Privacy

Nothing about you is sent anywhere. Your answers, streak, and review schedule are kept in your own browser using local storage. Clearing your browser data erases them, and there is no copy for anyone to recover.

Two things are then stored on a server:

• Your email address, used only to identify your account and send sign-in links. It is never displayed to anyone else, including on the leaderboard.
• Your progress — which questions you have answered, whether you got them right, your XP, streak, and review schedule. This is stored so it follows you between devices, and is readable only by you. Database rules enforce that, not just application code.

You are not on it unless you choose to be. Joining publishes a display name you pick, plus four numbers: XP, current streak, questions answered, and accuracy. Your email is never published, and neither is anything about which questions you answered. The board is visible only to people signed in, not to the open web.

Leaving deletes the entry outright rather than hiding it. Nothing of yours remains on the board afterwards.

Only sign-in cookies, which keep you logged in between visits. They are strictly necessary for the account to work, there are no advertising or tracking cookies, and so there is no consent banner to click through. Signing out removes them.

Whetstone is run and paid for by one person, who decides what is collected and why, and is the data controller for it. Reaching them is the email address at the bottom of this page.

The site runs on Vercel, and accounts and progress are stored by Supabase. Both act as processors on Whetstone's behalf, and both keep standard server logs containing IP addresses for security and debugging.

If you sign in with GitHub rather than by email, GitHub necessarily learns that you use Whetstone, and passes back the email address on your GitHub account so the account can be created. What GitHub does with that is covered by their privacy policy, not this one. Choosing the email link instead avoids involving them.

Nobody else receives your data. It is never sold, and it is not used to train anything.

Vercel and Supabase are United States companies, so if you are in the UK or EU your data is transferred outside it. Both are contractually bound to protect it to the standard required here — in the usual way, through standard contractual clauses in their terms.

Under UK and EU data protection law, the email address and progress are processed to perform the service you asked for — there is no account without them. The leaderboard entry is processed on your consent, which is why it is off until you switch it on and why switching it off deletes it. Server logs are kept on the legitimate interest of keeping the site up and secure.

For as long as your account exists. There is no archive: deleting your account removes your progress and any leaderboard entry at the same moment, because the database removes them along with the account rather than leaving them to be cleaned up later.

• See it. Everything held about you is shown on your profile and stats pages.
• Erase your progress but keep the account, from settings.
• Delete the account entirely, from your profile. It is immediate and cannot be undone — no grace period, no soft delete.

If you are in the UK or EU, the rights of access, rectification, erasure, restriction, objection and portability apply. The controls above cover the first three directly; for a copy of your data in a portable form, ask. You will not be charged for any of this, and nothing about the service changes because you asked.

If you think your data has been handled badly, please say so first — but you are entitled to complain to a data protection regulator without doing that. In the UK that is the Information Commissioner's Office; in the EU it is the supervisory authority where you live.

Whetstone is aimed at working software engineers. It is not intended for children, and accounts should not be created by anyone under 16, which is the highest age any country covered here sets for consenting to this on your own behalf.

If this policy changes in a way that affects what is collected or who receives it, the date at the top changes and anyone with an account is told before it takes effect.

Questions, or a request to exercise any of the above: wlcalvin3@gmail.com.