Privacy Policy

1. Who is responsible

42CodeLens is operated under the name SBG by an individual operating as a sole proprietor based in Morocco (see the Terms of Service, section 1). For the data described on this page, that individual is the data controller — 42CodeLens is not a company. For payment data, Paddle acts as an independent controller; see section 5.

2. What we collect, and why

Account data

When you create an account we store your email address, an optional display name, and the date the account was created. Your password is handled by our authentication provider and is stored by them as a salted hash; we never see it. We use this to identify your account, to sign you in, and to send the transactional emails below.

Authentication data

Signing in issues session tokens. A long-lived refresh token is stored in your browser so you are not signed out on every page load. These identify your session; they are not used to profile you.

Purchase and entitlement data

If you buy Premium we store a record of the purchase so we know your account is entitled: the amount and currency, the payment provider's transaction reference, the email associated with the transaction, and the resulting entitlement and its status. We also store the payment notifications Paddle sends us, so a payment can be reconciled or a refund traced.

We do not receive or store your card number, expiry date or security code. Those are entered on Paddle's checkout and never reach us.

Transactional email

We send account emails — confirm your address, reset your password. These are sent through our mail provider from a no-reply address. We do not send marketing email and there is no mailing list.

Product analytics (first-party)

To learn which parts of 42CodeLens are used, the site reports a small set of events to our own server — no analytics company is involved. An event is one of: a screen of the app was opened (recorded as an app location such as /learn/C04, never a web address with a query string); a lesson, project, Handbook chapter, lab, workspace or practice screen was opened (by its identifier); the Premium checkout was opened; and how long the tab was visible. The time of each event is taken from our server's clock.

With those events the browser sends context that our server reduces before anything is stored:

• Where you came from — the referring website is kept as its host name only (for example google.com); its path and query are discarded. Campaign tags in the link (utm_source, utm_medium, utm_campaign, utm_content) are kept when they look like campaign names; utm_term is never stored.
• Browser and device — your browser's user agent is reduced to a browser family, an operating-system family and a device class (phone, tablet or desktop). Versions and device models are not kept.
• Language and approximate country — the two-letter language of your browser, and a country derived from your browser's time zone. The time zone itself is not stored.
• Visit and session — a random session identifier that lives only in the current tab and ends when it closes, and whether this browser has visited before.
• Automation — requests from known bots and automated browsers are marked as such and counted separately from people.

IP addresses are not stored in analytics. To count unique visitors, our server combines your IP address and user agent with a random value that changes every day and keeps only a one-way hash of the result. The address is used for that calculation in memory and is never written to the analytics database, and each day's random value is deleted after two days, so a stored visitor key cannot be traced back to an address or linked across days.

If you are signed in, these events are linked to your account, so we can see, for example, when an account was last active and which parts of the product it opened. Nothing is linked to an account from the browser's say-so: our server verifies your sign-in token first. If you are not signed in, events are not linked to any account.

Analytics is off if your browser sends Global Privacy Control or Do Not Track, and you can switch it off yourself in Settings → Privacy. We use these statistics only to understand and improve 42CodeLens. They are not shared, sold or used for advertising, and they are not sent to Paddle or to any analytics provider.

Security records

Separately from analytics, the server records security-relevant events — a rejected sign-in token, a refused request for protected content, a payment notification with an invalid signature, a rate limit being reached. A record holds the kind of event, the part of the service involved, a status or reason code and, if you were signed in, your account identifier. It does not hold your IP address. These records exist to protect the service and your account.

Data stored only in your browser

Some things never leave your device. 42CodeLens uses local browser storage for your sign-in refresh token, your reading position in the Handbook, your learning progress, and interface preferences such as whether the sidebar is collapsed. Your progress is currently local to the browser you used, and is not synchronised to our servers. Clearing your browser data clears it.

Analytics adds three small entries and no cookies: the tab's session identifier and landing context (in session storage, removed when the tab closes), a flag noting that this browser has visited before, and your analytics opt-out choice if you make one (both in local storage).

Technical data

Our hosting provider processes standard server request information such as IP address and user agent in order to serve the site and protect it from abuse. Our server also uses your IP address, briefly and in memory only, to apply request limits. We do not combine this request information with your account to build a profile of you.

3. What we do not do

• There is no third-party analytics or tracking — no Google Analytics, no advertising pixels, no session recording, no cookies for analytics, no fingerprinting.
• Analytics never records what you type, the code you write, your mouse movements, the text of lessons, your password, sign-in tokens or payment details.
• We do not sell or rent personal data. Ever.
• We do not use your data for advertising or for automated decisions that produce legal effects for you.

4. Legal bases

Where the GDPR or a comparable law applies to you, we rely on: performance of a contract (running your account and delivering Premium you paid for), legitimate interests (keeping the service secure and working, and understanding through first-party analytics how it is used so it can be improved — which you can switch off at any time), and legal obligation (keeping records of sales where required).

5. Who else processes your data

• Supabase — authentication and database hosting for accounts, entitlements, analytics and security records. Processor.
• Paddle.com Market Ltd — Merchant of Record for purchases. Paddle collects and processes payment data under its own terms and privacy policy, as an independent controller for that data.
• Hostinger — web hosting for this website.

We do not use any other third-party service that receives your personal data.

6. International transfers

These providers operate outside Morocco, so your data is processed abroad, including in the European Union and the United States. Where transfer safeguards are legally required, we rely on the mechanisms our providers put in place, such as standard contractual clauses.

7. How long we keep it

Your account data is kept while your account exists. If you delete your account, the account and its entitlement records are deleted with it.

Records of a completed sale may be retained after that where we are required to keep them — for accounting, tax or fraud-prevention purposes, or to evidence that a purchase and any refund took place. We keep no longer than is necessary for those purposes.

Analytics events are deleted automatically after 395 days (about 13 months). Daily totals — counts of page views, visitors and sessions, with nothing about any individual — are kept. The daily random value used for visitor keys is deleted after two days. Security records are deleted after 180 days. If you delete your account, its analytics events are unlinked from it; security records keep only the bare identifier of the deleted account until they expire.

8. Security

The site is served over HTTPS. Premium material is authorised on the server for every request — a browser cannot grant itself access. Access to the database is restricted by row-level security so one account cannot read another's records. Payment card data never reaches our systems.

No system is perfectly secure, and we do not claim certification under any particular standard.

9. Your rights

Depending on where you live you may have the right to access your data, to correct it, to delete it, to receive a copy, to object to or restrict certain processing, and to complain to your data protection authority.

To exercise any of these, write to support@42codelens.com. You can delete your account yourself from your account panel, which removes your account data and entitlement records.

To stop analytics, switch it off in Settings → Privacy, which takes effect immediately, or enable Global Privacy Control or Do Not Track in your browser, which takes effect from the next page load.

For data Paddle holds about your purchase, contact Paddle directly through Paddle's buyer support.

10. Children

42CodeLens is not directed at children under 13, and we do not knowingly create accounts for them. If you believe a child has created an account, write to support@42codelens.com and we will remove it.

11. Changes

If this policy changes, the date at the top of the page changes with it. If a change materially affects how we handle your data, we will make that clear rather than editing the page quietly.

12. Contact

Privacy questions or requests: support@42codelens.com.