Privacy and support

Your account and practice

BioTorch stores an opaque account identifier, your username, submitted source, grading results, and your practice schedule in Cloudflare D1. Your history and progress remain until you request account deletion. Drafts and preferences stay in your browser. Email/password, Google, and GitHub sign-in are handled by Auth0; BioTorch does not store passwords or provider access tokens.

Model guides and the exercise catalog can be read without an account. Running code, saving progress and reviews require signing in.

Running your code

Modal runs the trusted judge and isolated learner execution. While you edit, your draft is sent to the policy checker to check permitted syntax and operations; these checks do not execute code or save a submission. The isolated worker receives submitted code and generated exercise inputs, without account identity or practice history. Bounded temporary execution outputs are stored privately in Cloudflare R2. They become eligible for lifecycle deletion after seven days; deletion is asynchronous, so this is not a guarantee of removal at exactly seven days.

Review reminder emails

Review reminders are off unless you turn them on from your profile. If you opt in, BioTorch stores the email address you enter, when you consented and confirmed it, and when reminders were sent. A confirmation email is sent first; nothing else is sent until you confirm. Reminders are sent at most once a week, only when reviews are due, through our email provider, Resend, which receives the address and the message to deliver it. Every email has a one-click unsubscribe link. Unsubscribing, or deleting your account, removes the stored address.

Public profile and exports

Your profile is private unless you publish it from your profile page. A published page at /u/your-username lists the problems you have solved on their current version and certificates for completed model paths. It never shows code, drafts, attempts, review schedules or your email address. Turning it off removes the page immediately.

You can download your accepted solutions at any time from your profile as a ZIP archive with a README, generated on request from your own records.

Analytics

BioTorch automatically collects limited product analytics while you are signed in. It helps us understand which exercises are useful and where the site needs improvement. Selected page views and learning actions are sent to PostHog with an opaque analytics identifier. We also measure execution wait times, broad error categories, and when you leave or return to an execution page. We do not send submitted code, email addresses, usernames, authentication tokens, or full URLs. There is no session recording or general click capture. Named learning controls report bounded impressions and clicks; reading, session and review events help measure the learning funnel. Account and execution records are used for essential progress, reliability, and cost reporting to operate the service.

Signed-in page views also include a device class (phone, tablet or desktop) and, if this browser recorded one on its first visit, a coarse first-touch category: how it arrived (for example search, social or a campaign), a short list of known referring sites, and the kind of page it landed on. Page-load and responsiveness timings and JavaScript error categories are sent without messages, code or URLs. The first-touch record stays in your browser until you are signed in with analytics allowed.

Signed-out visitors to public pages are measured only in aggregate with Cloudflare Web Analytics, which does not use cookies, local storage or fingerprinting. It records page views, referring sites, browser type and country, not who you are. Signed-out visitors are not tracked by the product analytics system above.

Account deletion queues removal of the associated analytics identity from PostHog. Vendor deletion is asynchronous and monitored separately. Additional raw analytics records are retained for up to 90 days in our database. PostHog’s free plan retains analytics events for up to one year unless removal is requested earlier; provider deletion may take time. Daily aggregate summaries contain no code or account identifiers and are retained for 13 months.

Exports and deletion

To request an export or deletion, contact the deployment operator. Account deletion can complete only after unresolved execution cleanup is confirmed. Daily usage totals that contain no account identifiers or submitted code remain after deletion. Historical database backups may retain earlier records until those backups expire under the operator’s retention policy; deletion from the active database does not immediately remove every backup copy. Browser drafts must be removed separately from this site’s browser storage.

For account help or privacy requests, contact Chris Hayduk on Twitter.