Privacy Policy

Last updated: October 18, 2026

Who we are
What we collect
Why we use it
Legal bases for people in the EU and UK
Who we share it with
How long we keep it
Your rights and how to use them
Children
Security
International transfers
Cookies and similar technology
Changes to this policy
Contact

1. Who we are

NoobAcademy (noobacademy.com) is run by Xero Media LLC. In this policy, "we", "us" and "our" mean Xero Media LLC. We decide what personal information NoobAcademy collects and why, so under privacy laws such as the GDPR we are the "controller" of your information.

This policy explains what we collect when you use NoobAcademy, what we do with it, and the choices you have. It goes together with our Terms of Service.

2. What we collect

Information you give us

Your email address, your display name and your password when you create an account. We never store your password itself, only a one-way scrambled version (a hash) that we cannot turn back into the password.
Your answers to the first-run questions, such as your daily goal, and the settings you choose (sound, theme, captions, auto-play, whether the Cade mascot shows, and so on).
An email address, if you join the waitlist for paid plans, or if you write to us.

Classes, educators and help questions

If you are in a class, we record which class and who the educator is. An educator can make an account for a student using the student's name or the student's email address. When an educator makes an account from a name, the account has a username and a temporary password and no email address. The educator gives us the name; the student picks their own password at the first login.
When you ask for help in a lesson, we save your message, the code that was in your editor, the lesson, and the answers you get. If you are in a class the question goes to your educator. If you are not, it goes to the NoobAcademy team.
Educators see their students' names, usernames or emails, and progress (see section 5). We keep a short log of the invite emails an educator sends, so we can limit how many they send in a day.

Discord (only if you use it)

If you press "Link Discord", Discord asks you to approve it. We then save your Discord user ID, your Discord username and the time you linked. We ask Discord for your name only (the "identify" permission) and for permission to add you to the NoobAcademy Discord server ("join servers for you"). Discord gives us a short-lived key for this. We use it once, right away, and we do not store it or write it to our logs.
You can also sign in or sign up with Discord ("Continue with Discord"). Then Discord also gives us your email address (the "email" permission), your Discord user ID, your Discord username and your Discord display name. If you already linked Discord, this just signs you in. If you are new, we use your Discord display name and your email to fill in the "Finish signing up" page, and we make your account when you press the button. We only do this when Discord says your email is verified. If it does not, we make no account: you can verify your email in Discord, or sign up here with an email and a password. We never sign you in to, or link Discord to, an existing account that has the same email: you have to sign in with that account's password first. We keep what Discord sent, and the short-lived key, only in the server's memory for up to 10 minutes while you finish signing up, and we clear it when that time is up. Then it is thrown away, and nothing is saved if you do not finish. An account made this way has no password until you choose one. In Settings, press "Email me a link" (or use "Forgot password") and we email a link to the address on your account.
After that, we set roles for you in our Discord server: Linked, your level (Noob, Scripter, Coder, Builder or Architect), and Pro, Educator or Staff if they apply to your NoobAcademy account. Other people in the server can see your Discord name and your roles, like any other member.
We never read your messages, your friends or any other server you are in. We only change the roles we manage, and no other role.
You can unlink any time in Settings. You can see what we saved in "Download my data".
Help notices. If you are not in a class and you send a private help question from a lesson, our Discord bot posts a short notice in a staff-only channel of our Discord server. It has your display name, the course and lesson, and a link to our help inbox. It never has your code or your message. Only NoobAcademy staff can see that channel. We never post a notice for an account that an educator made for a class.

Information about how you learn

Your lesson progress: which lessons you started and passed, how many tries you took, your XP, level, streak and achievements.
Certificates of Completion you earn, with the name you had when it was issued.
The code you write. We save a draft of your code as you type, and we keep the code that passed each lesson. When you press Run or Submit, your code is sent to our code runner, which runs it in a sandbox with no access to our database or the internet. We do not keep the output of your runs, with one exception: when you pass a chapter project, we keep what the passing run printed (at most 8 KB), so the "Your game so far" page can show your game. Only you see that page. We do not show it to other learners or to educators, and it is in your data download.
Each graded try. When you submit code or finish a quiz while signed in, we save a record of that try: the lesson, the time, your score, and which checks or questions you got right. For code, we also save the code you submitted. For a quiz, we also save the answers you gave. Pressing Run is not a try and is not recorded.
Pastes. When you paste text into the code editor or a quiz answer box while signed in, we save how many characters and lines it was, when you pasted it, and whether the text came from the lesson or from your own code in the editor, such as a line you copied and pasted again. We do not save the pasted text in this record.
A typing summary. When you submit code while signed in, your browser also sends a short summary of how the code was typed: how fast and how evenly you typed and how many corrections you made. It never includes which keys you pressed or when you pressed each one. We save this summary with the try.
An outside help guess. For each graded code try, we work out an automatic guess of how much outside help the try had, and we save it with the reasons in plain sentences. It is shown only to educators and staff, it is never used alone to decide anything, and it is included in your data export. It is made by fixed rules from the size of your pastes, the typing summary and the code you submitted, for example whether the code uses something the course has not taught yet. No artificial intelligence is used.
Who sees these records: you, in your data export (see section 7); your educator, if you are in their class; and NoobAcademy staff. We do not show them to anyone else.

