Privacy Policy

SoloScript works fully without an account, and stores as little as possible either way. Signing in is entirely optional — it exists only to sync your progress across devices, and choosing not to sign in costs you nothing. This page explains, plainly, what's involved in running the site in either case.

What stays on your device

Whether or not you sign in, your practice history, XP, levels, onboarding answers, and which concepts you've seen are all stored using your browser's local storage, on your device. If you never create an account, that's the only place this data ever lives — SoloScript has no server-side database to put it in and cannot see it. Clearing your browser's site data for soloscript.dev removes it completely. This is a deliberate design choice, not a limitation — see the blog for more on why the app works this way.

If you create an account

Signing in (via GitHub or Google) exists for one reason: so your progress follows you to a second device instead of starting over. If you do this, SoloScript receives and stores, via our backend provider Supabase: your email address, and basic profile information your chosen provider makes available (such as your name or avatar). Alongside that identity, the same practice data described above — XP, stats, onboarding answers, concepts seen, achievements earned, language/setting preferences — is also kept in Supabase, tied to your account, so it can sync back down to any device you sign into. Your device's local storage remains the copy the app actually reads from and writes to moment-to-moment; the account copy exists purely as a synced backup.

This relies on Supabase's own data processing agreement and, for data transferred outside the EU/EEA, the standard contractual clauses and data transfer safeguards Supabase maintains as our backend provider.

Leaderboards

Leaderboards are entirely opt-in and off by default — nothing about your account or practice data is ever visible to other users unless you deliberately choose to join one. Joining requires an account (so there's somewhere to keep your entry), but viewing a leaderboard never does. If you join, you pick a nickname yourself for that purpose specifically — it's never your real name, email, or GitHub/Google handle unless you happen to choose one of those as your nickname on purpose. What becomes visible to other users is limited to that nickname and your XP/level in whichever language(s) you're ranked in. Leaving a leaderboard deletes your entry outright, immediately — it doesn't just hide it, and nothing lingers behind for a later rejoin to pick back up.

Cookies

SoloScript does not use cookies, including for accounts — signing in is handled via your browser's local storage, the same mechanism as everything else on this site, not a cookie. Nothing on this site currently requires a cookie consent banner as a result. If that changes, this page will be updated to disclose it. A cookie used solely to keep you signed in would, in any case, be considered "strictly necessary" under GDPR and the ePrivacy Directive and wouldn't require a consent banner on its own — a banner would only become necessary if a genuinely non-essential cookie (analytics, marketing, or tracking) were ever added.

Analytics

The site uses Vercel Web Analytics and Vercel Speed Insights to understand overall traffic and page performance — nothing more granular than that. Both are built to be privacy-first: they don't use cookies, don't collect anything that identifies you personally, and don't track you across other websites. Visitors are distinguished using a hashed value derived from the incoming request, which is automatically discarded within 24 hours rather than kept indefinitely.

This processing relies on Vercel's own data processing agreement and, for any data transferred outside the EU/EEA, the standard contractual clauses and EU–US Data Privacy Framework Vercel maintains as our hosting provider. See Vercel's Web Analytics privacy documentation and Speed Insights privacy documentation for their full technical detail.

Legal basis

The aggregate analytics described above are processed under legitimate interest — understanding whether the site is working and reachable is necessary to run it at all, and no individually identifying data is kept as part of that. Account data (email, profile info, synced progress) is processed on the basis of your consent — you explicitly choose to sign in, nothing is created or stored on our servers unless you take that action yourself. Leaderboard participation is a separate, additional consent from having an account — signing in alone never joins one; you take a second, distinct action to opt in.

Data retention

Account data is kept for as long as your account exists, with no fixed expiry — there's currently no activity-based automatic deletion. Deleting your account (see "Your rights" below) removes it immediately, not on some later schedule. This is separate from the 24-hour analytics identifier described above, which expires automatically regardless of whether you have an account.

Your rights

Under GDPR, you have the right to access, correct, delete, and restrict use of your personal data. If you've never signed in, there is genuinely nothing to act on — your practice data has never left your own browser. If you do have an account, a "Delete account" button is available directly from the practice page itself — confirming it permanently deletes your account (email, profile info) and its synced progress immediately, with no manual request or waiting period needed. That request also runs entirely server-side against your own verified session, so it can only ever delete the account actually making it, never anyone else's. For anything the self-service button doesn't cover — a copy of what's stored, or trouble with the delete flow itself — contact us at the address below and we'll respond within the timeframes GDPR requires (generally within one month). Deleting your account also removes any leaderboard entry automatically, the same way — no separate step needed. Note that deleting your account removes the synced copy in Supabase, not whatever's still sitting in your own browser's local storage — clear your browser's site data separately if you want that gone too.

Changes to this policy

This page was last revised to reflect the addition of opt-in leaderboards — the first time any data becomes visible to other users rather than staying between you and your own devices. It'll be revised again if what the site collects changes further — most notably if a paid tier, school/organizational accounts, or any new category of server-side data collection is introduced down the line. Material changes will be reflected here with an updated date at the top of this page.

Contact

Questions about this policy or a privacy request can be sent to support@soloscript.dev.