Cruxly › Privacy

Privacy

What this site records, where it keeps it, and who can see it. This page describes what the site's code does today. It is a description, not a contract.

Visits

Lessons, tools and the catalogue need no account. Each time a page of this site loads in your browser, signed in or not, it sends one page-view record to the server. Moving between pages inside the app after that does not send more. For each page view the server stores:

• the time and the page address;
• the name of the website that linked you here (only when it is another site), or a ref or utm_source tag if the link carried one;
• your country and city (see Location);
• device type (desktop, mobile or tablet), browser family and operating system family, worked out from your browser's user-agent string;
• whether this browser has visited before.

To tell new visits from returning ones, the server sets a cookie named cx_vid. It holds a random id, lasts two years, and scripts on the page cannot read it. It is not linked to your account. Browsers that identify themselves as crawlers or scripts are not recorded. Page-view records older than 400 days are deleted. The server also keeps a list of the cx_vid ids it has seen, each with the time it was first seen; that list is not deleted after 400 days.

The capacity calculator also sends a record, at most once per page load each, when you first edit an input, press Reset or copy the link. These records name only the action, never the numbers you typed, and are stored like page views (same cookie, time, location and device details).

Location

If the hosting provider passes your country along with the request, that is used. If not, the server sends your IP address to ipwho.is, an outside lookup service, and keeps only the country and city it returns. Your IP address is not written to the database. The server keeps recent lookups in memory so it does not repeat them; that memory is cleared whenever the server restarts.

When you have an account

An account stores your username, an optional display name, your password as a salted hash (PBKDF2-SHA256; the password itself is never stored), when the account was created and when you last signed in.

An email address is optional. If you give one, it is used only to send you a password-reset link, and you can change or remove it on the Account page. A reset link works once and expires after 30 minutes; the server stores only a hash of it, with when it was made and used. Reset emails are sent through an outside email service (Gmail or Brevo, depending on how the site is set up), which therefore sees your address and the message.

Signing in sets a cookie named dsa_sid that scripts on the page cannot read. The server stores only a hash of it, with when the session started, when it was last used, when it expires, and your browser's user-agent string, which the Account page shows so you can recognise your devices. A session ends when you sign out or when it expires. The Account page can also sign out your other devices.

While you are signed in, the site records what you do under your account: which problems and lessons you attempted or finished, attempt counts and your review schedule; code you submit for grading and its result; your notes; your behavioral stories; and interview-mode sessions with your self-ratings.

Where it is kept

The site runs on Wasmer (Wasmer Edge). What the server stores, as described on this page, is kept in databases on Wasmer's systems.

Kept only in your browser

Some settings are saved in your browser's local storage and are not sent to the server: your theme, sidebar and editor layout, code drafts, quiz answers, narration language and voice, and whether this browser was signed in last time (so the home page can skip the landing screen). Clearing your browser's site data removes them.

Other services your browser may contact

• cdn.jsdelivr.net, to load Pyodide, which runs your Python code inside your browser.
• cruxly-audio-*.wasmer.app, separate hosts that serve the recorded narration for the animated explainers. Where no recording exists, your browser's own speech voice reads the text; some browsers send that text to an online voice service.
• WhatsApp, LinkedIn or X, only if you click a share button.

There are no ads and no third-party analytics scripts. Fonts are served from this site.

Who can see it

The site's owner has a private dashboard. It shows visit totals, the page-view records described above (time, country, city, page, referring site, device, browser and system), and the most recent accounts with username, display name, sign-up time, last sign-in and number of problems solved. Calculator actions appear there too: a tool usage card counts them, and in the list of recent visits each one is its own row with its time, country, city, device and browser.

Signing out and clearing site data

Signing out ends the session on the server and removes the session cookie from your browser. Clearing your browser's site data removes the cx_vid cookie and the local settings above; it does not delete records already stored on the server.