Privacy notice

If you have no account

You can read lessons and run Python without signing in. Python runs inside your own browser, so the code you write and run in that state never reaches our servers at all. Nothing is saved on our side, which is the trade. The editor does keep a draft of your code in your own browser, so a reload does not wipe it, but that copy stays on your machine and is never sent to us.

The activity log does not record the visit either. It accepts events only from a signed-in session, and a browser carrying no session is turned away before anything is written, so browsing this way leaves no row with your name on it and no row with anybody's name on it. Ordinary web-server logs are a separate matter and are outside what this application controls.

Trying to sign in is different. If you are turned away, usually because the Google account you picked has no account here, the instructor is emailed the address you used, so that an invitation sent to the wrong address can be fixed. The course does not keep that address. It exists in that one email, which is sent through Resend, and the activity log keeps only a short one-way hash of it so the same address does not set off a second email within the hour. The hash cannot be turned back into the address, though someone who already knew the address could check it against the hash.

If instead a sign-in breaks partway for a technical reason, such as an old sign-in tab being reopened, the instructor is emailed that someone could not sign in, with the time and the error code and no address, and the activity log notes the same without saying who.

What is stored when you do have an account

All of it is tied to your account so the platform can show you your own work, grade it, and let your instructor help you.

Your account

Your name, your email address, your role, a student id and title if you have been given one, the timestamp of your last activity, and, if you signed up through the public form, the timestamp at which you confirmed you were 18 or over and agreed to the terms. Signing in with Google hands us your name and address and we keep those two; the rest of your Google profile is not copied here, no access token is stored, and we never see a password. Your session is a signed cookie, not a row in a table.

Your enrollment

Which courses you are in, your role in each, whether the enrollment is invited, active, or dropped, and the date it was created.

Anything you type into a profile

Optional fields such as a preferred name, phone, school, city and state, subjects, years of experience, and your answers to any application questions. All of it is optional and you can leave every box empty.

The code you write

It depends on the page. On the practice pages, where Introduction to Python's exercises run, a passing Submit keeps your code, the score, and how many hidden tests passed, one record per exercise that each later pass updates. A Submit that fails there keeps no code, only the result, in the activity log below. On an assignment page inside a course, each Submit keeps your latest code along with your best result. On the older lesson pages, every submitted attempt is kept: the code itself, whatever it printed, the error text if it failed, whether it passed, the score, and how many hidden tests passed, per exercise, not just the last one.

Your progress and your XP

Per lesson: status, score, number of attempts, how many times you asked the tutor, how many times you opened the visualizer, and when you were last active. Plus your XP total, your daily XP, which exercises you have completed, and which individual hints you revealed.

Your graded work

Submissions, scores, whether a score was set by hand or by the automatic grader, the grader's written feedback, per-criterion marks, and anything you typed or linked as part of a project submission.

Your AI tutor conversations

The full text of every message, yours and the tutor's, with its hint level and timestamp, kept per lesson.

What you opened, and for how long

An append-only activity log: page views (path only), including inside the practice pages; lesson and exercise opens; code runs, whether each ended in an error and of what kind, and on the practice pages which exercise it was for; the result of each practice Submit (passed or failed, how many tests passed, and the kind of error, such as NameError, but never the code); tutor messages; engaged time on a page; problems the site hit while you were using it, such as Python not loading, a page crashing, work that did not save, or the tutor failing or stopping you at its limit; and a note each time an alert email about you was sent. It records the verb, the object, the course, a browser session id, and a duration.

Things you post

Discussion posts and replies, with your name and role attached, and a record of which announcements you have read.

What is not stored

These are worth stating because most sites cannot state them.

Your IP address, anywhere we can read it

The course itself never sees it. There is no column for it and no code path that could fill one, so it is not attached to your account, your work, or your activity log. One honest caveat: this site runs on Google Cloud, and the web server in front of it keeps ordinary request logs the way every web server does, which include the address you connected from. Nobody here reads those to look at a person, and they are not joined to anything else, but it would be wrong to tell you the number never touches a disk.

Your browser or device fingerprint

The user-agent header is never read by the course and never stored against you, and there is no fingerprinting script of any kind. It appears in the same ordinary web server logs described above.

Your code or your chat text inside the activity log

The activity log rejects them structurally: keys named code, message, text, traceback, prompt, reply, and content are dropped before an event is written, and only short scalar values on a per-event whitelist survive at all. Page paths have their query string and hash stripped, so nothing can ride along in a URL. Error reports follow the same rule. They record what failed, where, and when, an HTTP status, the kind of error (NameError, say), a reference number for the error, and whether the browser thought it was online. They never record the error message, your code, your chat text, or your browser's user-agent.

