Privacy Policy
Syrax Academy ("Syrax Academy", "we", "us") is an online platform with interactive programming courses — currently a C# for Unity course and a Python course — operated by Five Attempt Studio. Courses and the interface are available in Russian and in English. This Privacy Policy explains what personal data we collect when you use the Syrax Academy web application (the "Service"), why we collect it, and the choices you have.
Contact for all privacy matters: fiveattemptstudio@gmail.com
1. Data We Collect
1.1 Account data (Google Sign-In)
Syrax Academy uses Google Sign-In as its only authentication method. When you sign in, we receive from your Google account:
- your name,
- your email address,
- your profile photo URL,
- a unique account identifier (UID).
We never see or store your Google password. Authentication is handled by Firebase Authentication, a Google service.
1.2 Learning data
When you sign in, a profile record is created for your account. As you study, it stores, separately for each course (C# and Python):
- which lessons you have completed and which lesson you are on;
- your answers to in-lesson quizzes;
- the state of practice exercises and the code you typed in lesson practice editors — saved so your work survives a page reload and follows you across devices;
- an overall completion percentage.
Code typed in the free-experiment ("scratch") editor is not saved to your account. Progress in the Practicum trainer (available in the C# course) is stored the same way as lesson progress.
1.3 Content you create
- Personal notes you write inside lessons — stored in your account, visible only to you.
- Lesson reviews (a rating and an optional comment) — stored with your account identifier; the review text and rating may be shown to other users, your email is never shown.
- Feedback and bug reports you send through the in-app form — stored together with your account identifier so we can reply.
1.4 Subscription status
If you buy a paid plan, we store your plan name, its status and its start/expiry dates. All payment processing is done by Paddle (our Merchant of Record). We never receive or store your card number or other payment credentials; Paddle shares with us only what is needed to activate your plan (transaction and subscription identifiers, plan purchased).
1.5 Settings and technical data
- interface settings: language (Russian/English) and theme;
- usage analytics collected by Firebase Analytics (Google): aggregated events such as page views, session length, approximate region derived from IP, device and browser type. We do not build advertising profiles and do not sell data;
- standard server logs kept by our hosting provider (Firebase Hosting) — IP address, request time and URL — used for security and abuse prevention.
1.6 Guest mode
You can study the free lessons without an account. In that case your progress and notes are stored only in your own browser (see the Cookie & Local Storage Policy) and never reach our servers. If you later sign in, the progress made as a guest on that device is merged into your account.
2. Where Your Code Runs
Both courses check your solutions inside your browser:
- C# exercises are executed by an in-browser interpreter shipped with the Service;
- Python exercises are executed by Pyodide — a real Python runtime compiled to WebAssembly. On first use your browser downloads it from the jsDelivr content-delivery network; like any web request, that download exposes your IP address and browser type to the CDN. The code you run is not sent to jsDelivr or to any server — execution is local.
3. Why We Process Data (Legal Bases)
| Purpose | Data | Legal basis |
|---|---|---|
| Providing the Service: sign-in, progress sync across devices, notes | Account and learning data | Performance of a contract |
| Paid access management | Subscription status | Performance of a contract |
| Replying to feedback and support requests | Feedback, email | Legitimate interest / your request |
| Understanding how the Service is used, improving courses | Analytics events | Legitimate interest |
| Security, abuse and fraud prevention | Server logs, UID | Legitimate interest / legal obligation |
4. Third Parties We Rely On
| Provider | Role | What reaches them |
|---|---|---|
| Google Firebase (Authentication, Firestore, Hosting, Analytics) | Sign-in, data storage, hosting, usage analytics | Account data, learning data, technical data |
| Paddle | Merchant of Record — processes all payments, issues invoices and refunds | Payment details you enter at checkout, billing country, email |
| jsDelivr | CDN that serves the Python runtime (Pyodide) | IP address and browser type when the runtime is downloaded |
| Google Fonts | Fonts on policy pages | IP address and browser type when fonts load |
These providers process data in their own right or as our processors; data may be stored on servers outside your country, including the United States and the European Union, under the providers' standard safeguards.
5. Retention
- Account and learning data — kept while your account exists; deleted upon account deletion (see the Account & Data Deletion Policy).
- Subscription records — kept while the subscription is active; Paddle retains transaction records for the period required by tax and accounting law.
- Analytics — stored in aggregated form per Firebase Analytics defaults (up to 14 months).
6. Your Rights
Depending on your jurisdiction (including the GDPR if you are in the EU/EEA), you may request access to your data, correction, deletion, restriction of processing, portability, or object to processing based on legitimate interest. Write to fiveattemptstudio@gmail.com from the email of your account; we answer within 30 days. You can also delete your account yourself at any time — see the Account & Data Deletion Policy.
7. Children
The Service is not directed to children under 13 (or the higher minimum digital-consent age of your country). Minors may use the Service only with a parent's or guardian's consent. We do not knowingly collect data from children below that age; if you believe a child provided us data, contact us and we will delete it.
8. Security
Data in transit is encrypted (HTTPS). Access to stored data is restricted by Firebase security rules: your learning data is readable and writable only by your own signed-in account. No method of storage is 100% secure, but we follow the platform's recommended practices.
9. Changes
We may update this Policy as the Service evolves (for example, when new courses or features launch). The effective date above always reflects the latest revision; material changes will be announced in the app.