Privacy Policy

Account data you give us:

• Email address, username and display name (optional: it defaults to your username).
• Password. We never store it in plain text: only a salted hash made by ASP.NET Core Identity.
• A short bio (up to 280 characters) and a profile photo, both optional. The photo is cropped and resized on your device before it is uploaded.
• When the account was created and when you last signed in.

Learning data created by using the app: your answers and attempts (the option you chose, whether it was correct, time spent), practice sessions, daily challenges, XP, levels, streaks, achievements, topic, roadmap and module progress, and the notifications shown inside the app.

Technical data: your language choice (stored on your device), and the IP address and browser identification that any web server sees. The IP address is used to limit abusive requests and appears in our web server access logs. Application logs keep the method, route, status code, duration and your internal user identifier, never message bodies, passwords, tokens or email addresses.

We do not collect your location, contacts, advertising or device identifiers, date of birth or payment information, and the app does not use analytics, advertising or tracking SDKs.

• To run your account and sign you in securely.
• To save your progress, award XP and achievements, adapt the difficulty of practice to your accuracy and show leaderboards.
• To send the service emails described below.
• To protect the service: rate limiting, account lockout after repeated wrong passwords and fixing errors.

We do not sell your data, do not show advertising and do not use your data to train advertising profiles. Our legal bases under the GDPR are the contract with you (your account, your progress and the emails that make them work) and our legitimate interest in keeping the service secure (rate limits, lockouts and logs). We do not rely on your consent for these.

• Leaderboards (visible only to signed-in users) show your username, display name, profile photo, level, XP, questions answered and accuracy.
• In Settings, Privacy, you can turn off “Show me on the leaderboards” to stay out of every leaderboard. Your progress and XP are kept.
• A signed-in learner who opens your profile page sees your display name, username, photo, bio, member-since date, level, XP, streaks, accuracy, topic and roadmap progress, achievements and recent daily activity. Turning off the leaderboards does not currently hide this profile page.
• Your email address is never shown to other learners.
• Your profile photo is served from a web address that does not require signing in. The address contains a random internal identifier and is not listed anywhere, but anyone who has the link can open it.

TechRat administrators can see your email, username, display name, level, XP, number of answers, accuracy, creation date and last sign-in date in order to operate and support the service.

We send only service emails: a link to confirm your email address when you sign up, a notice if someone tries to sign up with an address that already has an account, a password reset link when you ask for one, a notice that your password was changed and a confirmation that your account was deleted. We send no marketing emails.

Emails are delivered by Resend, which processes the message for us in its European region in Ireland. Resend is a United States company, so any transfer to it relies on the safeguards of its data processing agreement.

• techrat.auth: the sign-in session cookie of the website. It is HttpOnly (JavaScript cannot read it), Secure and SameSite=Strict, and lasts up to 14 days, renewed while you use the site. It is strictly necessary.
• techrat-locale: remembers your language for one year.
• localStorage key techrat.locale: also remembers your language.
• The Android app keeps its sign-in tokens in the device’s secure storage (Android Keystore).

We do not use advertising or analytics cookies and we load no third-party scripts or fonts.

We do not sell or share your data for advertising. We use service providers that only process data on our behalf, under a data processing agreement:

• Hosting: TechRat runs on a virtual private server from Hostinger that holds the database (see section 7 for where it is).
• Email delivery, as described above.

We may disclose data when the law requires it. Study links inside the app open third-party sites that you choose to visit; their own policies apply there.

Your data is stored on the Hostinger server described above, in a data centre in the United Kingdom. The United Kingdom is outside the European Economic Area, but the European Commission recognises it as providing an adequate level of data protection (an adequacy decision, renewed in December 2025 and valid until 27 December 2031), so no further safeguard is needed for that transfer. Emails are processed in Ireland by Resend; because Resend is a United States company, any transfer to it relies on the safeguards of its data processing agreement, as described in section 4.

• We keep your data while your account exists.
• If you delete your account, your credentials, profile, photo, progress, XP, achievements and notifications are deleted immediately and every session ends.
• Backups are made daily on the server and deleted automatically after 14 days, so an older copy can contain your data for up to 14 days after you delete your account.
• Server logs may keep your random internal identifier (no name, no email) and, in web server access logs, IP addresses and requested addresses until they are rotated: web server access logs are deleted after at most 40 days and application logs are overwritten as their size-limited files rotate.

Connections to TechRat use HTTPS. Passwords are stored as salted hashes, repeated wrong passwords lock the account for a few minutes, requests are rate limited and the database is not reachable from the internet. No system is perfectly secure, so please choose a strong, unique password.

TechRat is meant for people aged 16 or over (16 is the age of digital consent in Ireland) and does not knowingly collect data from younger children. There is no age check when you sign up today. If you believe a child has created an account, write to us and we will delete it.

• Access and correction: you can see your data in the app and change your display name, bio, photo and password in Settings.
• Deletion: in Settings, Delete account (website), in Profile, Delete account (Android app), or at https://techrat.io/account/delete. It takes effect immediately.
• Other requests, such as a copy of your data in a portable format, objection or restriction: write to pablo.luan.carvalho@gmail.com; we answer within one month, as the GDPR requires. You may also complain to the Data Protection Commission, Ireland’s supervisory authority (dataprotection.ie).

When we change this policy we publish the new version on this page with a new date. For important changes we will also tell you in the app or by email.

Questions or requests about your data: pablo.luan.carvalho@gmail.com.