QueryU
Sign in

Privacy Policy

Last updated: October 2, 2026

Who we are

QueryU ("we," "us," "our") is operated as a sole proprietorship by an individual based in Texas, United States. This policy describes how we collect, use, and protect personal information when you use the QueryU website and SQL practice platform at query-u.com (the "Service").

If you have questions about this policy or your data, contact us at [email protected].

What we collect

We collect only what we need to run the Service:

  • Guest sessions: you can practice without signing up. The first time you run a query, submit an answer, check a lesson step, bookmark a challenge, or save a design, we create an anonymous guest account for you: a random identifier and a session token kept in your browser, with no email, name, or password. It stores the same practice activity and progress described below, so your work survives a reload. Guests are not shown on the leaderboard. If you later sign in with Google, GitHub, or LinkedIn from that guest session, it becomes your member account and keeps its progress. See Data retention for when guest accounts are deleted.
  • Account information: email address, display name, and (if your sign-in provider supplies one) the avatar URL.
  • Authentication data: a session token managed by Supabase Auth, plus the OAuth identifiers returned by Google, GitHub, or LinkedIn when you sign in with those providers.
  • Practice activity: the SQL queries you submit, the grade we computed (pass / partial / fail), execution time, and timestamps. This is what powers your progress page, leaderboard, and badges.
  • Progress and engagement: which challenges you completed, your streak, points earned, and which lessons you finished.
  • Subscription state: if you upgrade to Pro, we store your Stripe customer ID, your subscription status (active, canceled, past due), and the current billing period end date. We do not store credit card numbers or full payment details — those live with Stripe.
  • Feedback: messages you submit through the in-app feedback widget, along with the page you were on, your browser user-agent string, and viewport size (so we can reproduce visual bugs).
  • Analytics: page views and product-usage events (for example, which page a visit started on, whether a practice query passed, whether an account was created), and reports of errors the app runs into (the error message and where in the code it happened), through PostHog, run in cookieless mode. No cookies or browser storage are used for analytics, there is no cross-site tracking, and analytics events are not linked to your account, name, or email.

How we use it

  • To create and maintain your account, authenticate sign-in, and remember your preferences.
  • To grade your SQL submissions and track your progress, streaks, and achievements.
  • To process Pro subscriptions through Stripe and grant access to paid features.
  • To respond to support requests and feedback you submit.
  • To improve the platform — by understanding which pages are popular, which challenges users get stuck on, and what bugs people report.
  • To send transactional emails (billing receipts, account-deletion confirmations). We do not send marketing email.

Service providers we use

We rely on these third parties to operate the Service. Each is bound by their own privacy policies, and we share only what is necessary for them to do their job:

  • Supabase — database, authentication, and realtime infrastructure. Stores your account, progress, and submissions. Hosted in the United States.
  • Stripe — payment processing for Pro subscriptions. We never see or store your card details; Stripe handles them under PCI-DSS.
  • Google — only if you choose to sign in with Google. Google shares your email, name, and profile picture with us.
  • GitHub — only if you choose to sign in with GitHub. GitHub shares your email, name, and avatar URL with us.
  • LinkedIn — only if you choose to sign in with LinkedIn. LinkedIn shares your email, name, and profile picture with us.
  • PostHog — product analytics, used in cookieless mode: visits are recognised by a hash computed on PostHog's servers with a salt that rotates daily, your IP address is used only to compute that hash and is not stored with events, and events are never linked to your account. Hosted in the United States.
  • Netlify — hosts the website and serverless functions (Stripe webhooks, customer portal). May log standard request metadata (IP, user-agent, timestamps) for security and abuse prevention.

Cookies and local storage

We do not use tracking cookies. The Service stores small amounts of data in your browser's localStorage and sessionStorage to make the experience work — your auth session, theme preference (light or dark), whether you've seen the onboarding tour, the position of the feedback widget, and dismissal flags for in-app announcements. Clearing your browser storage will reset these.

How we protect your data

All traffic to and from QueryU is encrypted in transit with HTTPS. Supabase enforces row-level security policies so you can only read and write your own data — never another user's. Stripe handles all card data under industry-standard PCI-DSS compliance. We do not store passwords — sign-in is delegated to Google, GitHub, and LinkedIn, and we only receive the email and name they choose to share.

Your rights

You can access most of your data directly in the app — your email, account info, progress, and submissions are all visible on the relevant pages. You also have the right to:

  • Export your data — email us and we'll send you a JSON dump of everything we have on you.
  • Delete your account and data — use Delete Account on your Account page, which deletes your account, submissions, progress, and subscription record straight away and cancels any active Pro subscription. You can also email us and we'll do it within 30 days; a guest session has no Delete button, so email us or let it expire as described under Data retention.
  • Correct inaccurate data — most fields you can edit yourself; for anything else, email us.
  • Cancel your subscription — through the Stripe Customer Portal, accessible from your Account page.

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) including the right to know what data we have and the right to opt out of any "sale" of personal information (we do not sell or share personal information for advertising). If you are in the European Economic Area or United Kingdom, you have rights under the General Data Protection Regulation (GDPR) including the rights to access, rectify, erase, restrict, and port your data. Texas residents have similar rights under the Texas Data Privacy and Security Act (TDPSA), effective July 2024.

To exercise any of these rights, email [email protected]. We respond within 30 days.

Data retention

We keep your account data for as long as your account is active. If you delete your account from the Account page, your personal data is removed straight away; if you ask by email, within 30 days. A guest account is deleted automatically, with everything it holds, once it is more than 60 days old and has made no submission and completed no lesson step in the last 30 days. A guest that becomes a member account is not deleted this way. Some operational records (billing receipts, audit logs) may be retained longer where required by law. Your submissions, progress, streaks, badges and lesson progress are deleted along with your account; we do not keep an anonymized copy.

Children's privacy

QueryU is intended for users 13 and older. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has signed up, email us and we will delete the account.

International users

QueryU is operated from the United States. By using the Service, you consent to your information being processed in the United States, which may have different data protection laws than your country.

Changes to this policy

We may update this policy from time to time. The "Last updated" date at the top of this page reflects the most recent change. Material changes will be announced in-app or by email if the change affects how we handle your data.

Contact

For any privacy questions or to exercise your rights, email [email protected].