Codecombat
- The documents do not say whether your data trains AI.
- Your data is used for personalized ads, including by third-party ad companies.
- Data is shared only with the providers who run the service.
- The documents do not say who can read your content.
They collect account and usage data, share it with many processors and analytics, and let you delete in settings.
Agent Trust Hub uses AI and may make mistakes. Review reports and confirm their contents before relying on them.
Collected
Account details, birthdate for home users, cookies, IP and site usage, plus school roster data.
Read the exact line
Privacy policy
“When registering a free home account, we ask for your email address, for authentication, and your birthdate (to ensure you are old enough to consent).”
Training
They use it to log you in, personalize the game, improve the site, and send optional emails.
Read the exact line
Privacy policy
“To provide authentication and rostering features.To personalize your experience.To improve our website.”
Sharing
They say they do not sell PII, but many vendors and Google Analytics can see usage data.
Read the exact line
Privacy policy
“We do not sell or trade to outside parties your personally identifiable information, and do not otherwise transfer it except as described in this privacy notice.”
Kept
You can delete in settings; EU unpaid inactive accounts may be kept up to 2 years.
Read the exact line
Privacy policy
“CodeCombat will retain server log files for no more than 30 days, and will retain inactive, unpaid EU user accounts for no more than 2 years.”
Controls
Delete your account in settings, turn off cookies in the browser, or unsubscribe from emails.
Read the exact line
Privacy policy
“To delete your account and all personal data relating to your account, go to https://codecombat.com/account/settings and scroll down to the section Delete Your Account”
Fine print
Policy changes are posted on the privacy page; they try to email you before closing an account.
Read the exact line
Privacy policy
“Users will be notified of any privacy policy changes on this Privacy Policy Page.”
Expand “Read the exact line” to see the source alongside the explanation.
What you can turn off
The controls and opt-outs their own documents describe, and where they say to find them.
Delete your account and personal data
https://codecombat.com/account/settings, section Delete Your Account
Turn off cookies in your browser
Your browser settings (Help menu); they warn some features will break
Unsubscribe from marketing email
Account preferences, email them, or the link at the bottom of each email
Ask about student or EU data rights
Contact [email protected] or CodeCombat Inc., 2261 Market Street #4388, San Francisco, CA 94114
If a switch is not where they say, the deletion request above still applies.
Line by line
The lines that matter most, worst first.
Outside companies can track how you use the site, not just CodeCombat.
Read the exact line
Privacy policy
“Does our site allow third party behavioral tracking?Yes, for example, via Google Analytics.”
For example, Google Analytics can record which pages you visit even if you are just playing a level.
Cookies remember you and help them study how people use the site.
Read the exact line
Privacy policy
“We also use cookies to help us compile about site traffic and site interaction so that we can offer better site experiences and tools in the future.”
For example, a cookie can show them you returned after finishing a coding level.
They say they do not sell your name and email, but they still send data to listed partners.
Read the exact line
Privacy policy
“We do not sell or trade to outside parties your personally identifiable information, and do not otherwise transfer it except as described in this privacy notice.”
For example, your email can go to SendGrid so they can send you account mail.
For school students they promise not to build ad profiles or sell student info.
Read the exact line
Privacy policy
“do not use any data collected via the service to target ads to students;do not create advertising profiles on students;do not sell student information;”
For example, a fifth grader’s classroom progress should not be used to show them toy ads.
You can wipe your account yourself in settings if you know the password.
Read the exact line
Privacy policy
“To delete your account and all personal data relating to your account, go to https://codecombat.com/account/settings and scroll down to the section Delete Your Account”
For example, a home player can type their email and password and click delete permanently.
If you stop using a free EU account, they may keep it for up to two years.
Read the exact line
Privacy policy
“will retain inactive, unpaid EU user accounts for no more than 2 years.”
For example, an unused home account in France could sit on their servers until the two-year mark.
They say they will try to email you before they shut your account, but it is only an attempt.
