Privacy
Privacy policy
Last updated September 25, 2026
Codiva is a coding workspace for classrooms. We built it to collect as little as possible, especially about students. This page explains what we collect, where it’s stored, how long we keep it, and how to delete it.
Student privacy at a glance
- What we collect
- A name and username (chosen by the teacher, or by the student when they join with a class code), a password the student chooses (stored only as a secure hash), the class they belong to, the projects they save, and any feedback comments on those projects. We don’t ask students for an email address, phone number, birthday, photo or location.
- Where it’s stored
- In a database hosted by Supabase in Canada (Montréal). The website itself is hosted by Vercel.
- How long we keep it
- Until it’s deleted. Sign-in sessions end after 7 days, and setup codes and class codes expire after 7 days.
- How to delete it
- Students can delete any of their projects in the editor. Teachers can delete a student’s account, with all of their projects, from the class roster.
No ads. No selling or sharing data for marketing. No tracking or analytics cookies.
Who we are
Codiva (“we”, “us”) runs the website at codiva.lol.
Information we collect
Teachers and classroom admins
- Your name and username.
- Your password, stored only as a one-way bcrypt hash that we can’t read.
- Recovery codes for teacher accounts, stored only as one-way hashes.
- The classes you create, their class codes, and the student and admin accounts you add.
- Assignments you create, including instructions and starter code, and comments you leave on student projects.
- If you subscribe to the Teacher plan: your Stripe customer and subscription ids and your subscription’s status. Stripe collects your card details and billing email. We never see or store your card number.
Students
- A name and username. The teacher enters them, or the student chooses them when joining with a class code. A first name or nickname works fine.
- Their password, stored only as a one-way bcrypt hash.
- Which class they belong to, and whether their account is active, awaiting setup or disabled.
- The projects they save: project names, file names and code, and whether an assignment has been turned in.
- Comments their teacher leaves on their projects, and their replies.
Text typed into the editor’s Input tab and the output of a program stay in the browser. They aren’t sent to us.
Technical information
- A cookie that keeps you signed in (see Cookies).
- To slow down password and class code guessing, we keep a one-way hash of the IP address and username with a count of recent attempts, for about 15 minutes.
- Our hosting provider keeps standard server logs, such as IP address, time and page requested, for security and troubleshooting.
Who can see student projects
On the Free plan, a student’s projects are private to them, even from their teacher. If their teacher has the Teacher plan, the teacher and that teacher’s classroom admins can also open the student’s projects and leave comments. Other students can never see them.
How we use information
Only to run Codiva: to sign you in, save projects, let teachers manage their classes, and keep the service secure. We don’t sell personal information, use it for advertising, build profiles of students, or use student work to train AI models.
To run the service and manage plans, the person who runs Codiva can see each teacher’s name, username, sign-up date, plan, and how many classes and students they have. That view doesn’t show student names or code.
Where your code runs
When someone presses Run, their code runs inside their own browser in an isolated sandbox that can’t read Codiva’s sign-in cookie. Code is sent to our servers only when a signed-in user’s project is saved.
To run Python, the browser downloads the Python runtime from the jsDelivr content network when the editor opens. Like any website, jsDelivr receives the browser’s IP address when it does this.
Service providers
- Supabase hosts our database in Canada (Montréal).
- Vercel hosts and delivers the website. Vercel may process requests in the United States and other countries.
- jsDelivr delivers the Python runtime to the browser.
- Stripe processes Teacher plan payments. It receives only what’s needed to bill a teacher, never student information, and may process data in the United States and other countries.
We don’t share personal information with anyone else unless the law requires it.
How long we keep information
- Accounts, classes and projects: until they’re deleted.
- Sign-in sessions: 7 days, or until you sign out.
- Setup codes: they work once and expire after 7 days.
- Class codes: they close after 7 days, or sooner if the teacher turns them off.
- Sign-in attempt records: about 15 minutes.
- Billing records: kept by Stripe and us for as long as tax and accounting rules require.
- Server logs: kept by our hosting provider for a limited time.
When something is deleted, it’s removed from our live database straight away. Copies may remain in our providers’ backups for a short time before they’re overwritten.
Deleting information
- Students can delete any project from its project menu in the editor.
- Teachers can delete a student’s account and all of their projects from the class roster: open the student’s access menu and choose Delete student. Disabling an account instead keeps the student’s projects. Deleting a student also deletes the comments on their projects.
Children and schools
Codiva is designed for students working under a teacher’s supervision. Students can’t sign up on their own. A teacher either creates the account or shows the class a class code, and every student account belongs to that teacher’s class. We use student information only to provide Codiva to their teacher and school.
If you’re a teacher, please make sure your school or district approves using Codiva, and that any notice or consent your school requires is in place before you add students. Parents and guardians with questions about a student’s information can ask the student’s teacher.
Security
Passwords, recovery codes, setup codes and session tokens are stored only as one-way hashes. Class codes are meant to be shown to a class, so they’re stored as they are, and they stop working after 7 days. The site uses HTTPS, and our database requires encrypted, verified connections. Student code runs in a sandbox that can’t read Codiva’s sign-in cookie. No system is perfectly secure, but if we learn of a breach that affects your information, we’ll let affected teachers know.
Changes to this policy
When this policy changes, we’ll update the date at the top. If a change is significant, we’ll also post a notice on this site.