Data
How we handle your data
What we store, why, where it lives and how to get rid of it. Written to be read rather than survived. The privacy policy is the formal version; this is the same thing in plain words.
The short version. We hold your email, what you choose to put on your profile, and what you have built here. We do not sell it, we do not track you across other sites, and there are no advertising cookies, which is why you have never seen a consent banner on this site. Email hello@studiessprint.com and we will delete the lot.
Your account
| What | Why | How long |
|---|---|---|
| Email address | Signing in, password resets, and telling you the result of a challenge you entered. | Until you delete your account. |
| Password | Signing in. Stored as a bcrypt hash, never as text, so nobody here can read it. | Until you delete your account. |
| Name and username | Shown on your profile, on the leaderboard and next to anything you post. | Until you delete your account. |
| Date of birth | Checking you meet the minimum age. Competitions have an age limit and we have to be able to show we applied it. | Until you delete your account. |
| Gender, and where you heard about us | Both optional. Used only as counts, to see who the site is and is not reaching. | Until you delete your account. |
| Bio, avatar and LinkedIn link | Optional, and public by design. This is the part an employer sees. | Until you remove them or delete your account. |
| Last seen time | Showing who is active, and spotting an account being used from somewhere it should not be. | Overwritten each visit. |
What you do here
| What | Why | How long |
|---|---|---|
| Challenge entries | Judging, and your record on the leaderboard. Includes your walkthrough video and your written answers. | Kept while the leaderboard references them. Removed with your account. |
| Community posts, comments and reactions | The feed itself. | Until you delete them, or your account. |
| Job applications | Sent to the employer who posted the role. They see your application; they do not see your account. | Until you withdraw the application or delete your account. |
| Jobs board interest | Just an address, so we can tell you once when the board opens. | Deleted once the board has opened and that email has gone out. |
Payments
| What | Why | How long |
|---|---|---|
| Card details | We never receive them. The card is entered on Stripe's own checkout page and stays with Stripe. | Not held by us at all. |
| Stripe customer and subscription identifiers | Knowing whether your membership is active, and letting you open your own billing portal. | Until you delete your account. Stripe keeps its own records for its legal obligations. |
Keeping the account safe
| What | Why | How long |
|---|---|---|
| Session token | Keeping you signed in. One device at a time, so signing in elsewhere ends the older session. | Until you sign out or it expires. |
| Two-factor secret | Only if you switch two-factor on. | Until you switch it off, or delete your account. |
| Password reset token | Making a reset link work once and then stop. | Hashed, and expires shortly after it is issued. |
| IP address | Rate limiting, so one machine cannot hammer the login form. Held as a counter key, not as a log of where you went. | Minutes, then it expires by itself. |
Who else touches it
Three companies, each doing one job. Nobody else receives your data, and none of them are advertising networks.
| Company | What for | Where |
|---|---|---|
| Supabase | Database hosting: accounts, progress, community posts | EU / US, depending on region |
| Stripe | Payments: card details go straight to Stripe, never to us | EU / US |
| Resend | Transactional email: password resets | US |
What you can ask for
- A copy of everything. Ask and you get it, in a format you can open.
- A correction. Most of it you can edit yourself in settings.
- Deletion. Your account and everything attached to it. Two things survive, and only because the law requires it: payment records Stripe must keep, and the fact that a prize was awarded, if one was.
- To take it elsewhere. Your profile and your entries, exported.
- To complain. To us first, and to your data protection regulator if we do not put it right.
One address for all of it: hello@studiessprint.com. A person reads it. We answer within 30 days, and usually the same week.
If something goes wrong
If data is exposed in a way that puts anyone at risk, we tell the people affected and the regulator within 72 hours of finding out. Not a press release weeks later. If you have found a hole, the security page says how to report it.
StudiesSprint is the data controller. Governed by the law of England and Wales. Last reviewed August 2026.