Privacy notice

If you have no account

You can read lessons and run Python without signing in. Python runs inside your own browser, so the code you write and run in that state never reaches our servers at all. Nothing is saved, which is the trade: close the tab and it is gone.

The activity log does not record the visit either. It accepts events only from a signed-in session, and a browser carrying no session is turned away before anything is written, so browsing this way leaves no row with your name on it and no row with anybody's name on it. Ordinary web-server logs are a separate matter and are outside what this application controls.

What is stored when you do have an account

All of it is tied to your account so the platform can show you your own work, grade it, and let your instructor help you.

Your account

Your name, your email address, your role, a student id and title if you have been given one, the timestamp of your last activity, and, if you signed up through the public form, the timestamp at which you confirmed you were 18 or over and agreed to the terms. Signing in with Google hands us your name and address and we keep those two; the rest of your Google profile is not copied here, no access token is stored, and we never see a password. Your session is a signed cookie, not a row in a table.

Your enrollment

Which courses you are in, your role in each, whether the enrollment is invited, active, or dropped, and the date it was created.

Anything you type into a profile

Optional fields such as a preferred name, phone, school, city and state, subjects, years of experience, and your answers to any application questions. All of it is optional and you can leave every box empty.

The code you write

Every submitted attempt: the code itself, whatever it printed, the error text if it failed, whether it passed, the score, and how many hidden tests passed. Attempts are kept per exercise, not just the last one.

Your progress and your XP

Per lesson: status, score, number of attempts, how many times you asked the tutor, how many times you opened the visualizer, and when you were last active. Plus your XP total, your daily XP, which exercises you have completed, and which individual hints you revealed.

Your graded work

Submissions, scores, whether a score was set by hand or by the automatic grader, the grader's written feedback, per-criterion marks, and anything you typed or linked as part of a project submission.

Your AI tutor conversations

The full text of every message, yours and the tutor's, with its hint level and timestamp, kept per lesson.

What you opened, and for how long

An append-only activity log: page views (path only), lesson and exercise opens, code runs, tutor messages, and engaged time on a page. It records the verb, the object, the course, a browser session id, and a duration.

Things you post

Discussion posts and replies, with your name and role attached, and a record of which announcements you have read.

What is not stored

These are worth stating because most sites cannot state them.

Your IP address, anywhere we can read it

The course itself never sees it. There is no column for it and no code path that could fill one, so it is not attached to your account, your work, or your activity log. One honest caveat: this site runs on Google Cloud, and the web server in front of it keeps ordinary request logs the way every web server does, which include the address you connected from. Nobody here reads those to look at a person, and they are not joined to anything else, but it would be wrong to tell you the number never touches a disk.

Your browser or device fingerprint

The user-agent header is never read by the course and never stored against you, and there is no fingerprinting script of any kind. It appears in the same ordinary web server logs described above.

Your code or your chat text inside the activity log

The activity log rejects them structurally: keys named code, message, text, traceback, prompt, reply, and content are dropped before an event is written, and only short scalar values on a per-event whitelist survive at all. Page paths have their query string and hash stripped, so nothing can ride along in a URL.

Third-party analytics

There is no Google Analytics, no Plausible, no PostHog, no Mixpanel, no Segment, no Hotjar, and no advertising pixel anywhere in the site. The only usage tracking is the first-party activity log described above, which posts to this site and nowhere else.

Anything sold, rented, or shared for advertising

None of it, ever. There is no advertising on this platform and nothing here is a product to sell.

The AI tutor, in detail

The tutor is the part of this platform with the most privacy weight, so here is the whole of it.

When you ask the tutor something, what is sent to the model provider is: your message, the conversation so far, the lesson you are on and its objectives, a summary of your learning profile, the code currently in your editor and the error it produced, and your last few submitted attempts including their error output. In production that provider is OpenAI. Your name and email address are not part of that request.

Every message in the conversation is then stored on your account. That is the default and it is on. Course staff for a course you are enrolled in can read those conversations word for word, and the instructor dashboards do exactly that.

The “Start over” button does not delete anything. It writes a marker into the stored conversation and your panel then shows only what came after it. The earlier messages stay on the record and staff still see them. This is deliberate, so that a record of how somebody was helped cannot be erased, but you should know it before you type.

The practical rule: treat the tutor like something you said out loud in a classroom, not like a private notebook.

Who else touches your data

Google

Sign-in (you authenticate with a Google account), and the hosting and database this site runs on, which are Google Cloud services in the United States.

OpenAI

Runs the model behind the AI tutor and the model that grades project submissions. Receives what is listed above; receives nothing else.

Resend

Sends the platform's email, such as course announcements. Receives your email address and the message.

jsDelivr

A public code CDN. Your browser downloads the Python runtime from it the first time you run code, so your browser makes a request to that CDN. We send it nothing about you.

YouTube

The course videos are embedded from YouTube in its no-cookie mode. Playing a video is a request from your browser to YouTube.

Who can see your work

Staff of a course you are enrolled in: the instructor, any teaching assistant assigned to that course, and the administrator of the platform. They can see your submissions, your grades, your attempts, your progress, and your tutor conversations. That is the point of having an instructor.

Say the uncomfortable half of that plainly: staff access follows the account, not only the course. A teaching assistant scoped to one course reaches only the students they share an active course with. An administrator, or anyone whose account role is instructor, reaches any student on the platform, tutor conversations included. That is a small, named group of people rather than a company, but it is wider than the course you signed up for and you should know it.

Other students see almost nothing: the course roster hands them your name and your role in the course and nothing further, not your email address and not a grade. Your discussion posts are visible to everyone in that course, which is what a discussion board is for.

Research

No research data is collected from people who enroll in Introduction to Python through the public sign-up. The pre-course and post-course research surveys that run in the invited cohort programs are not part of this course, you will not be asked to consent to anything, and your work here is not part of a study.

How long it is kept

Indefinitely, until somebody deletes it. There is no automatic expiry, no scheduled purge, and no retention window, because no code enforces one. We would rather say that than promise a period nobody is actually enforcing.

Getting your data, or getting it deleted

There is no button for this. The platform has no self-service delete, so the honest answer is a person and an email address. Write to adisak@iastate.edu from the address you signed in with and say what you want: a copy of what is held about you, a correction, or deletion of your account and your work. It is handled by hand.

Who this is for, and where it runs

You must be 18 or over to hold an account. The course is offered from the United States and its hosting, database, and email are in the United States, so your data is processed there.

The AI Program is built at the Iowa State University Department of Computer Science. The cardinal and gold palette is an homage; see about for the trademark note.

Changes

If what the platform stores changes, this page changes with it and the date at the top moves. It is not a document that gets to drift away from the software it describes.