Privacy policy

ByteMonk Academy runs this site, bytemonk.io, and the courses, practice tools and assessments on it. When this policy says “we”, it means ByteMonk Academy. The person responsible for how your data is handled can be reached through the contact page or at himalay@bytemonk.io.

The short version: we keep what the site needs to teach you and to bill you, we send it to a small number of providers who do specific jobs for us, we do not sell it, and we do not run advertising trackers.

Your account. An email address and a password, or, if you sign in with Google or GitHub, the email address, name and profile picture that provider shares with us together with an identifier for your account there. We never see your Google or GitHub password. A display name you set is stored with your profile.

Your learning. Which lessons you have completed, your quiz attempts and scores, what you liked, and everything you submit to the practice tools: system-design whiteboards and written answers, the questions you ask during a practice session or to the tutor, and the solutions you submit to coding problems. This is what lets the site remember where you are and show you how you did.

Your purchases. Which plan you bought, when, the amount and currency, its status, and the reference numbers our payment providers give us for the payment or subscription. We never receive or store card numbers, UPI ids or bank details; those go to the provider directly (section 5).

What you write to us. Messages sent through the contact form, feedback submitted through the feedback page (with your email only if you chose to give it), and your email address if you subscribe to the newsletter.

Assessments. If you sit a timed assessment run with a university or an employer (a “campus drive”), we collect the name, roll or entry number and institute email you enter when you join, your submissions, and the verdicts and scores they receive.

Mock interviews. If you take part in a mock interview, the whiteboard from that session, the interviewer’s notes and the feedback written for you are stored so you can come back to them.

Technical records. Our servers keep short-lived logs that include your IP address and the pages requested, used to rate-limit forms and APIs and to investigate abuse. Page views are counted by an analytics tool configured not to identify you (section 6).

• No advertising or cross-site tracking of any kind.
• No card, UPI or bank details. Payment pages belong to Razorpay or Stripe, not to us.
• No analytics cookies and nothing analytics-related stored in your browser (section 6).
• No location beyond what an IP address implies, and we do not look that up.
• No data bought from, or sold to, anyone.

• To run the site: sign you in, remember your progress, grade your quizzes and problems, and show you your own work.
• To bill you and to know which courses your account may open.
• To send the emails the service needs: confirming your address, resetting your password, a receipt or a note about your access. The newsletter is separate and goes only to people who subscribed; every issue carries an unsubscribe link.
• To reply when you write to us.
• To run an assessment on behalf of the institution that organised it, and to give that institution the results (section 7).
• To keep the service working and safe: rate limits, abuse investigation, debugging.
• To improve the courses and the automated grading, using submissions in aggregate or with anything identifying removed.

The practice tools grade system-design answers, answer clarifying questions, and power the tutor with a large language model. When you use them, the answer or whiteboard you submit, your question, and the lesson context it relates to are sent to Anthropic, whose model produces the evaluation or reply. Coding submissions are compiled and run by Judge0, a code-execution service, against the problem’s tests.

Both are processors acting on our instructions under their commercial API terms, which do not allow them to use what we send to train their models. Please keep personal details, passwords and secrets out of whiteboards, code and tutor questions all the same: nothing in a practice session needs them.

The model’s verdicts are automated and can be wrong. They are practice feedback, not a judgement about you, and for assessments a person reviews before anything is reported (section 7).

We do not sell personal data and do not share it for anyone else’s marketing. It goes to:

• Providers who run parts of the service for us: Supabase (database, sign-in and file storage), Vercel (hosting), Resend (email delivery), Anthropic and Judge0 (section 4), PostHog (page-view analytics, section 6), and, for video lessons, a video hosting provider that streams the video to you. Each receives only what its job needs.
• Payment providers: Razorpay (payments in India) and Stripe (elsewhere). You give them your payment details directly on their pages; they tell us whether the payment succeeded and give us a reference for it.
• Google or GitHub, if you choose to sign in with them. They learn that you signed in to ByteMonk; their own privacy policies govern what they do with that.
• YouTube, when a lesson embeds a video. We use the privacy-enhanced embed, which does not set cookies until you play the video; once you do, YouTube’s policy applies.
• The institution organising an assessment you sit (section 7).
• Anyone the law requires us to, or where needed to protect the service or someone’s safety.

These providers run on servers in several countries, so your data may be stored and processed outside the country you live in.

A campus drive is an assessment we run for a university or an employer. The organiser sets who may sit it and what it is for. When you join with a code, you are telling us it is fine to give that organiser your name, the roll or entry number you enter, your email address, your submissions, the verdicts, your scores, and a record of when you started and finished. The organiser is responsible for what it does with them afterwards; ask them about their retention and their decisions.

Grading of coding problems in an assessment is automatic. The system-design problem is scored by the model and marked by a person before results are reported.

Sign-in cookies. When you sign in, our authentication provider sets cookies that keep you signed in and refresh your session. They are essential: without them there is no account. Signing out removes them.

During a timed assessment the browser keeps a cookie identifying the device you started on, so a page reload does not lose your place and so the organiser can see if one attempt moved between machines.

Your preferences (light or dark theme, a collapsed panel) are kept in your browser’s own storage and never sent to us.

Analytics uses PostHog with persistence turned off: it counts page views in memory while the page is open, sets no cookie, writes nothing to your browser, and has no profile to tie your visit to. That is why there is no cookie banner: nothing here needs consent.

• Account and learning data: for as long as your account exists.
• Purchase records: as long as accounting and tax rules require after the purchase, even if the account is later deleted.
• Assessment records: for the organiser’s process, and as our own record of the drive.
• Contact messages and feedback: until they are dealt with and for a reasonable time after, so a follow-up has its context.
• Newsletter address: until you unsubscribe.
• Server logs: briefly, on a rolling basis.

You can see and change your profile from your account page, and unsubscribe from the newsletter with the link in any issue or on the unsubscribe page.

For anything else, including a copy of what we hold about you, a correction, or deleting your account and its learning data, write to us through the contact page from the address on the account. We will confirm it is you and act on it without undue delay. Purchase records we are required to keep are the one exception to deletion. Depending on where you live, you may have further rights under local law and the right to complain to a data-protection authority; we would rather hear from you first.

Everything travels over TLS. Passwords are hashed by our authentication provider and are never visible to us. Database access is restricted row by row so that one member cannot read another member’s data, and the keys that can bypass those rules live only on the server. Payment details never reach us at all.

No system is perfect. If you find a weakness, please tell us through the contact page before telling anyone else, and give us a chance to fix it.

The site is for people who are at least 16, or the age at which someone in your country may agree to a service like this on their own. We do not knowingly keep data about anyone younger; if you believe we have, write to us and we will remove it.

When the site starts doing something new with your data, this page changes in the same release, and the date at the top moves. A change that matters to existing members is announced by email or on the site before it takes effect.