Privacy

The short version

• We keep what the app needs to work: your email, your progress and the prompts you write in lessons.
• Prompts you run go to Anthropic's Claude so it can answer. Nothing else about you goes with them.
• No ads, no analytics, no tracking cookies, no third-party scripts. We don't sell or share your data.
• You can download everything or delete your account at any time in Settings.

If you have an account

• Account: your email, display name, handle, the goals you picked at sign-up, your time zone (to count streak days), the lesson depth you picked (new to this or engineer) and when you joined.
• Progress: lessons you finished and when, neurons earned per exercise, quiz and lesson, your streak, daily activity counts and badges.
• Prompt journal: every prompt you run or submit in a lesson, with the lesson, the temperature, the model, token counts, whether the checks passed, and the time.
• Quick-check answers: each answer you check in a lesson's quick check, with the lesson, whether it was right, and the time. The server grades it; it is never sent to a model.
• Sign-in methods: if you sign in with GitHub or Google, your account id there and the email they report. If you add a passkey, its public key and a name for it. We never see a password: there are none.
• Sessions: each signed-in browser has a session record with a hash of its id, the browser's user agent, and when it started and was last seen. Sessions end after 30 days.

All of this stays until you delete your account. Expired sessions are removed by a daily clean-up.

If you don't have an account

You can take lessons signed out. Your browser then gets the same session cookie, and the session holds your finished lessons, the lesson depth you picked and a random visitor id. Prompts you run are journalled under that visitor id with a hash of your IP address, which is how the hourly limits work. Quick-check answers are kept the same way. A daily clean-up deletes signed-out runs and answers after 7 days. If you sign in, your progress, recent runs and answers move into your account.

Signing in by email

When you ask for a sign-in link we store your email, hashes of the link and code, and a hash of your IP address (to limit how many codes one address can request). They expire after a few minutes and the daily clean-up deletes them an hour later. The email itself is sent through Cloudflare's email service.

Author invites

If an admin invites you to write courses, we store your email, a hash of the invite link, the courses it offers, which admin sent it, and when it was accepted or withdrawn. The invite is sent through Cloudflare's email service and counts towards the same daily email limit as sign-in codes. The record is deleted 30 days after the invite expires (invites last 7 days), accepted or not, or straight away when you delete your account. Bits admins can see the email addresses of authors, admins and anyone with an open invite.

Cookies and your browser

We set one cookie, __Host-session, which keeps you signed in and holds your signed-out progress. It is strictly necessary, so there is no cookie banner. Drafts of prompts you're writing are kept in your browser's local storage and never leave your device until you run them. Fonts and scripts are served from our own site.

Your public profile

Profiles are public by default at /u/your-handle: your name, handle, stats, courses, badges and activity heatmap. Certificates for finished courses are public with it. Your email and your prompt journal are never shown. You can make your profile (and certificates) private in Settings.

Who else handles your data

• Cloudflare hosts Bits: the app (Workers), the database (D1, in the United States), course files (R2), sign-in email and the AI Gateway. Cloudflare keeps short-lived request logs (paths, status codes and errors) that we use to fix bugs.
• Anthropic runs the model. When you press Run, the text of your prompt and a fixed instruction from us go to Claude through Cloudflare's AI Gateway. Your name, email and account are not sent. Anthropic handles that data under its own privacy policy.
• GitHub and Google, only if you choose to sign in with them.

Course authors don't see who took their course or what you wrote.

Taking your data with you, or deleting it

• Export: Settings → Download my data gives you a JSON file with your account, sign-in methods, progress, badges, every prompt in your journal and your quick-check answers.
• Sign out everywhere ends every session at once.
• Delete account removes your account and everything tied to it straight away: sessions, sign-in methods, passkeys, progress, badges, your prompt journal and your quick-check answers. Courses you published stay up but are no longer linked to you. Cloudflare's database keeps point-in-time recovery history for a limited time, after which deleted data is gone from backups too.

Changes

If we change what we collect, we'll update this page and the date at the top before the change ships.