Privacy Policy

1. Who We Are

Alok The Analyst ("we", "us", "our") operates the website aloktheanalyst.com — a learning platform for data analytics professionals offering free SQL/Python tutorials, an interactive Practice Arena, domain knowledge guides, and 1:1 mentoring.

This Privacy Policy explains how we collect, use, and protect your personal information when you use our website and services.

2. Information We Collect

A. Account & Authentication Data (Google OAuth)
When you sign in with Google, we receive and store:

• Your Google account ID
• Name and email address
• Profile picture URL
• Last login timestamp

B. Profile Information (optional, provided by you)
Via the profile modal in the Practice Arena, you may optionally provide:

• Current and target job roles
• Years of experience and career start date
• Technical skills (SQL, Python, Excel, Tableau, etc.)
• Target companies and preparation stage
• City and how you found us

C. Practice Activity
We log events in the Practice Arena to track your progress and improve content:

• Cases opened, code runs, hints used, answers checked, scores received
• AI chat messages sent and model used
• Session start events and tab navigation

D. Feedback Submissions
When you submit feedback via the feedback widget, we collect:

• Your message text
• Page URL, browser user agent, and IP address
• Optional screenshot you choose to include
• Contextual debug info (active case, SQL dialect, AI provider, errors)

E. Technical & Usage Data
Our hosting infrastructure (Cloudflare) automatically collects standard web server logs including IP addresses, browser type, referring URLs, and page visit timestamps. This data is processed at the edge and subject to Cloudflare's Privacy Policy.

3. How We Use Your Information

• Authentication: To create and maintain your account session.
• Personalization: To tailor the Practice Arena experience to your skill level and goals.
• Progress tracking: To save your solved cases and practice history across sessions.
• AI coaching: To provide context-aware hints and feedback from AI models.
• Platform improvement: To analyze aggregate usage patterns and improve content quality.
• Support: To respond to feedback and bug reports you submit.
• Security: To detect abuse, enforce rate limits, and protect the platform.

We do not use your data for advertising, profiling for sale, or any purpose unrelated to operating this educational platform.

4. How We Share Your Information

We do not sell, rent, or trade your personal information. We share data only in these limited circumstances:

• Service providers: Cloudflare (hosting/edge), Resend (transactional email for feedback), Cloudflare Workers AI and Groq (AI inference — messages are not stored by these providers beyond request processing).
• Google: Only to complete OAuth sign-in. We do not share your data back to Google beyond standard OAuth flows.
• Legal requirements: If required by law, court order, or to protect the rights, safety, or property of users or the public.
• Business transfer: In the event of a merger or acquisition, users will be notified before data is transferred.

5. Data Storage & Retention

Your data is stored in Cloudflare D1 (SQLite) databases and Cloudflare KV (key-value store), hosted on Cloudflare's global edge network.

• Session data: Expires automatically after 7 days of inactivity.
• Account and profile data: Retained as long as your account is active.
• Practice events: Retained indefinitely to support long-term progress tracking.

You may request deletion of your account and all associated data at any time — see Section 8.

6. Cookies & Local Storage

Cookies we set:

• session — An HttpOnly, Secure, SameSite=Lax cookie containing your session ID. Required for login. Expires after 7 days.
• Short-lived OAuth state and redirect cookies (5-minute expiry) used only during the sign-in flow.

localStorage: Your profile information (role, skills, goals) is saved in your browser's localStorage for fast access. This data stays on your device and is also synced to our server when you save your profile.

We do not use advertising cookies, cross-site tracking cookies, or third-party analytics cookies.

7. Third-Party Services

Our platform integrates with the following third-party services. Each has its own privacy policy:

• Google OAuth & YouTube API — Google Privacy Policy
• Cloudflare (hosting, edge, AI, D1, KV) — Cloudflare Privacy Policy
• Groq (AI inference) — Groq Privacy Policy
• Resend (email delivery) — Resend Privacy Policy
• Topmate.io (1:1 mentoring bookings) — governed by Topmate's own privacy policy when you visit their platform.
• LinkedIn (embedded posts) — LinkedIn Privacy Policy
• Google Fonts (typography) — font files are loaded from Google's CDN.

If you choose to provide your own OpenAI or Groq API key, that key is forwarded directly to the respective provider for your request and is never stored on our servers.

8. Your Rights & Choices

You have the following rights regarding your personal data:

• Access: Request a copy of the data we hold about you.
• Correction: Update your profile directly in the Practice Arena profile modal, or contact us.
• Deletion: Request full deletion of your account and all associated data.
• Portability: Request an export of your practice history and profile data.
• Opt-out: You may use the Practice Arena without creating an account (progress will not be saved). You can clear your localStorage at any time via browser settings.

To exercise any of these rights, email info@aloktheanalyst.com with the subject line "Data Request". We will respond within 30 days.

9. Children's Privacy

Our services are not directed at children under the age of 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal data, please contact us immediately and we will delete it.

10. Security

We implement industry-standard security measures including:

• HTTPS/TLS encryption for all data in transit
• HttpOnly, Secure, SameSite cookies to prevent session theft
• CSRF protection via OAuth state tokens
• Rate limiting on all API endpoints (IP-based and per-user)
• Input validation and parameterized database queries

No method of transmission over the Internet is 100% secure. We encourage you to use strong passwords on your Google account and to sign out when using shared devices.

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top of this page. For significant changes, we will post a notice on the website. Your continued use of the platform after changes constitutes acceptance of the updated policy.

12. Contact Us