Privacy Policy

LiveCodeShare-Pro (livecodeshare-pro.vercel.app) is built so that privacy comes from the design, not from a promise:

• Room code and chat are encrypted client-side with WebCrypto AES-GCM 256, keyed from the room password. Encryption happens in your browser, before transmission; our relay only ever forwards ciphertext.
• We do not store your room passwords, so we cannot decrypt your sessions — not for support requests, and not for anyone else's requests either. A lost password means that room's content is gone for good.
• There is no central database of user files. Your work lives in your browser's storage, in a real folder on your disk (disk-folder mode), or in your own Google Drive if you back up there. Local Offline mode never touches a server at all.

The list is short, because there are no accounts:

• Display name — whatever you type when entering a room. It isn't verified; a pseudonym is fine. Peers in your room see it; we don't keep a registry of names.
• Google profile basics (optional) — if you sign in for Drive backups, your Google name and email are used for authentication in your browser session.
• Contact form messages — if you write to us via /contact, we receive what you send: your name, email, topic, rating, and message. Used only to reply.
• Basic usage data — anonymous page views and feature usage, not tied to your identity.

What we do not collect: the contents of your rooms. Code and messages are encrypted before they reach any server, and we don't log or store them.

Being precise here matters more than sounding good:

• Encrypted room traffic goes through our relay server so peers stay in sync. It is ciphertext end to end.
• Cloud code runs send the file being executed (and any stdin you typed) to Wandbox, a third-party compiler service. This is the one deliberate exception to "your code never leaves encrypted": you choose it per run by pressing Run Cloud. Browser JS and WebNode runs stay entirely in your tab.
• Voice, video, and screen share are carried by Agora's real-time network, governed by Agora's privacy practices.
• AI requests use the key you configure and go directly to your chosen AI provider under that provider's policy. No key, no AI traffic.
• Drive backups are written from your browser straight to your Google Drive with your OAuth token. Neither your files nor your token pass through or get stored on our servers.

Drive backup uses only the https://www.googleapis.com/auth/drive.file scope, which means:

• We can read and write only files that were created or opened through LiveCodeShare-Pro.
• We cannot see, modify, or delete anything else in your Drive.
• You can revoke access at any time at myaccount.google.com/permissions; files already saved to your Drive stay there, under your control.

We use your browser's localStorage and sessionStorage for preferences and session state — themes, editor settings, practice progress, and similar. That data stays on your device and you can clear it any time through your browser's site-data settings.

Two kinds of third-party cookies can appear:

• Google AdSense serves ads on some pages (not inside the workspace) and may set advertising cookies. You can manage ad personalization at adssettings.google.com.
• Google OAuth sets its own cookies during sign-in, governed by Google's privacy policy.

We do not sell, rent, or trade your personal information. And because we hold neither your room passwords nor your decryption keys, we cannot hand over workspace content — the technical capability doesn't exist on our side.

The infrastructure providers named above (Vercel for hosting, Agora for calls, Wandbox for cloud runs, Google for OAuth/Drive/ads) each receive only what their role requires; Vercel, like any host, may keep standard server logs such as IP addresses and request metadata.

Most deletion you can do yourself, immediately, because the data lives with you:

• Browser data (preferences, offline workspaces, practice progress) — clear this site's data in your browser.
• Drive backups — delete the files in your Google Drive; revoke our access at Google Account Permissions.
• Temporary rooms expire automatically after inactivity.
• Contact messages — write to us and we'll delete the correspondence.

The Service is not directed at children under 13, and we don't knowingly collect personal information from them. If you believe a child has sent us personal information (realistically: through the contact form, since rooms have no accounts), tell us and we will delete it promptly.

When this policy changes, the "Last Updated" date at the top changes with it. Meaningful changes will be visible in what the page actually says, not buried — this document names concrete services, so a change in practice requires a change in text.

Questions about privacy? Contact us — messages go straight to the operator's inbox and are answered personally.