Privacy

Privacy policy

Effective date: November 13, 2026

CppPath (cpppath.com) is operated by a sole proprietor based in the United States, who is responsible for the information described in this policy. CppPath is currently available only in the United States. For privacy questions or requests, contact support@cpppath.com.

Information in your browser

CppPath uses local storage for learning progress and results, code drafts and project checklists, preferences such as your theme and saved lessons, your signed-in session, sync state, billing and usage caches, and compiler-result cache. It uses session storage for a browser-session Practice state. For signed-in users, CppPath also keeps downloaded lesson and exercise content in IndexedDB on this browser.

CppPath doesn't set its own cookies and doesn't use analytics, advertising, or tracking. Checkout and the customer portal open on pages that Polar Software, Inc. (Polar) hosts at polar.sh. Polar's own cookies and tracking on those hosted pages are covered by Polar's Privacy Policy. CppPath doesn't change its behavior in response to Do Not Track or Global Privacy Control signals. Google Fonts and Cloudflare Turnstile load from those providers and are covered by their own privacy notices. CppPath does not load a Polar script. Guest progress, Playground code, appearance settings, and compiler-result cache stay on this browser. Clear site data in your browser settings to remove local data, including guest progress and drafts.

Accounts and cloud progress

Supabase Auth handles your email address, password, and session. CppPath stores your username in your account profile. When you create an account, CppPath records that you confirmed you're at least 18 and have reached the age of majority where you live, agreed to the Terms of Service, and confirmed that you read the Privacy Policy, with the document versions. After this browser is linked to your account, Supabase stores synced lesson, quiz, challenge, exercise, checkpoint, project, Practice review schedule, saved-lesson, and most-recent-lesson data, plus challenge and project code drafts. If this browser already has progress, CppPath asks before syncing it. Each synced code draft can contain up to 64 KB. Playground code, appearance settings, and compiler-result cache do not sync.

Free usage records track lesson, exercise, and Practice starts. CppPath stores daily AI assist counts and short-window AI rate-limit counts. Billing records identify your Polar customer and subscription and include the product, subscription status, billing interval, period start and end dates, cancellation state, end and ended dates, payment-problem date, and access-revocation date and reason.

Account and deletion emails

Supabase Auth sends account emails through Resend. The account-deletion flow also sends a confirmation email through Resend. These services process the email address and message details needed for each flow.

When you email support, Cloudflare Email Routing forwards your message to CppPath's support mailbox.

Payments

Polar Software, Inc. (Polar) is the merchant of record and authorized reseller for CppPath orders. Polar processes payments, calculates and collects applicable sales tax and VAT, and issues receipts and invoices. Polar's Buyer Terms identify the seller as Polar Software, Inc., 3500 South DuPont Highway, Dover, DE 19901. Polar invoices show the CppPath name and the card statement descriptor. Polar uses CppPath's Polar identifier, cpppath, on card statements for CppPath charges.

Polar processes payment and billing information under the Polar Privacy Policy. Polar's payment processor, Stripe, Inc., collects your card details. To ask Polar about its handling of your data, email privacy@polar.sh. CppPath does not receive or store full card details. When you start checkout, CppPath sends Polar your account email address and CppPath user ID. CppPath stores the Polar customer ID, the Polar subscription ID, the product, subscription status, billing interval, period start and end dates, cancellation state, end and ended dates, a payment-problem date, and the access-revocation date and reason.

CppPath AI

When you submit a CppPath AI request, CppPath sends your question and available page context to OpenAI. Context can include lesson text, challenge instructions, your code, compiler output, and recent conversation turns held in the current page. CppPath sets store: false on OpenAI requests, so OpenAI doesn't store the response for later retrieval. Separately, OpenAI keeps abuse-monitoring logs of API requests for up to 30 days by default, or longer where the law requires or to protect its services or others from harm. These logs can include your question, the page context, and OpenAI's answer. CppPath does not save AI conversation content. It stores daily usage counts and rate-limit counters. AI answers can be wrong, so check generated code and explanations.

Compiler requests

Only when you choose Run, Check Solution, or a project check, your browser sends a request directly to Wandbox. Wandbox receives your IP address together with the code, standard input, and compiler options for the request. Some checks also send a generated test harness. Wandbox's operator logs requests and does not publish a retention policy. Do not include personal information in code or input.

Hosting, fonts, and rate limits

Supabase keeps service logs for CppPath's backend. API request logs include your IP address and browser user agent, and function logs can include billing identifiers. On CppPath's current Supabase plan, Supabase keeps these logs for 1 day. The period depends on the plan, and CppPath updates this policy if it changes.