Technical information

Your IP address. We use it for security and rate limits, for example to slow down someone guessing passwords and to count how many code runs a visitor has used in a day. For visitors without an account, that daily count is tied to the IP address and is kept for a few days.
Our hosting provider and Cloudflare may also record standard request details in their logs, such as IP address, browser type and the page asked for.
The date you created your account, the last time you were seen, and the version of the Terms you agreed to and when.

Optional, cookieless analytics

We may use Cloudflare Web Analytics to see how many people visit and which pages they read. It does not use cookies, does not follow you across other sites and does not build a profile of you.

Things we do not collect

We do not take payments yet, so we hold no card or bank details. We do not collect your precise location. We do not use advertising trackers.

3. Why we use it

To run NoobAcademy. To create your account, sign you in, save your progress, run your code, give you XP and certificates, and send emails you ask for, such as a password reset link.
For security and to stop abuse. To protect accounts, limit automated sign-ups (we use Cloudflare Turnstile for this) and keep the code runner fair for everyone.
To improve the lessons. To see where learners get stuck, such as lessons with many failed tries, and fix them. We look at counts and patterns, not at you as a person.
To let you sign in with Discord and to help you quickly. To sign you in or sign you up when you choose "Continue with Discord", to give you roles in our Discord server, and to tell our staff there that someone is waiting for an answer.
To let educators teach. To show educators how their students are doing, including their tries, pastes and the outside help guess, and to pass help questions to the right person. The guess is a hint to look closer, not a decision.
To follow the law. To answer legal requests and keep records we must keep.

We do not sell your personal information and we do not use it for advertising.

4. Legal bases for people in the EU and UK

If you are in the European Economic Area or the United Kingdom, the law says we need a reason, called a legal basis, to use your information. Ours are:

Contract. We need your account details, progress and code to give you the service you signed up for.
Legitimate interests. We use technical information and aggregate usage to keep the service secure, stop abuse and improve the lessons. We believe this is fair and does not override your rights. You can object (see section 7).
Consent. If we ever ask for your consent to something optional, you can take it back at any time.
Legal obligation. Where the law requires us to keep or share something.

We share information only with companies that help us run NoobAcademy, and only what they need:

Cloudflare. It provides our network, security and delivery (CDN), the Turnstile check on sign-up and forgot-password, optional Web Analytics, and possibly the email we send. See Cloudflare's privacy policy.
Our hosting provider. The company whose servers run NoobAcademy and store our database.
An email provider. To deliver emails such as password resets. This is Cloudflare or another provider we choose and will name here.
Discord. Only if you link your Discord account or sign in with it. Discord receives our requests to add you to our server and to set your roles, and it handles your Discord account under its own rules. If you ask for help without being in a class, Discord also holds the short staff notice described in section 2 on our own server. See Discord's privacy policy.

These companies may only use your information to provide their service to us.

We also share information with your educator, if you are in a class. The educator of a class can see their students' names, usernames or emails, levels, XP, lessons passed, tries, the lessons they are stuck on, their streak, when they were last on the site, each graded try (the score, which checks or questions were right, and the code or answers submitted), the size and time of pastes, the typing summary and outside help guess of each code try, and the help questions and code they send. Educators cannot see passwords. If you are in more than one class, each educator sees only the students in their own classes. Our staff can also see this information, to run the site and answer help questions from students who are not in a class.

We may also share information if the law or a court requires it, to protect people's safety or our rights, or if NoobAcademy is sold or merged with another business (we would tell you first if your information would be handled differently).

We do not sell your information and we do not share it for advertising.

6. How long we keep it

Your account and learning data stay until you delete your account. You can delete it yourself in Settings at any time. (If you signed up with Discord and have no password yet, Settings first emails you a link to choose one, because deleting asks for your password. You can also email us and we will delete the account for you.)
Your Discord sign in or sign up, before you finish, is kept in the server's memory for up to 10 minutes and then thrown away. A restart of the server also clears it.
Staff notices in Discord stay in our staff channel until our staff delete them. They hold no code and no message.
Your Discord link stays until you unlink it or delete your account. When you do either, we take our roles away from you in the Discord server and delete the Discord ID and username we saved. You stay in the server unless you leave it. If Discord does not answer, we try again for a while.
When you delete your account, we delete your profile, progress, drafts, tries, paste records, the saved output of your chapter projects, XP history, achievements and certificates. We chose to delete certificates instead of keeping them, so a deleted account's certificate codes stop working. Copies in backups are removed on the normal backup cycle, within 30 days.
Tries and pastes. The code you submitted and the paste records are deleted after 1 year. The score of each try, which checks or questions you got right, your quiz answers, and the typing summary and outside help guess of each code try stay with your progress until you delete your account.
Help questions and answers are kept until the account that asked is deleted, and then they are deleted with it. If an educator deletes their account, their classes are deleted. Their students keep their own accounts and progress.
Invite links. A link in an invite email from an educator, to set a first password, works once and for 7 days.
Password reset links stop working after 60 minutes and after one use. We keep only a scrambled version of the link, never the link itself.
Daily run counts tied to an IP address are kept for a few days.
Server and security logs are kept for up to 30 days, unless we need longer to look into a security problem.
Emails you send us are kept as long as we need to answer you and for a reasonable time after.

