language choice (German or English) – so website, learning app and Studio speak your language.
  • Cookie “nexcode_consent” (necessary) – stores your choice in the cookie banner, 12 months.
  • Power-saving mode and glass guard (comfort) – remember whether your device needs to draw more simply so everything stays smooth.
  • Notices you have seen (comfort) – such as the welcome animation and Koda hint, so they don’t keep coming back; dismissed announcements and your consent for Koda are necessary.
  • Last platform status (comfort) – for starting offline; chat history with Koda (necessary) – so your chat stays until you choose “New chat”.
  • Service worker and file cache – store public Compile Academy files (no personal data) so pages start quickly and also offline. Sign-in sessions and server responses are not stored there.
  • Command Center (administration) – only remembers a sign-in on a private device after an explicit choice.

Fonts

Compile Academy serves all fonts itself. There is no connection to Google Fonts or other font services.

Recipients and third countries

Your data is only received by the services named here and only as far as needed for the respective feature. Supabase, Cloudflare (Cloudflare Pages) and Google (Firebase Hosting) work on behalf of Compile Academy; emails go via a Gmail mailbox from Google. Transfers to Cloudflare, Inc. and Google LLC in the USA are based on the EU-US Data Privacy Framework. For other providers outside the EU, such as OpenRouter or Compiler Explorer, an equivalent level of protection is not guaranteed; they are only contacted when you trigger the feature yourself. There is no disclosure to others, no sale and no use for advertising.

Storage periods at a glance

Data is deleted as soon as it is no longer needed for its purpose. Statutory retention obligations remain unaffected.

  • Browser storage: until you delete it; choice cookie: 12 months.
  • Account, progress, projects and leaderboard data: until you delete your account.
  • Learning analytics: 30 days.
  • Operational and error signals: 90 days.
  • AI support counters: 90 days; Compile Academy does not store chat content.
  • Learning reminders: until you turn them off, at the latest 90 days after your device last checked in.
  • Contact, team and feedback messages: until handled, then 12 months.
  • Connection data at Cloudflare, Google and Supabase: according to their own periods; Compile Academy does not analyse it.

Children and young people

Learning without an account is open to everyone. You may create an account yourself from age 16; if you are younger, you need the consent of your parents or guardians – this also applies to the AI support. Parents who believe their child created an account without consent can contact the operator; the account will then be deleted.

No automated decisions

Compile Academy makes no automated decisions with legal or similarly significant effect and does no profiling within the meaning of Art. 22 GDPR. Leaderboards, leagues and rewards only result from your XP.

Obligation to provide data

You don’t have to provide any data. Without an account, learning works fully on your device; only account, sync, leaderboard and contact form need the respective details.

Your rights and contact

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20) – for example, you can export your progress in the settings at any time. You can withdraw consent at any time with effect for the future (Art. 7 (3) GDPR). Simply contact the operator named in the legal notice.

Right to object

Where Compile Academy processes data on the basis of legitimate interests (Art. 6 (1) (f) GDPR), you can object at any time for reasons arising from your particular situation (Art. 21 GDPR). An informal message to the operator is enough; the processing then ends unless compelling legitimate grounds prevail.

Complaint to the supervisory authority

You can complain to a data protection supervisory authority (Art. 77 GDPR). The authority responsible for Compile Academy is the Bavarian State Office for Data Protection Supervision (BayLDA), Promenade 18, 91522 Ansbach, Germany, www.lda.bayern.de.

Changes to this policy

If Compile Academy’s features change, this policy is updated. The version published here with the date below applies.

Legal notice · Terms of use · Accessibility

Last updated: 25 October 2026