Cloudflare hosts CppPath and provides its DNS. Google Fonts loads the Inter and JetBrains Mono fonts from Google. Requests to these providers can include connection metadata such as your IP address and browser details.

When you sign in, create an account, request a password reset, or resend a confirmation email, Cloudflare Turnstile checks that a person, not an automated program, sent the request. Turnstile runs in your browser on those forms only and sends Cloudflare signals about your browser and connection. CppPath receives only a single-use pass or fail token, which Supabase or the username sign-in function checks with Cloudflare.

Username sign-in rate limits use SHA-256 hashes of the client IP address and normalized username. Rate-limit buckets expire after their window and the database removes expired records after one day. Username availability checks use a separate IP-based limit. Account-deletion password attempts use a rate limit keyed by a SHA-256 hash of your user ID.

Account deletion

Start deletion in Settings with your password, then confirm it through the emailed link. Confirmation deletes the Supabase Auth user and its associated profile, synced progress, code drafts, sign-up consent record, CppPath's Polar customer and subscription rows, AI usage records, and deletion request. Account deletion cancels any active Polar subscription immediately and does not refund it. CppPath keeps webhook event records, which contain the event ID, type, and processing outcome, but no user ID. CppPath also keeps billing review records and clears their user ID. Account deletion doesn't delete your customer record at Polar. Polar keeps customer, order, subscription, and invoice records, which include your CppPath user ID as the external customer ID and in metadata. Polar's Privacy Policy says that Polar keeps personal data while needed to provide its services, and longer where needed to meet legal, accounting, or tax obligations, resolve disputes, or collect fees. To ask Polar for access to or deletion of this data, email privacy@polar.sh. Encrypted backups can keep copies of deleted account data until those backups are deleted.

How long CppPath keeps information

CppPath keeps your account, synced progress, code drafts, usage counts, and billing records until you delete your account. Rate-limit records are deleted one day after their window ends. OpenAI keeps abuse-monitoring logs of CppPath AI requests for up to 30 days by default, as described in CppPath AI. Supabase keeps service logs for 1 day on CppPath's current plan. After deletion, CppPath keeps Polar webhook event records and billing review records without your user ID. Polar keeps its own customer, order, subscription, and invoice records under its Privacy Policy. Encrypted backups can keep copies of deleted account data until those backups are deleted.

Why CppPath uses your information

If the GDPR or UK GDPR applies to you, CppPath relies on these legal bases:

• Performance of CppPath's contract with you: your account, progress sync, code drafts, Pro access, the AI help you ask for, the compiler checks you start, and account emails.
• CppPath's legitimate interest in offering CppPath only to adults and on its Terms: the age confirmation and Terms agreement recorded when you sign up.
• CppPath's legitimate interest in keeping the service secure and preventing abuse: rate limits, Turnstile checks, and service logs.
• CppPath's legitimate interest in accurate billing records: the billing event and billing review records kept without your user ID after account deletion.

You need an email address, username, and password to create an account. CppPath doesn't make decisions with legal or similarly significant effects about you based only on automated processing.

Your rights and requests

You can delete your account yourself in Settings. You can also ask CppPath for a copy of your account data, a correction, deletion, or a restriction of processing, and you can object to processing based on CppPath's legitimate interests. If the GDPR or UK GDPR applies to you, you can also ask for your account data in a portable format. CppPath doesn't offer a self-service data export.

To make a request, email support@cpppath.com from the email address on your account. CppPath responds within one month. For a complex request, CppPath can extend that by up to two more months and tells you why.

If you're in the EU, EEA, or UK, you can complain to a data protection authority, such as the one in the country where you live. In the UK, that's the Information Commissioner's Office.

Minimum age

CppPath is for adults. You must be at least 18 years old, or the age of majority where you live if that's higher, to create an account or use CppPath. CppPath doesn't knowingly collect personal information from anyone under 18. If CppPath learns that an account belongs to someone under 18, CppPath deletes the account and its personal information. CppPath also cancels any CppPath Pro subscription on that account and refunds the current billing period.

Where information is processed

CppPath stores account data with Supabase in the United States (AWS us-east-1). CppPath's service providers, including Supabase, Cloudflare, OpenAI, Resend, Wandbox, Google, Polar, and Polar's payment processor Stripe, Inc., can process information in the United States and other countries where they operate.

Polar processes payment information under its own terms and Privacy Policy. Wandbox has no data processing terms with CppPath; your browser sends your code to Wandbox only when you choose Run, Check Solution, or a project check. To ask about these safeguards, email support@cpppath.com.

Changes to this policy

CppPath may update this policy. For a material change, CppPath emails account holders before the change takes effect. The effective date above identifies the current version.