Read the exact line
Privacy policy
“Should CodeCombat need to terminate a user account, we will attempt to forewarn the user via the email address on file.”
For example, if they close a teacher account they will try to email the address used at signup.
They may change the rules and only update this page, not email you in advance.
Read the exact line
Privacy policy
“Users will be notified of any privacy policy changes on this Privacy Policy Page.”
For example, you might only notice a new tracking partner if you re-read the policy.
They list basic security steps like encryption and limited staff access.
Read the exact line
Privacy policy
“These measures include but are not limited to SSL, strong encryption, , , limited access controls, regular testing, and minimal data collection and data retention.”
For example, they say credit cards go through Stripe and are not stored on their servers.
Home users type their own birthdate; there is no extra age check described.
Read the exact line
Privacy policy
“When registering a free home account, we ask for your email address, for authentication, and your birthdate (to ensure you are old enough to consent).”
For example, a child could enter an older birthdate and still create a home account.
Words to know
Legal words from the lines above, in plain English.
- consent
- Your clear agreement to something, given by an action like ticking a box or tapping Accept. For example, a pop-up asking if the app may use your location is asking for consent.
- sell or share
- Under California law, selling means passing your data to others for money or other value; sharing means passing it on for targeted ads. For example, letting an ad network use your browsing history in return for ad space counts as a sale.
- personal data
- Any information that is about you or can be linked to you, from your name to your phone's ID. For example, your email, your IP address and the list of apps on your phone are all personal data.
- retention
- How long a company keeps your data before deleting it. For example, a policy might keep your messages for 30 days after you delete them, or for as long as it likes.
- third parties
- Any company or person other than you and the app, such as advertisers, partners or analytics firms. For example, an analytics company that receives a record of every screen you tap is a third party.
- cookies
- Small files a website saves on your device so it can recognise you and remember what you did. For example, a cookie keeps you logged in and can also tell an ad company which sites you visited.
- de-identified
- Data with your name and obvious identifiers removed, though it can sometimes still be traced back to you. For example, your chats with names stripped out may still be kept and studied after you delete your account.
- pseudonymous
- Your name is swapped for a code, but the company keeps the key and can still link the data back to you. For example, your chats are filed under user 48213 instead of your name, but staff can still look up who that is.
How we got here · grade C · score 40/100 · 15 of 15 policy answers backed by a verified quote · 7 not stated
What does the app collect beyond what it needs to work?
They collect account info plus cookies, IP, device and site-usage data, and school roster details when used in class.
Does it record your voice, face or body, and what happens to that?
Not stated in the documents.
Are your chats and uploads used to train AI models, and is that off by default?
Not stated in the documents.
Can employees or contractors read your conversations, and when?
Not stated in the documents.
Are you profiled or tracked for advertising?
They allow third-party behavioral tracking such as Google Analytics; they say they do not target ads to students.
Do they sell or share your data, and can you opt out?
They say they do not sell PII and share it with listed service providers and school tools.
What rights do they take over what you type and what the AI makes?
Not stated in the documents.
How long do they keep your data after you delete it, and can you delete it in the app?
You can delete in account settings; they also keep inactive unpaid EU accounts up to two years and logs 30 days.
Does it build a lasting memory or profile of you, and can you see, edit or turn it off?
Not stated in the documents.
Do they commit to basic security, and have they leaked data?
They describe SSL, encryption, limited access, and Stripe for payments; no independent audit is named.
Is there a real age gate, and are teens protected?
Home accounts ask for birthdate; school student accounts need a teacher. Age is self-declared, not extra-verified.
Will they tell you when the rules change, and is the policy specific?
The policy is dated 2023-05-17; they say changes are posted on the privacy page, not mailed in advance.
Can they close your account without warning, and can you get your data out first?
They say they will try to email you before they terminate an account; no export step is described there.
If something goes wrong, who pays?
Not stated in the documents.
Do subscriptions renew on their own, and can you get a refund?
Not stated in the documents.
The privacy policy is 4,337 words at a professional or legal expert level (Flesch reading ease 0).