7. Your rights and how to use them

You can ask us to:

Give you access to your information, and a copy of it. In Settings, press "Download my data" to get a file with everything we store about your account, except your password hash.
Delete your account and its data. In Settings, use "Delete my account". You will need your password. If you signed up with Discord and never chose one, Settings first emails you a link to choose it, or you can email us (see section 13) and we will delete the account for you.
Correct information that is wrong. You can change your display name in Settings. For anything else, such as your email address, write to us.
Limit or object to some uses of your information, and take back your consent where we rely on it.
Move your data to another service. The downloaded file is in JSON, a common format.

If you linked Discord, you can unlink it any time in Settings.

If you joined a class with a code, you can leave it any time in Settings. If your educator made your account, you can ask your educator, or us, to take you out of the class or to delete the account.

You can use these rights through Settings or by emailing us (see section 13). We may need to check that you are who you say you are. We aim to answer within 30 days.

If you are in the EU or UK, you also have the right to complain to your local data protection authority. We would like the chance to fix things first, so please write to us.

If you live in California, you have the right to know what personal information we collect, to ask us to delete or correct it, and not to be treated worse for using these rights. We do not sell personal information and we do not share it for cross-context advertising.

8. Children

NoobAcademy is for people who are 13 or older. If you are under 18, you need a parent or guardian to read the Terms and this policy and agree to them for you.

Children under 13 may only have an account that an educator at their school makes for them. An educator who does this confirms that they have authorization from the school, or from the child's parent or legal guardian (see section 17 of the Terms). For these accounts we collect only what the class needs: a name chosen by the educator, a username or email, and the child's learning progress, graded tries (with their typing summaries and outside help guesses), paste records, help questions and code. A username account has no email address. We use this information only to run the class and the lessons, and we do not use it for advertising. A parent or guardian can email us (see section 13) to see, correct or delete their child's information.

Discord needs its members to be 13 or older. So accounts that an educator made for a class cannot link Discord or sign in with it.

We do not knowingly collect personal information from other children under 13 (as the US law called COPPA requires). If we learn that we have collected information from a child under 13 who is not in a class made by an educator, we will delete it. If you think a child under 13 has an account like that, please email us and we will remove it.

In some countries the age at which a young person can agree to the use of their information is higher than 13. If that is the case where you live, you need your parent's permission to use NoobAcademy.

9. Security

We protect your information with encrypted connections (HTTPS), hashed passwords, limits on how many times someone can try to sign in, and a sandbox for the code that learners run, which cannot reach our database or the internet. We keep access to our servers limited.

No website is perfectly secure, so we cannot promise that nothing will ever go wrong. If a problem affects your information, we will tell you and the authorities when the law says we must. Please use a strong password that you do not use anywhere else.

10. International transfers

We are based in the United States. Our servers and the companies we use may be in the United States or other countries, which may have different privacy laws from where you live. If you are in the EU or UK, your information is sent to the United States and other countries. Where the law requires it, we rely on safeguards such as the standard contractual clauses approved by the European Commission and the UK, or on a provider's participation in the EU-US Data Privacy Framework.

11. Cookies and similar technology

Sign-in cookie. When you log in, we set one cookie (called anvilcade_auth) so the site knows who you are. It is needed for the site to work and lasts up to 30 days.
Discord sign in cookies. If you choose "Continue with Discord", we set one short cookie (called na_discord_login) before we send you to Discord, to make sure the person who comes back is the one who left. It lasts up to 10 minutes. If you are new, we set another (called na_discord_signup) for the "Finish signing up" page, also for up to 10 minutes. Both are needed for the sign in to work, and we delete them as soon as they are used.
Security cookies from Cloudflare. Cloudflare may set its own cookies to keep the site secure and tell people from bots.
Your browser's storage. Your browser keeps small things for you, such as your theme, sound settings and, if you try lessons without an account, the lessons you passed as a guest and what your chapter project printed. That stays in your browser. We only receive guest progress if you sign up and it is added to your account.

We do not use advertising or tracking cookies. Because we only use essential cookies, we do not show a cookie banner.

12. Changes to this policy

We may update this policy. We will change the date at the top, and if the change is important we will tell you, for example by email or with a notice on the site. If you keep using NoobAcademy after a change, that means you accept the updated policy. If you do not agree with it, you can delete your account.

13. Contact

Questions about this policy, or want to use your rights? Email [email protected].