Code24Lab
Menu
Courses Categories Guides Pricing Log in Sign up

Privacy policy

Last updated: November 2026

1. Who is responsible

The controller is the operator named in the imprint, based in Switzerland: Babala Özdemir, Unterer Rainweg 22, 4414 Füllinsdorf, Switzerland, hello@code24lab.com. We process personal data in line with the Swiss Federal Act on Data Protection (FADP) and, where it applies to users in the EU/EEA, the General Data Protection Regulation (GDPR).

2. The short version

  • No tracking, no analytics, no advertising, no third-party scripts, no social-media pixels.
  • We use only cookies needed for functions you use, none for tracking: tl_sid keeps you signed in and protects forms (session); tl_guest keeps a course you bought without a password open in this browser (12 months, set only after such a purchase); tl_cur2 remembers the currency you chose (180 days).
  • We store what is needed to run your account: email, optional name, a hashed password, your lesson progress and your certificates.
  • We store your IP address with your purchase only if you buy as a guest, without a password. For registered accounts we no longer store it, apart from short-lived server logs; a few sign-in records from before 2 November 2026 stay until the account is deleted.
  • Payments are handled by Stripe. We never see or store your card details.

3. Data we process

Account

Email address, password (stored only as a one-way hash), optional name (printed on certificates), date of registration. Legal basis: performance of the contract (Art. 6(1)(b) GDPR).

Buying without a password

The email address you enter on the purchase page is passed to Stripe for the checkout. We store it only after the payment is completed, together with the name given at checkout, in order to set up your access and send your confirmation and access link. To keep the course open for you, we also store your IP address and a one-way hash of your browser identifier and language settings. For 30 days after the purchase these can reopen your course on the same connection and browser if the cookie is missing; the cookie itself is the normal way back. Legal basis: performance of the contract (Art. 6(1)(b) GDPR).

Learning data

Which lessons you completed, which lab tasks you passed or failed (to unlock "Show solution"), exam results and certificates. When you use a lab, the contents of the sheet cells are sent to our server to be checked; they are not stored, only the result (passed / not passed) is recorded for signed-in users. For visitors who are not signed in, nothing is stored except a temporary session counter.

Certificates

A certificate shows your name, the course, the date, your score and a credential ID. Anyone who has the certificate link can view it — that is what makes it verifiable. Certificate pages are marked "noindex" so search engines do not list them.

Payments

Sign in with Google (optional). If you choose “Continue with Google”, Google LLC (USA) / Google Ireland Ltd. confirms your identity and sends us your name, your email address and a Google account ID. We use them only to create and log in to your Code24Lab account; we do not receive your Google password or any other Google data. See policies.google.com/privacy. You can remove Code24Lab’s access at any time in your Google account settings.

Course purchases are processed by Stripe Payments Europe Ltd. (Ireland) and Stripe, Inc. (USA). Stripe receives your email address and your payment details directly. We receive and store the Stripe checkout session ID, the course and the purchase status, and the Stripe customer ID where one is linked to your account. For subscriptions bought before 28 October 2026 we also store the subscription ID, plan, status and renewal date. See stripe.com/privacy. Transfers to the USA are based on the Swiss-U.S. and EU-U.S. Data Privacy Framework and/or standard contractual clauses.

Code24Lab app. In the Android app, courses are bought through Google Play (Google LLC / Google Ireland Ltd.), which processes the payment under its own privacy policy; we never see your payment details. To unlock the course we store the Google Play purchase token, order ID, product and date with your account and check them with Google; Google receives only a random ID derived from your account, not your email. When you sign in, the app gets a login token; we store only a one-way hash of it, the device name you send and when it was last used, and it is deleted when you log out or after 180 days without use. You can delete your account in the app or on the website; this also deletes these records. Purchases stay in your Google Play account.

Reviews (optional)

If you write a review, we store your rating, your text, the name and country you choose to show (both optional), the date and how many lessons you had completed, linked to your account. A review is only published after we have read it; the name and country you entered and the rating and text are then visible to everyone on the website, your email never. You can change or delete your review at any time on code24lab.com/review; it is also deleted with your account. Legal basis: your consent (Art. 6(1)(a) GDPR), which you can withdraw by deleting the review.

Server logs

Our web server logs IP address, date and time, requested page, browser identifier and status code to keep the service secure and to fix errors. Logs are deleted after 14 days. Legal basis: legitimate interest (Art. 6(1)(f) GDPR). IP addresses are also used briefly for rate limiting (protection against password guessing).

Email

We do not send newsletters. We send only service emails, such as password resets, purchase confirmations and links to open a course.

4. Hosting

The website and database are hosted by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, in a data centre in Falkenstein, Germany.

5. How long we keep data

Account, learning and guest purchase-access data are kept as long as your account exists. If you bought without a password and want your data deleted, write to hello@code24lab.com. When you delete your account (Account → Delete account), your account, progress, certificates and guest purchase-access data are deleted immediately; certificate links stop working. Records we must keep for accounting (invoices at Stripe) are retained as required by law (in Switzerland generally 10 years).

6. Your rights

You can request access to, correction or deletion of your data, restriction of processing, data portability, and object to processing. You can delete your account yourself at any time. Contact: hello@code24lab.com. You may also complain to the Swiss Federal Data Protection and Information Commissioner (FDPIC) or, in the EU, to your local supervisory authority.

7. Security

All connections are encrypted (HTTPS). Passwords are hashed. Access to the server is restricted to the operator.

8. Changes

We will update this policy when the service changes. The date at the top shows the current version.