datarekha
Policy Last updated July 3, 2026

Privacy

Short version: we collect as little as we can, we don't sell any of it, and we're upfront about the two third-party scripts we do run — Google Analytics (aggregate traffic stats) and Google AdSense. The longer version is below — in plain English, no dark patterns.

What we collect

Only the things this site needs to work for you:

  • Your email, if you choose to sign in. We use it to authenticate your sessions and recover your account.
  • Your learning progress — which lessons you've completed, your streak, your XP, and the last lesson you visited. This lives on your device first (in localStorage); if you sign in, a copy is kept in our database so it follows you across devices.
  • Anonymized activity events — when a signed-in user starts or completes a lesson, we record the lesson reference and a timestamp so we can show a "live" community feed. We do not record who did it.
  • Standard server logs — IP, user-agent, requested URL — kept briefly for security and abuse prevention by our hosting provider (Vercel). We do not enrich, cross-reference, or sell them.
  • Aggregate usage analytics via Google Analytics (GA4) — page views and general traffic patterns, used only to understand which content helps and to improve the site. We do not use it to identify you personally.

What we don't collect

  • No session-replay tools, heatmaps, browser fingerprinting, or data-broker enrichment.
  • No telemetry from the code you write in the in-browser playgrounds — that code runs locally in your browser via WebAssembly and never reaches our servers.
  • No social-media share trackers.
  • We never sell your personal data, and we don't build advertising profiles ourselves (see Advertising below for what Google's ads do).

Cookies and similar tech

Storage that datarekha sets directly:

  • Auth session (cookie / localStorage entry, managed by Supabase) so you stay signed in.
  • Theme preference (localStorage theme) so light/dark sticks across visits.
  • Progress data (localStorage dr:progress:v1) for the visual journey and streaks.
  • Started-event dedupe flags (sessionStorage) so the live feed doesn't double-count.

Beyond those essentials, two Google scripts may set cookies: Google Analytics sets cookies (e.g. _ga) to measure aggregate, de-identified traffic, and Google AdSense may set advertising cookies to choose and measure the ads you see (see Advertising below). In regions that require prior consent for analytics or advertising cookies — such as the EEA and the UK — Google's consent tooling governs whether those cookies and personalized ads are used.

Advertising

datarekha is free to use and is supported by ads served through Google AdSense. We don't operate our own ad tracking, but Google and its partners use the AdSense script to select and measure the ads displayed on this site.

  • Google may use cookies and similar identifiers to show ads based on your visits to this and other sites, and to cap how often you see a given ad. See how Google uses cookies in advertising.
  • Third-party vendors, including Google, use cookies to serve ads based on a user's prior visits to this website or other websites. Google's advertising cookies enable Google and its partners to serve and measure those ads.
  • You can turn off personalized ads in Google Ads Settings, and opt out of many third-party ad cookies at aboutads.info/choices or youronlinechoices.eu (EU).
  • We never share your name, email, or account data with advertisers.

Where the data lives

  • Hosting: Vercel (vercel.com) serves the static pages.
  • Database & auth: Supabase (supabase.com) — your progress row, magic-link emails, and optional Google sign-in flow.
  • Optional Google OAuth: if you choose "Continue with Google", Google receives a sign-in request from us. Their terms apply to that interaction.

Data centers are typically in the region closest to our user base; this site is currently configured for Supabase's ap-south-1 (Mumbai) region.

Sharing

We do not sell your data. We do not share it with third parties for their marketing. The only entities that touch it are the processors listed above (Vercel, Supabase, and Google when you choose Google sign-in) — each acting under their own terms to provide the service.

Your rights

  • Access: while signed in, you can see your progress on every page. Email us for a full export.
  • Deletion: email us to delete your account; we remove your profiles, progress, and comments rows. Anonymized activity events have no link to you and are kept.
  • Withdraw consent: clear your browser data, or sign out, and we stop syncing.

Children

The site is intended for users 13 and over (16 in the EEA). We don't knowingly collect data from younger children. If you believe a child has signed up, contact us and we'll delete the account.

Security

All data in transit is TLS-encrypted. Database access is gated by Supabase Row-Level Security — by policy, only you can read or modify your own progress row. Service-role credentials are never exposed to the browser.

Changes

If we materially change how we handle data, we'll update this page and bump the "last updated" date at the top. Returning here is the canonical way to see the current policy.

Contact

Privacy questions, deletion requests, or anything else: team@datarekha.com.

Skip to content