insidcode Privacy Policy

We adhere to strict data minimization principles. We only collect information strictly necessary to operate our programming platform:

• Authentication & Social Profile Data: We operate a password-free platform. When you sign in via Google OAuth or GitHub OAuth, we receive your verified email address, display name, public profile image (avatar), and provider-specific account identifier. You may disconnect a linked OAuth provider at any time via Account Settings; disconnection removes the token from our systems but does not affect the third-party provider's own records.
• User-Provided Account Details: You may customize your platform username, display name, biography, college branch, and selected titles. You may permanently delete your account via Account Settings at any time.
• Code Submissions & Practice Metrics: We store source code submissions, selected programming languages (Python, JavaScript, C, C++, Java), execution runtimes, problem completion status, practice streaks, 1v1 Duel outcomes (wins, losses, Elo rating, Duel Points, Duel Rank, Duel Ratio), and earned Experience Points (XP).
• Cookie & Consent Preferences: We store your cookie preference selections (Necessary, Functional, Analytics) and the version of the cookie policy you consented to. You can review or update these at any time via the Privacy Choices link in the site footer.
• Security & Audit Metadata: Safe request metadata including system IP addresses, user agent headers, and request timestamps are processed solely for security audits, automated abuse prevention, sliding-window rate limiting, DDoS mitigation, and server integrity.

* We do not collect physical home addresses, government identification numbers, or phone numbers.

We process your data strictly under valid legal bases:

• To provision your user account and verify code solutions against server-side test suites.
• To compute fair ranking metrics, calculate daily practice streaks, and reward XP achievements.
• To calculate and display Duel competitive metrics including Elo rating, Duel Points, Duel Rank, and Duel Ratio.
• To enforce community safety, detect automated malicious scripts, and prevent unauthorized scraping.
• To communicate critical account alerts, system updates, and security announcements.
• To process voluntary account deletion requests and remove associated data upon request.
• To honor cookie consent preferences and restrict optional data collection accordingly.

* We never sell, rent, monetize, or trade your personal information with third-party advertisers.

To protect users, maintain fair competition, and safeguard infrastructure, insidcode actively monitors for unauthorized access, privilege escalation, automated scraping, and malicious code execution:

• Security Event Logging: When an account attempts unauthorized access to privileged administrative endpoints or manipulates server resources, the incident (including timestamp, endpoint, HTTP method, and account ID) is recorded in an immutable security audit ledger.
• Suspension Data Retention: Information regarding policy violations, account suspensions, and administrative actions may be retained as necessary for security enforcement, moderation, dispute handling, and legal compliance.

When you run or submit code, your instructions are dispatched to an isolated execution sandbox. The execution environment enforces strict security boundaries:

• Subprocess execution runs with strictly non-root permissions.
• Outbound network sockets are disabled to prevent data exfiltration.
• Strict memory and wall-clock execution limits (3.0 seconds) terminate runaway infinite loops.
• Source files are processed in ephemeral containers and wiped after test evaluation.

We partner with reputable infrastructure providers:

• MongoDB Atlas: Secure cloud database hosting with encrypted storage at rest (AES-256).
• Google OAuth & GitHub OAuth: Identity verification protocols.
• Vercel Inc.: High-availability application hosting, edge caching, and DNS routing.

If you reside in the European Economic Area (EEA), you possess enforceable data rights:

• Right of Access: Request a complete copy of your stored personal data.
• Right to Rectification: Update inaccurate account details directly via Account Settings.
• Right to Erasure ("Right to be Forgotten"): Request permanent account deletion via Account Settings.
• Right to Data Portability: Export your submission history and practice statistics.

For California residents:

• We do not sell personal information for monetary or other valuable consideration.
• You have the right to request disclosure of categories of personal information collected.
• You will not receive discriminatory treatment or diminished service quality for exercising your privacy rights.

insidcode is strictly directed to university students, working professionals, and individuals aged 13 and older. We do not knowingly solicit or collect personal information from children under 13. If you believe a child under 13 has created an account, please contact us immediately.

If you have questions, feedback, or legal inquiries regarding this Privacy Policy, reach out to us:

Email: contactphoenixfy@gmail.com