Privacy Policy

1. Who This Policy Covers

This policy explains what personal data Coder in 90 handles, why, who receives it, how long it is kept, and how to see it or have it deleted. Coder in 90 is operated from Spain by a sole trader (autónomo).

The product is Coder in 90 Classroom, which instructors subscribe to and use to run coding classes on GitHub. An instructor is the person or institution who subscribes and runs classes. A student is someone who joins one of those classes. The Terms of Service use the same words.

Who decides what happens to personal data depends on whose data it is:

• An instructor's own account, subscription and billing records. We decide how that data is used, and we answer requests about it ourselves.
• Student data inside a class. For this data the instructor's institution is the controller and Coder in 90 is the processor. The institution decides what is collected from its students and why, and we handle that data on its instructions. Section 7 explains what that means for a request to see or delete it.

2. Information We Collect

What we hold depends on how you use Coder in 90.

• Account information. Your email address and name, where you give them. If you sign in with GitHub, your GitHub username and GitHub account id. The region your account's data is assigned to, EU or US, worked out once, from your billing country at checkout or the country your connection comes from when you sign in, whichever is known first.
• Class rosters and join requests. The GitHub username of each student on a roster, and the name and email address an instructor includes when importing a roster from a CSV file. A request to join a class carries the email address it was made with.
• Student work and submissions. The address of the repository created for each student or team, the results of each autograding run on the code pushed to it, the scores recorded from those runs, and answers to readiness quizzes. To write feedback we also read the changes a student made in that repository. On some assignments we also receive files the student's repository produces for marking.
• CLI transcripts. If a class uses the Coder in 90 CLI and the student agrees on its consent screen, the CLI uploads a record of the student's AI tool sessions (the prompts and the responses) and the commands run inside the cin90 session shell when work is pushed, together with when each study session ran and which tools and versions it used. To find secrets worth removing it also reads project config files such as .env and replaces the values it finds there.
• AI-generated feedback. The explanations and reviews written about a student's work, and coaching messages drafted with an AI provider.
• Coaching, one-on-ones and interviews. Why a one-on-one meeting was opened and what came of it, as the student or instructor wrote it. Staged interview and Studio session transcripts, holding the student's answers, any code they submit and the AI interviewer's turns, with their scored reports.
• Attendance and catch-up. Which catch-up sessions a student attended, and the reasons recorded when a student is excused from a readiness requirement or given a catch-up plan.
• Teaching assistants. The GitHub username of each teaching assistant, on a record of the repository access granted to them.
• Email we send. A log of each email: the address it went to, its subject and its body.
• Billing records. For instructors who subscribe: email address, amount, currency, and the Stripe payment and subscription identifiers. Card details are collected by Stripe and never reach us.
• Marketing email. The email address you give when you ask for a resource or sign up for updates.
• Usage and anti-abuse signals. Analytics events and session recordings, described in Section 6, and the signals Google reCAPTCHA Enterprise uses to score form submissions.

An instructor can add students to a roster by GitHub username or from a CSV file, and a student who joins through an invite link adds themselves, with the GitHub username from their own sign-in. Everything else a student hands in or writes in the product is collected from them directly as they take part in the class, on the instructor's behalf.

3. How We Use It

• To run classes: create a repository for each student or team in the instructor's GitHub organization, add students as collaborators, read the results of each autograding run, and show the instructor what was handed in.
• To write AI-generated feedback and run the class features built on it: student work, test results, quiz answers, interview and session answers, and the assignment they belong to are sent to an AI model provider, which writes explanations, reviews, scores against the instructor's rubric, interview replies, exercises and drafts of coaching messages.
• To keep a cost record of each AI call: the provider, the model, the number of tokens, and the instructor, class and autograding run it was for. That record does not contain what was sent, and it is kept after the class is deleted.
• To send the email the product needs, such as sign-in links, and marketing email you asked for. You can unsubscribe from marketing email at any time.
• To take payment for subscriptions.
• To see how the product is used, and to protect forms from automated abuse.

4. Who Receives It

These kinds of service receive personal data from us, each only for the purpose named.

• Amazon Web Services: hosting of our servers, database and backups, in the European Union (Frankfurt, Germany).
• GitHub: repositories, collaborators and autograding runs in the instructor's GitHub organization, and signing in with GitHub. See GitHub's Privacy Statement.
• AI model providers: the uses described in Section 3, and monitoring of those calls so that we can fix the AI features.
• Stripe: payment processing for subscriptions, as our Merchant of Record. See Stripe's Privacy Policy.
• An email delivery service: the email the product sends, including sign-in links.
• PostHog: product analytics and session recording, described in Section 6.
• An operations alerting service: when something breaks, a diagnostic that can name a class, an assignment, and a repository name that carries a student's GitHub username.
• Google reCAPTCHA Enterprise: scoring form submissions for automated abuse. Each check sends Google a reCAPTCHA token, your IP address and your browser's user agent. Google's Privacy Policy and Terms of Service apply to that check.

Instructors: on a plan where you supply your own AI provider key, and on any assignment marked against your rubric, the AI calls that send your students' work run on your key, under your own account with that provider.

Where an instructor links a Google Classroom course to a class, we read the email addresses on that course's roster to match students, and send the assignment and each matched student's draft grade to that course. Nothing is sent to Google Classroom for a class that is not linked.

Some of these services are in the United States, so personal data can be transferred there. Write to us to learn which safeguards cover a transfer.

The current list of sub-processors, what each one receives and where it is located, is kept on the sub-processor list, which customers can read and anyone else can ask us for. Before a new one starts receiving a class's student data we email the class's instructor, who may object within 30 days.

