Privacy policy

Varnook (“we”, “us”, “our”) is operated by Soulstack. We operate Varnook at varnook.com, where you can learn to program in your browser.

Soulstack is the data controller for personal data processed through Varnook. Address for data-protection queries and legal correspondence: Office One, 1 Coldbath Square, Farringdon, London, EC1R 5HL, England. Email: hello@soulstack.co.uk.

You can read the course catalogue and every course's syllabus without signing in and without giving us any details. Your light or dark theme choice is kept in your own browser.

Like any website, our hosting provider records basic request details (your IP address, browser type and the page requested) in server logs, which we use to keep the service secure and working.

• Account details. Your email address, how you sign in (Google, password or an emailed link) and when you signed up and last signed in. If you sign in with Google, the name and profile photo on your Google account. If you set a display name in Settings, that name. We never see your password; Firebase Authentication stores it in a form that cannot be read back.
• Progress. Which exercises you have passed, how many attempts each took, whether you used an AI hint, when you passed it and the last lesson you worked on.
• Your submitted work. When you pass an exercise, the code you submitted and any explanation you wrote for the comprehension check, so you can see them again when you come back to the lesson.
• Usage. How much active time you spend in lessons each week and how many AI hints you have used, to apply your plan's weekly allowances.
• Plan and payments. Once paid plans are available: your plan, its status and the Stripe customer and subscription references that link your account to it. Stripe handles payment, and your card details never reach our servers.

This is stored in Google Cloud Firestore under your own account, and other learners cannot read it. A copy of your progress and usage, and any unsaved code you are working on, is also kept in your browser on the device you use, so the app keeps working if a sync fails. That copy is cleared when you sign out, and unsaved code expires after 30 days.

Code you write runs in your browser, in a sandbox that cannot reach your account. Apart from the submitted work described above, it is sent to us only when you use an AI feature:

• When you ask for an AI hint, we send your current code for that exercise, with any error message and output, to generate the hint.
• When you submit an explanation for a comprehension check, we send what you wrote to check it.

These requests go from our server to Microsoft Azure AI Foundry, which generates the reply. We send the exercise and your text, not your name or email address. Please do not put personal information in your code or explanations.

We use your data only to run Varnook, on these lawful bases under UK GDPR:

• Providing the service (contract): your account, saving progress and work, AI hints and comprehension checks, weekly allowances, and the emails the service needs to send, such as sign-in links and address verification.
• Keeping it secure and working (legitimate interests): telling real visitors from automated abuse at sign-in and on the AI features, server logs, and fixing faults.
• Payments (contract, and legal obligation for financial records): once paid plans are available.

We do not send marketing emails, do not profile you for advertising and do not make decisions about you by automated means that have legal or similarly significant effects.

These providers process data on our behalf to run the service, under their data processing terms, and not for their own purposes except where noted.

• Google Cloud and Firebase: hosting (App Hosting, in the United States), sign-in (Firebase Authentication) and data storage (Cloud Firestore, in a United States multi-region).
• Microsoft Azure AI Foundry: AI hints and comprehension checks. Our Azure resource is in Sweden Central, in the EU, and uses a Global deployment. Per Microsoft's documentation, a Global deployment may process each request in any region where the model is deployed, so a request may be processed outside Sweden and the EU; anything Microsoft stores at rest stays in the EU. Microsoft acts as a data processor under its Products and Services Data Protection Addendum and does not use prompts or replies to train models.
• Google reCAPTCHA Enterprise, through Firebase App Check: checks that requests to sign-in, the database and the AI features come from the real Varnook app. It uses information about your browser and device, under Google's own terms for reCAPTCHA.
• Soulstack Verify: our own bot check on email sign-in, sign-up and sign-in link requests. Your browser solves a small puzzle; the service sees your IP address and browser details while it checks the result.
• Stripe: payments, once paid plans are available.

The code runtimes (Python, SQL and HollowScript) and the fonts are served from varnook.com itself, so no third-party content network sees your visit. There is no advertising and no analytics tracking, and we do not sell learner data. We may review aggregate completion and assistance counts from progress you already save, to improve lessons. Staff and synthetic testing accounts are excluded, and reports require at least five participating learners. Reports do not include your code or explanations.

Your account data is stored in the United States (Google Cloud). AI requests are handled by our Azure resource in Sweden Central; as described above, Microsoft may process an individual request in another region where the model is deployed, while anything it stores at rest stays in the EU.

Where data leaves the UK, we rely on the safeguards in each provider's data processing terms, such as the UK Addendum to the EU Standard Contractual Clauses or the UK Extension to the EU-US Data Privacy Framework.

• Your account and everything stored under it: until you delete your account. Deletion removes your Varnook sign-in and learner profile. A minimal technical deletion record containing your internal account ID and deletion status is retained to stop old or unfinished requests recreating your profile. It contains no learner code, explanations, name or email. If a deletion step fails, Settings explains how to retry.
• AI requests: we do not store your hint requests or the replies. If Microsoft's abuse monitoring flags a request, Microsoft may store it, in the EU, for up to 30 days so that authorised Microsoft staff can review it.
• Server logs: kept by Google Cloud for a short period, normally 30 days.
• Payment records: once paid plans are available, Stripe and we keep the records the law requires for tax and accounting, normally six years, even after an account is deleted.

Under UK GDPR you have the right to:

• Access the personal data we hold about you, and portability: receive it in a structured, machine-readable format.
• Rectification: correct inaccurate data.
• Erasure: have your data deleted.
• Restriction of, and objection to, processing based on our legitimate interests.

You can do some of this yourself. In Settings you can change your display name and delete your account. For a copy of your data, or anything else, email hello@soulstack.co.uk. We will reply within one month.

Varnook sets no advertising or analytics cookies. It uses your browser's storage for things the service needs:

• Keeping you signed in (Firebase Authentication).
• Your theme choice, your progress cache and unsaved code, as described above.
• The security checks above (App Check and reCAPTCHA Enterprise), which may set cookies from Google to tell people from automated traffic.

All of these are needed for the service to work securely, so we do not ask for consent to them.

You need to be 13 or older to create an account. If you are under 18, please check with a parent or guardian first. If you believe a child under 13 has given us personal data, email hello@soulstack.co.uk and we will delete it.

We will update this page when what Varnook does with data changes, and change the date at the top. For a significant change, we will also tell signed-in learners in the app or by email before it takes effect.

If you have a question or a complaint about how we handle your data, email hello@soulstack.co.uk first, and we will do our best to put it right.

You also have the right to complain to the Information Commissioner's Office (ICO), the UK data protection regulator: Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, telephone 0303 123 1113, or online at ico.org.uk/make-a-complaint.