Who is responsible
the CodeQuest operator operates CodeQuest. The verified business identity and contact details are listed on the Contact and business information page.
Information used
Account details, verification and security records; student profile choices; lessons, answers, code submissions, quiz attempts, generated practice answers, misconception categories, hints, mastery and review dates, progress, XP, Bits, achievements and streaks; classes, assignments and teacher feedback; and timestamps needed to operate and secure the service. Coarse response time may be recorded for a submitted practice activity but is not used to label ability.
Why it is used
Proposed bases are contract or steps requested before a contract for direct accounts; legitimate interests for proportionate security and service operation; and, for school-provisioned use, processing on documented school instructions where CodeQuest acts as processor. These allocations require legal and contracting review before production.
Children
Children receive the same data-protection rights as adults. CodeQuest uses high-privacy student defaults, does not request a full date of birth, does not sell student information, and does not use learning difficulty to target advertising.
Who can see learning information
A student sees their own information. A teacher sees a student only through a class they own after that student joins it. Other students and public visitors do not receive detailed progress. Authorised compliance staff require separate permissions for sensitive case records.
Sharing and transfers
The current application uses its configured hosting, database, email and cache providers, plus jsDelivr to deliver Pyodide in coding activities. Production providers, locations, contracts and transfer safeguards require confirmation in the subprocessor register.
Retention
Retention periods remain proposed and subject to legal and business approval. Unverified accounts, security events and generated export links have technical expiry controls. A legal hold, safeguarding concern or school instruction can pause deletion where justified.
Your rights
You can request access, correction, erasure, restriction, objection or portability, withdraw an optional consent, or ask about automated decisions. A parent or representative does not automatically receive a competent child's information; authority, confidentiality and best interests must be assessed.
Complaints
Use the internal data-protection complaint route first if appropriate. You can also complain to the Information Commissioner's Office. CodeQuest will not ask for sensitive identity evidence by default.
Required information and profiling
Username, email, password and role are required for an account. Learning activity is required to save progress. Recommendations and class analytics are educational profiling with limited effects; they do not make legal or similarly significant automated decisions.