Privacy Policy

1. Introduction

Stanza ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our learning platform, website, browser extension, or any related services (collectively, the "Service").

Stanza is operated from France and complies with the European Union General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA).

By using our Service, you agree to the collection and use of information in accordance with this Privacy Policy.

2. Data Controller

The data controller responsible for your personal data is:

3. Information We Collect

3.1 Information You Provide

When you create an account using GitHub OAuth, we collect the following information from your GitHub profile:

• GitHub username
• Email address
• Profile picture (avatar URL)
• GitHub user ID

3.2 Information Generated Through Use

As you use our Service, we collect:

• Learning progress (courses started, lessons completed, challenges solved)
• Achievements and badges earned
• Preferences and settings you configure

3.3 Analytics Data

We use PostHog, a product analytics platform, to understand how visitors use our Service and to improve the user experience. PostHog is configured to be privacy-friendly:

• No cookies are used (we use localStorage instead)
• Anonymous visitors are not linked to personal profiles
• We do not track users across other websites

For anonymous visitors, PostHog collects aggregated usage data such as page views, feature interactions, and general navigation patterns. For logged-in users, this data may be associated with your account to provide personalized features and improve your learning experience.

4. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve our Service
• Create and manage your account
• Track your learning progress across devices
• Personalize your learning experience
• Send you important updates about the Service (security alerts, policy changes)
• Respond to your inquiries and support requests
• Detect and prevent fraud, abuse, and security issues

6. Data Processors

We use the following third-party service providers (data processors) to help operate our Service:

7. Data Sharing and Disclosure

We do not sell, rent, or share your personal data with third parties for their marketing purposes.

We may disclose your information only in the following limited circumstances:

• Legal Requirements: When required by law, subpoena, or other legal process
• Protection of Rights: To protect the rights, property, or safety of Stanza, our users, or others
• Business Transfers: In connection with a merger, acquisition, or sale of assets, in which case you will be notified

Sponsor Reporting (Aggregated Data Only)

Some courses on Stanza may be sponsored by technology companies. We may share aggregated, anonymized statistics with sponsors about their sponsored content, such as:

• Total number of enrollments and completions
• Average completion rates
• General demographic breakdowns (e.g., "60% of completers use VS Code")

We never share individual user data with sponsors. All reports use k-anonymity principles - metrics with fewer than 10 users are suppressed or grouped to prevent identification.

8. Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes outlined in this Privacy Policy:

• Active Accounts: We retain your data while your account is active
• Account Deletion: When you delete your account, we will delete your personal data within 30 days, except where we are required to retain it for legal purposes
• Inactive Accounts: Accounts inactive for more than 3 years may be deleted along with associated data

11. Cookies and Local Storage

We use only essential cookies that are strictly necessary for the operation of our Service. These cookies are used for authentication purposes only and do not track your activity across websites.

Our analytics provider (PostHog) uses localStorage (not cookies) to store a randomly generated identifier for distinguishing unique visitors. This does not require consent under GDPR as it is not a cookie.

For more information, please see our Cookie Policy.

12. Data Security

We implement appropriate technical and organizational security measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. These measures include:

• Encryption of data in transit using TLS/SSL
• Secure authentication via GitHub OAuth
• Regular security assessments and updates
• Access controls limiting who can access personal data

However, no method of transmission over the Internet or electronic storage is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.

13. International Data Transfers

Your data may be transferred to and processed in countries outside of your country of residence. When we transfer data outside the EEA, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses approved by the European Commission.

14. Children's Privacy

Our Service is not directed to children under the age of 16. We do not knowingly collect personal data from children under 16. If you are a parent or guardian and believe your child has provided us with personal data, please contact us at hello@stanza.dev, and we will delete such information.

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any significant changes by posting a notice on our Service or sending you an email. Your continued use of the Service after such changes constitutes your acceptance of the updated Privacy Policy.

16. Contact Us

If you have any questions about this Privacy Policy, wish to exercise your privacy rights, or have concerns about how we handle your data, please contact us:

You also have the right to lodge a complaint with your local data protection authority (in France: CNIL - Commission Nationale de l'Informatique et des Libertés).