Privacy

Nothing about you is sent anywhere. Your answers, streak, and review schedule are kept in your own browser using local storage. Clearing your browser data erases them, and there is no copy for anyone to recover.

Two things are then stored on a server:

• Your email address, used only to identify your account and send sign-in links. It is never displayed to anyone else, including on the leaderboard.
• Your progress — which questions you have answered, whether you got them right, your XP, streak, and review schedule. This is stored so it follows you between devices, and is readable only by you. Database rules enforce that, not just application code.

You are not on it unless you choose to be. Joining publishes a display name you pick, plus four numbers: XP, current streak, questions answered, and accuracy. Your email is never published, and neither is anything about which questions you answered. The board is visible only to people signed in, not to the open web.

Leaving deletes the entry outright rather than hiding it. Nothing of yours remains on the board afterwards.

Whetstone itself sets only sign-in cookies, which keep you logged in between visits and are strictly necessary for the account to work. Signing out removes them.

The Sponsor button in the footer is an embedded frame from GitHub, present on every page, and GitHub may set its own cookies in it — Whetstone has no say over that and does not read them. There is still no advertising, and no tracking of you across other sites by Whetstone itself, so there is no consent banner to click through.

Vercel Web Analytics counts page views and measures loading performance. It is cookieless — it does not set a cookie or any other identifier that would let it recognise you on a return visit — and it stores no name, email, or account ID against what it collects. What it does record is standard for this kind of tool: which page was viewed, in what country, and general device and browser information taken from the request.

It exists to answer one question honestly: whether anyone is actually using this. It does not feed advertising, anywhere, and it is never combined with your account or your progress.

Whetstone is run and paid for by one person, who decides what is collected and why, and is the data controller for it. Reaching them is the email address at the bottom of this page.

The site runs on Vercel, and accounts and progress are stored by Supabase. Both act as processors on Whetstone's behalf, and both keep standard server logs containing IP addresses for security and debugging.

If something breaks, the crash — the error message, a stack trace, which page, and your IP address as the report arrives — is sent to Rollbar, also as a processor, so it can be noticed and fixed. Nothing about who you are signed in as is attached to that report.

Attached to the same report is a short recording of the screen itself, covering roughly the half-second before the crash and the five seconds after — reconstructed from the page's structure, not a video, but close enough in effect that anything visible on screen at that moment can appear in it, including a question you were looking at. It only ever happens around an actual crash; ordinary use of Whetstone is never recorded. Anything typed into a password or email field is masked before it leaves your browser — Whetstone has no password fields, so in practice this means your email address, on the rare crash near the sign-in page.

If you sign in with GitHub rather than by email, GitHub necessarily learns that you use Whetstone, and passes back the email address on your GitHub account so the account can be created. What GitHub does with that is covered by their privacy policy, not this one. Choosing the email link instead avoids involving them.

Separately, every page carries a GitHub Sponsors button in the footer, loaded live from github.com rather than drawn as a static image. That means a request carrying your IP address reaches GitHub on every page you visit here, whether or not you ever click it — the same way it would for an embedded YouTube video or Google Map on another site. Whetstone does not see anything from that request; GitHub does, under their own privacy policy.

Nobody else receives your data. It is never sold, and it is not used to train anything.

Vercel, Supabase and Rollbar are United States companies, so if you are in the UK or EU your data is transferred outside it. All three are contractually bound to protect it to the standard required here — in the usual way, through standard contractual clauses in their terms.

Under UK and EU data protection law, the email address and progress are processed to perform the service you asked for — there is no account without them. The leaderboard entry is processed on your consent, which is why it is off until you switch it on and why switching it off deletes it. Server logs and crash reports are kept on the legitimate interest of keeping the site up and secure, and analytics on the legitimate interest of knowing whether the site is actually used — it needs no consent of its own precisely because it is cookieless and does not identify you.

For as long as your account exists. There is no archive: deleting your account removes your progress and any leaderboard entry at the same moment, because the database removes them along with the account rather than leaving them to be cleaned up later.

• See it. Everything held about you is shown on your profile and stats pages.
• Erase your progress but keep the account, from settings.
• Delete the account entirely, from your profile. It is immediate and cannot be undone — no grace period, no soft delete.

If you are in the UK or EU, the rights of access, rectification, erasure, restriction, objection and portability apply. The controls above cover the first three directly; for a copy of your data in a portable form, ask. You will not be charged for any of this, and nothing about the service changes because you asked.

If you think your data has been handled badly, please say so first — but you are entitled to complain to a data protection regulator without doing that. In the UK that is the Information Commissioner's Office; in the EU it is the supervisory authority where you live.

Whetstone is aimed at working software engineers. It is not intended for children, and accounts should not be created by anyone under 16, which is the highest age any country covered here sets for consenting to this on your own behalf.

If this policy changes in a way that affects what is collected or who receives it, the date at the top changes and anyone with an account is told before it takes effect.

Questions, or a request to exercise any of the above: wlcalvin3@gmail.com.