Privacy

The short version

You can use RoseCode without an account. By default, your learning work stays in this browser.

• Supabase cloud sync starts only when it is available and you sign in.
• Tutor Bridge shares nothing until you copy or send something yourself.
• The optional in-app AI sends data only after you press Send.
• Upstash may count protected requests when shared abuse protection is turned on.

The current app has no advertising tracker or tool designed to measure how people use the product.

On this device

RoseCode saves your learning record in IndexedDB, a database inside your browser. This record can include profile choices, lesson and lab work, drafts, reviews, interview practice, notes, projects, goals, event recaps, and activity history.

Small appearance and accessibility settings live in another browser storage area called localStorage so the right colors and motion choices can appear before the app finishes loading. RoseCode also keeps a temporary random tab ID in memory so repeatable XP does not double-count during sync. The ID is not your name or account ID and disappears with the page. Your browser may also save RoseCode pages and files so parts of the app work without internet.

Browser data stays until it is reset, replaced, cleared by you or the browser, or removed by device cleanup. Private browsing and storage limits can shorten that life. RoseCode cannot control device or browser backups. A downloaded JSON file is a full copy from one moment that you can import later. The Markdown file is only an easy-to-read summary and cannot restore your progress.

Optional Supabase cloud account and sync

Supabase is the outside service RoseCode can use for sign-in and cloud storage. If it is turned on and you sign in, Supabase receives the details needed for an email-link or Google sign-in, information about your signed-in session, and a numbered copy of your learning record for sync. A site upgraded from an older RoseCode version may also have older profile and learning-history tables. Choosing Google sign-in sends a normal sign-in request to Google too.

Database rules and a signed-in sync function are designed to limit each learner to their own records, but no security control is a promise of zero risk. Where Supabase hosts the data and how long it keeps operations data depend on this site's setup; this page does not claim a region it cannot verify. Read the current Supabase privacy policy (opens in a new tab).

Tutor Bridge, ChatGPT, and optional in-app AI

Tutor Bridge builds a brief in your browser. Previewing, removing sections, copying, or downloading it does not send the brief to OpenAI. “Open ChatGPT” only opens ChatGPT in a new tab; OpenAI receives the content if you choose to paste or type it there. That use follows your ChatGPT account settings and OpenAI's consumer policies.

If optional in-app AI is enabled, RoseCode sends the conversation you submit and selected lesson details to OpenAI only after you press Send. The server keeps the secret OpenAI key out of your browser. Do not submit passwords, private keys, health records, or other information you do not want processed by an AI service. OpenAI currently says API inputs and outputs are not used for model training by default unless the API customer chooses to opt in. Its safety logs may still keep content under its current rules.

Outside-service rules can change. See OpenAI's API data controls (opens in a new tab) and ChatGPT data-use explanation (opens in a new tab).

Request limits and Upstash

RoseCode limits how many protected requests one source can make in a short time. This helps prevent abuse and surprise AI costs. When Upstash Redis is turned on, the server sends Upstash a short-lived counter and a one-way code based on the request's IP address. Upstash does not receive the plain IP from this code path. Active codes expire when their counting window ends. Local development can use temporary counters in memory. On a live site, RoseCode refuses protected requests if the shared counter cannot confirm that space remains. Upstash's own logs and backups follow the Upstash privacy policy (opens in a new tab).

Cookies, logs, and analytics

Supabase sign-in uses a session cookie, a small browser record that keeps you signed in. RoseCode's current code does not include an advertising tracker or product-analytics tool. Hosting, database, AI, Google sign-in, and request-counting services may still handle normal connection details such as IP address, request time, browser information, response status, and service logs under their own rules.

Export, reset, and deletion

Settings can download the current browser record, import a checked copy, or reset learning. Signed-in learners can also request account deletion within fifteen minutes of a fresh sign-in. RoseCode reports a successful deletion only after the server confirms removal of the Supabase sign-in. Cloud database records linked to that sign-in are designed to delete with it.

A live-data deletion request does not pull back files you already downloaded or instantly erase every browser copy, server log, legal record, or provider backup. Those copies may remain until separately cleared or aged out under the relevant system's retention rules. Export before deletion if you want a copy, then verify the download opens.

Changes and questions

RoseCode is an independently run project. Important product or outside-service changes should be reflected here with a new date. No public support address is published in the current app, so this page and the linked service policies are the available written references for now.