1. Who we are
Step Through Code, based in India, is responsible for your personal data (the data controller under the GDPR and the data fiduciary under India’s Digital Personal Data Protection Act, 2023). Contact us about privacy, including grievances, at support@stepthroughcode.com.
2. Data we collect and why
Free lessons need no account, and your progress stays in your browser. Like any website, our hosting provider processes basic connection data when you visit.
| Data | Purpose | Legal basis (GDPR) |
|---|---|---|
| Account: email; if you use Google or GitHub, also your name, profile picture and provider ID; GitHub may also supply your username | Sign-in and your account | Contract |
| Optional profile: display name, avatar choice and billing country | Personalise your account and prefill checkout | Consent (optional details) |
| Learning progress | Save and sync your progress | Contract |
| Course reviews you post: star rating, optional text and date | Show learner reviews on course pages, with your first name and last initial | Consent (you choose to post) |
| Purchases: course, order reference, amount, currency and access dates | Give you access, handle refunds and keep tax records | Contract; legal obligation |
| Technical data: IP address, browser type and error logs | Run and secure the site, fix errors, and show prices for your country | Legitimate interests |
| Support emails | Answer your request | Legitimate interests |
| Optional analytics: random browser identifier, pseudonymous account ID after sign-in, visits to known site pages, successful sign-ins, lesson activity, coupon redemption, course ratings and sanitised browser errors | Measure visits, returning learners and conversion to sign-in and learning; never used to decide course access | Consent; off until you accept, and withdrawable below |
Profile setup is optional. You can skip it, edit your details, or clear them from your Profile page at any time. We do not support picture uploads or collect your age. Your profile is never public. If you post a course review, it shows your first name and last initial with your rating and text. You can edit or delete it on the course page at any time.
To show prices for your country, our server looks up your IP address in a local copy of the DB-IP database. Your IP address is not shared or stored for this.
Under Indian law, we process your data with the consent you give when you create an account. You can withdraw it at any time by asking us to delete your account. Payments are handled by Dodo Payments, so we never see your card number, CVV, OTP or UPI PIN. Dodo shares with us only what we need to deliver and support your purchase, such as the order reference and payment status.
4. Optional analytics and error reporting
Only after you accept, PostHog (EU hosting) receives page visits, pricing and course views, lesson starts, progress checkpoints, completions, successful sign-ins, coupon redemptions, course ratings and sanitised browser errors. A random browser identifier recognises returning visits. When you sign in, we link this activity to your internal account ID, which is pseudonymous, not anonymous. We do not send your name, email, profile picture, typed commands, coupon codes, payment credentials, page queries, fragments or raw error messages. There are no recordings, advertising or automatic click tracking.
Browser requests necessarily expose connection data to PostHog, but IP storage and geolocation are disabled in our event payloads. Analytics does not start before consent. Rejecting or withdrawing consent stops browser reporting and removes analytics persistence; previously collected events are not automatically deleted. Browser Do Not Track and Global Privacy Control override acceptance. You can request deletion of account-linked analytics through the contact above.
Optional browser analytics and error reporting are currently off.
Your choice affects optional reporting in this browser, not essential account storage or sanitised server-side failure reports. Blocking analytics never limits lessons or course access.
6. How long we keep it
- Account, progress and reviews: kept while your account is active, and deleted when you ask us to delete your account, except records the law requires us to keep.
- Progress saved in your browser: stays on your device until you clear your browser data.
- Support emails and technical logs: kept only as long as needed to resolve your request or investigate a problem.
- Analytics: subject to the retention configured in our PostHog project. Clearing cookies or withdrawing consent does not erase previously collected events; contact us to request account-linked deletion.
- Payment records: kept as long as tax and accounting law requires, including after you delete your account.
7. Your rights
You can ask us to access, correct, delete or export your data, object to or restrict its use, withdraw consent, or nominate someone to act for you. Email support@stepthroughcode.com from the address on your account.
You can also complain to the Data Protection Board of India or, in the EU or UK, your local data protection authority.
8. Children
Accounts are for people aged 18 and over. We do not knowingly collect data from anyone under 18. If you believe a child has created an account, contact us and we will delete it.