5. How Long We Keep It

• CLI transcripts. Transcript content is deleted 30 days after it is uploaded. An instructor may extend that period for a class, to a maximum of 730 days, and a class cannot shorten it below 30 days. Deleting the content clears the recorded sessions and commands. The record that a session existed, which tool it used and what the redaction found is kept, so an instructor can tell a student who used no AI from a record that has aged out.
• Copied pull request reviews. Where a class brings an outside code review of a student's pull request into its own, the copied text and the code it was about are deleted 30 days after the review was last handled. The record that the review existed is kept.
• Practice material. To prepare practice exercises, a summary of a student's progress, quiz answers and code excerpts, with no name, email address or GitHub login, is sent to an AI model provider. The exercise that comes back is kept with the class's other work.
• Class data. Rosters, submissions, scores, AI-generated feedback, coaching messages, one-on-one notes and staged interviews are kept for the life of the class. A teaching assistant's record of repository access is kept after the class is deleted, until that access is taken away.
• Accounts. Kept for the life of the account.
• Backups. Our nightly database backups keep erased data for up to 7 days, and are then deleted.
• Billing records. Kept after an account is erased, with the email address replaced, because Spanish tax law requires them to be retained.
• Marketing email. Kept after you unsubscribe, marked so it is not emailed again, until the account is erased or you ask us to delete it.
• Analytics, session recordings and reCAPTCHA signals. Kept for the retention period each provider sets.

6. Cookies, Analytics and Session Recording

We use essential cookies to keep you signed in, to protect forms from forged submissions, to remember your answer about analytics, and to remember whether you chose the light or dark theme. We also use PostHog analytics, which stores an identifier in your browser and records sessions so we can see how the product is used. This site sets no masking on those recordings, so a recording shows what was on screen.

Visitors in the European Economic Area and the United Kingdom, and visitors whose country we cannot determine, are asked first, and the analytics in your browser records nothing until they answer. Elsewhere, it is on unless you turn it off. When you are signed in and it is on, it tells PostHog who you are by your GitHub username and email address, where your account has them.

Events our server sends. Some events are sent to PostHog by our server rather than by your browser: asking for a resource or signing up for updates, leaving a checkout without paying, returning to the page that confirms an earlier checkout, asking again for the sign-in link to a purchase, accepting an assignment, reaching a lesson of a self-paced course you cannot open, and progress through one bought before September 9, 2026. Our server follows the same answer as your browser, which it reads from a cookie that keeps a copy of your answer for a year from your last visit: it sends nothing from a browser that declined or used the button below, and nothing from a browser that is asked first and has not answered. What it does send is recorded under your GitHub username, your email address or, failing both, your account number, and leaving a checkout is recorded under an identifier for your browser session. Accepting an assignment, or returning to that confirmation page with the email address of an existing account, can also record whether you teach or study in a class, your plan, how many classes you run and whether your GitHub account is connected.

Clearing or blocking cookies is not a reliable way to switch analytics or session recording off, because the identifier is also kept in your browser's storage. Use the button below instead. It applies to this browser, takes effect immediately, and stops the analytics and the session recording in your browser and the events our server sends from it.

Turn off analytics and session recording

7. Your Rights

Instructors asking about their own account, and anyone asking about marketing email or analytics. You may ask us for a copy of the personal data we hold about you, in a portable format, and ask us to correct or delete it. You can also opt out of marketing email at any time. Email hello@coderin90.com.

Students asking about their class data. Your class data is held for your instructor's institution, which decides what happens to it. To ask for a copy of it, or for it to be corrected or deleted, send your request to your instructor. If you send it to us instead, we will forward it to your instructor and act on it when they tell us to.

What erasing an account does. It anonymizes the account rather than removing every record, so that the class records other people rely on stay intact. Erasing an account:

• keeps the account as a placeholder, with its email address replaced, no usable password, and its link to GitHub removed;
• deletes CLI transcript content;
• clears coaching message text, the reasons for and outcomes of one-on-one meetings, and staged interview and Studio session transcripts and their scores;
• keeps the student's place on a class roster, with the GitHub username, name and email address stored on it removed;
• deletes marketing records, and removes the address, subject and body from the log of email sent;
• keeps billing records, with the email address replaced, for tax reasons;
• keeps the record of what was agreed to on the CLI consent screen.

It leaves in place the submissions, scores and AI-generated feedback on a student's work, the address of each repository, which contains the GitHub username, notes an instructor wrote about a catch-up session several students attended, and the GitHub username on a teaching assistant's record of repository access, which is needed to take that access away.

Erasing an account does not delete repositories on GitHub, which live in the instructor's GitHub organization, and does not remove the person as a collaborator on them. It does not reach anything held by PostHog, including session recordings.

A student can see everything the CLI has collected and sent by running cin90 inspect or cin90 transcript at any time. Anyone can turn off analytics, session recording and the events our server sends from their browser with the button in Section 6.

8. Security

The site is served over HTTPS. Card details are handled by Stripe and never reach our servers. Before a CLI transcript can be read, it passes through a redaction step that removes the secrets and personal data it detects, and if any part of that step cannot run, the transcript is not made readable at all. AI provider keys that instructors supply are stored encrypted.

9. Changes to This Policy

We may update this policy. Each version carries its effective date at the top of this page. The previous version was effective September 10, 2026, and the one before it, effective March 18, 2026, was written before Coder in 90 Classroom. Email us if you need a copy of either.

10. Contact Us

If you have questions about this policy or your personal data, email hello@coderin90.com.