Third-party analytics

There is no Google Analytics, no Plausible, no PostHog, no Mixpanel, no Segment, no Hotjar, and no advertising pixel anywhere in the site. The only usage tracking is the first-party activity log described above, which posts to this site and nowhere else.

Anything sold, rented, or shared for advertising

None of it, ever. There is no advertising on this platform and nothing here is a product to sell.

The AI tutor, in detail

The tutor is the part of this platform with the most privacy weight, so here is the whole of it.

When you ask the tutor something, what is sent to the model provider is: your message, the conversation so far, the lesson you are on and its objectives, a summary of your learning profile, the code currently in your editor and the error it produced, and your last few submitted attempts including their error output. In production that provider is OpenAI. Your name and email address are not part of that request.

Every message in the conversation is then stored on your account. That is the default and it is on. Course staff for a course you are enrolled in can read those conversations word for word, and the instructor dashboards do exactly that.

The “Start over” button does not delete anything. It writes a marker into the stored conversation and your panel then shows only what came after it. The earlier messages stay on the record and staff still see them. This is deliberate, so that a record of how somebody was helped cannot be erased, but you should know it before you type.

The practical rule: treat the tutor like something you said out loud in a classroom, not like a private notebook.

Who else touches your data

Google

Sign-in (you authenticate with a Google account), and the hosting and database this site runs on, which are Google Cloud services in the United States.

OpenAI

Runs the model behind the AI tutor and the model that grades project submissions. Receives what is listed above; receives nothing else.

Resend

Sends the platform's email, such as course announcements, and the alert emails to the instructor described below. For an announcement it receives your email address and the message. For an alert it receives the instructor's address and the alert itself, which names the student it is about (or, for a turned-away sign-in, gives the address that was used).

jsDelivr

A public code CDN. Your browser downloads the Python runtime from it the first time you run code, so your browser makes a request to that CDN. We send it nothing about you.

YouTube

The course videos are embedded from YouTube in its no-cookie mode. Playing a video is a request from your browser to YouTube.

Who can see your work

Staff of a course you are enrolled in: the instructor, any teaching assistant assigned to that course, and the administrator of the platform. They can see your submissions, your grades, your attempts, your progress, and your tutor conversations. That is the point of having an instructor.

Say the uncomfortable half of that plainly: staff access follows the account, not only the course. A teaching assistant scoped to one course reaches only the students they share an active course with. An administrator, or anyone whose account role is instructor, reaches any student on the platform, tutor conversations included. That is a small, named group of people rather than a company, but it is wider than the course you signed up for and you should know it.

The course's instructors and teaching assistants, and the administrator, can also open an activity report for the course, built from the activity log: when you signed in and were last active, what you opened, which exercises you passed or kept failing, runs that ended in an error, hints and tutor questions used, any problems the site hit for you, and the alert emails sent about you. For most students it shows totals. For a student on the watch list described next, it lists all of it exercise by exercise, with a timeline.

For students on the instructor's watch list, the instructor is also emailed, through Resend, when the site fails for that student or turns them away (Python not loading, work that did not save, the tutor at its limit) or when they look stuck on an exercise, for example after several failed Submits or runs that keep ending in an error. The email names the student and says what failed, where, and when. It never contains their code, their tutor messages, or an error message. Being on the list does not change what is recorded about what you do. It decides whether an email goes out, with a note in the activity log and a line in the server's own log each time one is tried, and how much detail the activity report lays out about you. The site does not show you whether you are on it.

Other students see almost nothing: the course roster hands them your name and your role in the course and nothing further, not your email address and not a grade. Your discussion posts are visible to everyone in that course, which is what a discussion board is for.

Research

No research data is collected from anyone in Introduction to Python, whether you signed up yourself or were invited. The pre-course and post-course research surveys that run in the separate cohort programs are not part of this course, you will not be asked to consent to anything, and your work here is not part of a study. The activity report and the alert emails exist to run the course and to help you when something goes wrong.

How long it is kept

Indefinitely, until somebody deletes it. There is no automatic expiry, no scheduled purge, and no retention window, because no code enforces one. We would rather say that than promise a period nobody is actually enforcing.

Getting your data, or getting it deleted

There is no button for this. The platform has no self-service delete, so the honest answer is a person and an email address. Write to adisak@iastate.edu from the address you signed in with and say what you want: a copy of what is held about you, a correction, or deletion of your account and your work. It is handled by hand.

Who this is for, and where it runs

You must be 18 or over to hold an account. The course is offered from the United States and its hosting, database, and email are in the United States, so your data is processed there.

The AI Program is built at the Iowa State University Department of Computer Science. The cardinal and gold palette is an homage; see about for the trademark note.

Changes

If what the platform stores changes, this page changes with it and the date at the top moves. It is not a document that gets to drift away from the software it describes.