Privacy

Who is responsible

bybecode is made by UNIDIOR, the data controller under Mexico’s Federal Law on the Protection of Personal Data Held by Private Parties. For anything on this page, write to privacidad@unidior.com or contacto@unidior.com.

Your bybecode account is separate from your UNIDIOR one: they are two different services and they do not share progress data.

Your progress: on your phone and, if you have an account, on our server too

The lessons you finish, your XP, your uptime, the challenges you solve and your settings are stored in a database inside the app itself. You do not need an account to use it, and without an account none of that leaves the device.

If you create an account, that progress is copied to our server so it is not lost when you change phones. It is a record of learning — which lesson you finished, which challenge you solved and on what day — and nothing you cannot see in your own profile.

If you delete the app, what it stored on the phone goes with it. What is in your account is deleted when you delete the account.

The code you write runs on your phone

The editor and the engine that runs your code live inside the app, sandboxed and with no access to the network: the security policy for that part forbids any outgoing connection. Python and the SQL engine ship inside the app, so running your code downloads nothing either.

Your code is not sent to a server to be graded: it runs on your device and the result is compared right there. It only leaves your phone if you ask Nube for help, as explained below.

bybecode in the browser

The app also runs in the browser, at bybecode.com/app. It does the same things as the phone app and everything on this page applies to it; what changes is where things are stored.

Your browser keeps, in its storage for this site, your progress, your settings, the code you left half-written in a challenge, the hints you already asked for and your conversation with Nube. It also keeps a copy of the app itself and of Python, so it opens faster next time. Without an account, none of that leaves the browser.

Those are not cookies, and they do not travel to any server on their own. They are deleted when you clear the site data from your browser settings, and in a private window they are gone when you close it. If you have an account, your progress is also in it, as on the phone.

Your code runs in your browser, in a sandboxed part of the page that cannot see your session or connect to the internet.

The session cookie

bybecode sets a single cookie, and only when you sign in to your account from the browser: the one that keeps your session open so you do not have to type your password every time.

It lasts 60 days at most and is renewed while you keep using the app. No script on the page can read it, it only travels over an encrypted connection and only to our server; another website cannot get it sent. It is deleted when you sign out.

It is needed for the account to work, so it does not ask for permission. It is not used for advertising or to follow you around other sites. Without an account, bybecode sets no cookie at all. The ones Stripe uses when you pay are explained under “Payments”.

Nube, the AI tutor

Nube can give you a hint or answer you in a chat. To do that it uses an artificial intelligence model from DeepSeek, an outside provider.

Only when you ask for a hint or write in the chat, the exercise, your code, what it printed and your messages are sent to our server, and from there to DeepSeek. The app tells you so at that moment. If you do not ask for help, nothing is sent.

We do not keep your code or the conversation: the conversation stays on your phone. We only count how many hints you used this week, to apply the limit. DeepSeek handles what it receives under its own privacy policy.

You need an account to use Nube, because the hint limit is per person. Your name, email and username are not sent to DeepSeek.

Measurement: what is measured, and why

The app uses Firebase Analytics (from Google) to know how many people install it and how they move through the course. That includes an installation identifier generated by the SDK itself, the device model, the language, the app version and usage events such as opening the app or finishing a lesson.

This is for two things: improving the course by seeing where people get stuck, and knowing which ads bring students, so the advertising budget is not spent blind.

There are no ads inside the app.

The tracking prompt on iPhone

On iOS, the app asks whether you allow tracking. That permission controls exactly one thing: whether Apple’s advertising identifier (IDFA) can be used to attribute your install to an ad.

Whatever you choose, the app works the same and no lesson changes. If you say no, the IDFA is not used. You can change your mind at any time in the iOS settings.

On Android the equivalent identifier is Google’s advertising ID (GAID), managed from the system settings.

Accounts

An account is optional. You can create one with your email and a password, or sign in with Google or Apple.

With an account we store your email, the name you want us to call you, your username (@something) and, if you sign in with Google or Apple, the identifier they give us to recognise you. Your password is stored encrypted: nobody can read it.

Your email is used to sign in and to reset your password. We do not send you marketing.

You can delete your account from the app, in Settings → Delete your account, or as explained on the account deletion page of this site.

Certificates

From the Junior rank on, you can request a certificate for every rank you earn in a language. It is only issued when you ask for it, and before it is issued you choose the name that goes on it.

Each certificate has an ID and a public page at bybecode.com/c/ so anyone can check it is genuine. That page shows your name, the rank, the language and the date you earned it, so anyone who has the ID can see them: you decide who you share it with. The ID cannot be guessed and the page is not listed in search engines.

We keep the name you chose and the details of each certificate for as long as your account exists. If you delete your account, your certificates lose your name and their page only says they are no longer valid.

Payments

The full plan is paid for once; it is not a subscription. In the phone app the charge is made by the App Store or Google Play, and your card details are handled by the store.

On bybecode.com the payment is processed by Stripe. You type your card details into a Stripe form and they go straight to Stripe: we never see or store them. Stripe also receives your email, the amount and technical data about your browser that it uses to prevent fraud, and for that it sets its own cookies while you pay. The receipt is emailed to you by Stripe.

RevenueCat keeps track of what you bought, in a store or on the web, so the plan shows up on all your devices. It receives an identifier for your account and, if you buy on the web, your email.

We store the fact that your account has the plan, from when until when, and where you bought it.

Who the data is shared with

With Google (Firebase Analytics and Google Ads, and sign-in if you use Google), with Apple (when you use its store, its attribution system or sign in with Apple), with DeepSeek (only what you send when you ask Nube for help), with Stripe (if you pay on bybecode.com) and with RevenueCat (if you buy the full plan, anywhere). Each of them handles the data under its own policy.

Data is not sold to anyone, and it is not shared with advertisers beyond what is described here.

How long it is kept

Your account data and the progress copied to it are kept until you delete the account, and then they are actually deleted, not deactivated.

Measurement data is kept for as long as you keep using the app, plus any additional period required by legal and tax obligations; after that it is deleted or aggregated so that it no longer identifies anyone. What is on your phone or in your browser is yours to keep: it lasts until you delete the app or clear the site data.

The record of your purchases is kept for as long as Mexican tax law requires, even if you delete the account.

Your rights

You can ask for access to your data, for it to be corrected, cancelled or deleted, object to it being processed, and withdraw your consent. Write to privacidad@unidior.com with your name, a way to reach you and what you are asking for; we answer within 20 working days at the latest.

If you are not satisfied, you can take it to INAI, the Mexican data protection authority.

Children

bybecode is for people aged 13 and over, on the phone and in the browser: it is the same age we declare on the App Store and on Google Play.

We do not knowingly collect data from children under 13. If we find data from a child under 13, we delete it as soon as we have verified it. If you are between 13 and 17, you need your guardian’s supervision and consent, and purchases are made by that person.

Changes to this page

If something important changes, the date above is updated and the app tells you before the change takes effect.