Privacy policy.

DSA University is a learning platform for data structures and algorithms, operated by DSA University. Where this policy says “we”, it means that entity. Where it says “you”, it means anyone with an account or anyone browsing the public site.

For data protection purposes we are the controller of the personal data described below. Our data protection contact is privacy@dsauniversity.com.

We try to collect the minimum that lets the product work, and we would rather store a derived number than a raw record. In practice the data falls into five groups.

• →Account data — name, email address, password hash, and your chosen handle. If you sign in through Google or GitHub we receive your email and profile name from them, never your password.
• →Learning data — problems attempted and solved, submitted source code, verdicts, runtimes, notes you write, bookmarks, streaks and contest results. This is the substance of the product and it is tied to your account.
• →Billing data — plan, billing country, invoice history and the last four digits of a card. Full card numbers are handled by our payment provider and never reach our servers.
• →Usage data — pages visited, features used, approximate location derived from IP, device and browser type, and error reports. Used in aggregate to find what is broken and what is unused.
• →Communications — support tickets, forum posts, messages you send through the platform, and any survey responses.

Every use below maps to a lawful basis under GDPR-style regimes. Where the basis is legitimate interest, you have the right to object and we will stop unless we can show a compelling reason not to.

• →To run your account and deliver the curriculum — performance of a contract.
• →To judge submissions, compute ratings and maintain leaderboards — performance of a contract.
• →To take payment, issue invoices and process refunds — performance of a contract and legal obligation.
• →To detect plagiarism, cheating and abuse — legitimate interest in a fair platform.
• →To improve the product using aggregated usage patterns — legitimate interest.
• →To send service emails you cannot opt out of, such as security alerts and billing notices — legitimate interest and legal obligation.
• →To send marketing email — consent, withdrawable at any time from one link in every such message.

Code you submit is stored so you can review your own history, so the judge can re-run it, and so plagiarism comparison works. It is private to you by default.

Notes you write are private, are never used to train anything, and are exportable in full at any time from your Library. Forum posts and community solutions are public by definition — that is what publishing them means — and remain visible if you later delete your account, though they are dissociated from your name at your request.

We do not sell personal data. We share it with processors who perform a specific job for us under contract, and with nobody else except where the law requires it.

• →Cloud hosting and storage — to run the service.
• →Payment provider — to take payment and issue refunds.
• →Email and push delivery — to send the messages described above.
• →Error tracking and product analytics — to find faults and understand feature use.
• →Your institution, if you hold a Campus seat — limited to your cohort progress.

Each processor is bound by a data processing agreement, may use the data only on our instructions, and may not use it for their own purposes. A current list of subprocessors is available on request from privacy@dsauniversity.com.

• →Account and learning data — for as long as your account exists, then 30 days after deletion to allow recovery from mistakes.
• →Submitted code — 24 months, then deleted unless it is attached to a public solution you posted.
• →Billing records — 7 years, or whatever [YOUR JURISDICTION] requires for tax purposes, whichever is longer.
• →Server and access logs — 90 days.
• →Support tickets — 24 months after the ticket closes.

Depending on where you live you have some or all of the following rights. We honour all of them for everyone, regardless of jurisdiction, because operating two standards is worse than operating one.

• →Access — get a copy of the personal data we hold about you.
• →Portability — receive your learning data and notes in a machine-readable format.
• →Rectification — correct anything inaccurate.
• →Erasure — delete your account and the data attached to it, subject to the retention rules above.
• →Restriction and objection — tell us to stop a particular processing activity.
• →Withdraw consent — for anything we do on the basis of consent, at any time.

Write to privacy@dsauniversity.com and we will respond within 30 days. Account deletion and data export are also available directly in Settings without contacting anyone.

We use strictly necessary cookies for authentication and security — those cannot be switched off without breaking sign-in. We use a small number of analytics cookies to understand feature use, and those are opt-in where the law requires consent.

We do not use advertising cookies, and we do not embed third-party trackers on the learning surface.

Data is encrypted in transit and at rest. Passwords are hashed with a modern memory-hard algorithm and are never recoverable, including by us. Access to production data is restricted to staff who need it, requires two-factor authentication, and is logged.

Submitted code executes in a sandboxed environment with no network access and hard resource limits. No system is perfectly secure, and if a breach affects your personal data we will notify you and the relevant supervisory authority within 72 hours of becoming aware.

The service is not directed at children under 13, or under 16 where local law sets that threshold, and we do not knowingly create accounts for them. If you believe a child has an account, write to privacy@dsauniversity.com and we will delete it.

Our infrastructure is hosted in [YOUR REGIONS]. Where personal data moves outside your region, the transfer is covered by an adequacy decision or by standard contractual clauses. You can request a copy of the relevant safeguards.

We will post any change here and update the date at the top. If a change materially affects your rights we will email account holders at least 30 days before it takes effect, and continuing to use the service after that date constitutes acceptance.