Privacy Policy
Coding Lab Studio
This policy explains how this application handles information and how to contact us about privacy.
Information we process
Coding Lab Studio stores the tasks and notes you enter, programming-language or topic tags, code snippets and descriptions, skill categories and self-assessed progress, completed focus sessions, timer state, a local display name and preferences on your iPhone using SwiftData. A randomly generated installation secret is stored in the iOS Keychain. There are no user accounts. Optional sync is off initially. When you enable it, tasks, snippets and skills, their identifiers, edit timestamps and deletion markers are sent to our backend; focus-session history, your display name and timer preferences remain local. The backend stores a SHA-256 hash of the installation secret rather than the secret itself. HTTPS hosting necessarily receives network metadata such as IP address, request time, route and technical connection information. Public website and privacy-page visits also reach the hosting infrastructure.
How we use information
Local records support your coding journal, snippet library, skill tracking, timer and statistics. Optional server storage merges your installation’s records using edit timestamps and deletion markers so offline changes can be sent when a connection returns. The secret authorizes access to that installation’s private records; it is not a login or a cross-device recovery mechanism. Local notifications remind you when an interval ends. Technical metadata and limited error logs support service operation, security and diagnosis. We do not include advertising, analytics, email delivery, contact forms or social sign-in services.
Service providers and sharing
Cloudflare terminates HTTPS for our public API and website and forwards requests over HTTPS to our Railway service. Cloudflare therefore processes request contents, authorization headers and technical connection metadata while proxying those requests. Railway hosts the API and PostgreSQL database and processes server records and technical request information as our infrastructure provider. We have not established a fixed retention period for Cloudflare infrastructure or security logs. Application error logs contain request identifiers and limited database error codes, not intentionally logged bearer secrets or record bodies. Railway may process infrastructure and HTTP logs under its platform practices. We have not established a fixed retention period for those provider logs. Apple supplies the device operating system, Keychain, local notifications and any device backup services you choose. We do not integrate third-party advertising or analytics SDKs or sell your journal records. If you export a JSON file, the file is handed to the location or app you choose through the iOS file interface; that destination’s practices apply.
Data retention
Local workspace data remains until you delete it in Settings or remove the application and its data. iOS may preserve Keychain items separately from app data, and device backups are governed by your Apple settings. Server records and deletion markers remain associated with the installation hash until you use Delete all data; no automatic time-based expiry is configured. Turning sync off stops future sync but does not erase existing server records. Exported files remain at the destination you selected until you remove them. We do not promise a fixed infrastructure-log or backup retention duration. Provider snapshots or backups, if present under hosting or device settings, may retain earlier copies until their normal lifecycle ends; the app does not selectively edit those copies.
Deleting your information
Settings provides Delete all data with confirmation. It clears tasks, snippets, skills, sessions, timer and local preferences, and requests deletion of installation records from the active server database if sync was enabled. When offline, a persisted deletion request is retried before further uploads; keep the app installed and allow it to reconnect for server deletion to complete. Exported JSON files and independent device or provider backups are not removed by this action. The retained installation secret can authorize any pending deletion, but losing the secret may make server records impossible to locate or authorize through the app. We do not promise recovery after uninstalling, changing devices or losing that secret.
Permissions and your choices
The app asks for local-notification permission when you start the timer, to display an interval-completion alert. You can decline or withdraw this permission in iOS Settings; the timer continues to calculate elapsed time without an alert. No location, maps, contacts, camera, microphone or photo-library permission is requested. Clipboard access occurs when you choose Copy code or long-press a snippet, which writes that snippet to the system clipboard. Export opens the standard iOS file destination interface. Optional server sync can be turned off in app Settings without affecting local editing.
Your privacy rights
You can inspect and edit your records in the app, export a local JSON copy and use Delete all data. Depending on your jurisdiction, you may have rights to access, correction, deletion, restriction or objection and to complain to a competent privacy authority. Contact branoc.penfold@icloud.com with privacy questions or requests. This is a public privacy contact, not an in-app email or support system. Because there are no accounts and storage is keyed by an installation hash, we may need information sufficient to identify and verify an authorized request; do not email your bearer secret or sensitive code. We cannot identify anonymous installation data from a name or email address alone.
Security
Public HTTPS terminates at Cloudflare, which proxies requests to the Railway origin over HTTPS. The app uses HTTPS for the deployed API, a randomly generated installation-scoped bearer secret in Keychain, and server-side authorization by the secret’s SHA-256 hash. Each installation can read, merge and delete only its own rows. The backend validates records, limits payload sizes and uses PostgreSQL transactions to serialize changes. Credentials are not embedded as shared client credentials, and the application does not intentionally log secrets or record bodies. These measures reduce risk but do not guarantee absolute security. Server records are not end-to-end encrypted by the app; the hosting infrastructure processes them. Protect your device, exported files and any confidential material you choose to store.
Children’s privacy
Coding Lab Studio is a productivity tool for programming students and developers and is not specifically directed to children under 13. It has no age-verification or account-registration system. If you believe a child has provided personal information that requires removal, contact branoc.penfold@icloud.com. Installation-scoped storage means we may need help identifying the relevant records without requesting the installation secret by email.
Changes to this policy
We may update this policy when application features, data processing or hosting arrangements change. The effective date at the top of the published policy identifies the current version. Review this page for updates; the Privacy Policy link in app Settings opens it. Material changes to optional processing will be reflected in the application and policy as appropriate.