Summary
The website and documentation have no accounts, no advertising and no third-party analytics. The playground sends the code you submit to our server to compile and run it in a sandboxed container, and optional sign-in stores only your lesson progress -- never your source. The registry stores the package metadata that makes distribution possible, and email we receive is kept so we can answer it.
What we collect
- Server logs. Like most web servers, ours record the requested URL, timestamp, IP address and user agent for security and operations. Logs are kept for a short period and are not used to profile visitors.
- Email. If you write to support@xiom-lang.org, we keep the correspondence so we can respond and follow up.
- Browser storage. The documentation theme remembers your light/dark preference in your own browser (local storage). Guest playground progress and export/import files also stay in your browser. None of this is transmitted to us.
Registry data
The registry is a package index: package names, versions, digests, signatures, publication times and yank state are public by design, because clients must verify them. Publishing requires a publisher token; any account or contact details used to issue and manage tokens are processed only to operate publishing, and are not sold or used for marketing. See the registry documentation for how artifacts and metadata are stored.
Playground
When you check, format, compile or run code in the playground, the source you submit is sent to our server and processed there. Programs are compiled and executed in a sandboxed container: non-root, read-only root filesystem, no network egress, capabilities dropped, and a temporary filesystem for work. Work directories are created per request and deleted immediately. The toolchain's script cache may hold a compiled binary and a source copy in the container's ephemeral temporary storage until the container restarts; nothing is written to persistent disk. The WebAssembly preview runs in your browser, but the checks and executions you request run on the server.
Playground accounts (optional)
The playground is fully usable without an account; guest progress and export/import stay in your browser. If you sign in with GitHub, we store one JSON progress document per account on the playground server: completed lesson ids, run timestamps with pass/fail and duration, and truncated program output capped at 400 characters. No source code is stored. The document lives on a Docker volume on the playground server and is not currently part of the off-site backup set; the "Delete account data" action removes it from the live server. Signing in uses an HttpOnly session cookie with a 30-day lifetime; signing out clears it.
Third parties
Source code, issues and releases live on GitHub, which has its own privacy policy. Signing in to the playground uses GitHub OAuth: GitHub receives the authorization grant, and the access token is discarded by the playground after fetching your public profile (id, username, avatar). The services are hosted on our own infrastructure in the EU. No analytics, advertising or social-tracking scripts are embedded in the website or documentation.
Cookies
The website and documentation do not set cookies; the documentation theme preference is stored in your browser. The playground sets a single HttpOnly session cookie, and only if you choose to sign in for progress tracking.
Retention and your choices
Server logs are short-lived. You can ask us to delete email correspondence and any account details held for registry publishing by writing to the address below; published package metadata is immutable by design and can only be yanked, not erased, because clients depend on it.
Changes
This policy may change as the project grows; the date at the top shows the current version.
Contact
Privacy questions: support@xiom-lang.org.