Privacy
Last updated 7 October 2026
This says what we hold about you, why we hold it, and what you can make us do with it. It is written from the database schema rather than from a template, so it describes this product and not a generic one.
Who we are
LeetFoundation is operated from India and is the Data Fiduciary for your information under the Digital Personal Data Protection Act 2023. Where this page says “we”, that is who it means.
Questions, corrections and complaints go to [email protected]. That address is monitored by a person, not a queue.
What we collect, and why
| What | Why we have it | Could we work without it? |
|---|---|---|
| Email address | It is how you sign in, and the only way to reach you about your own account. | No |
| Display name | Shown on the leaderboard and in discussion. | No, but it does not have to be your real name |
| Password (hashed) | Sign-in. Stored as a scrypt hash; we cannot read it. | No |
| Profile picture | Optional. Yours only if you add one. | Yes |
| College, batch year, year of study | Optional. Powers your college leaderboard, and lets your college see cohort progress. | Yes |
| GitHub, LinkedIn, website, X links | Optional. Shown on your public profile because you put them there. | Yes |
| Code you submit, and its result | Running it is the product. The verdict is what your progress is computed from. | No |
| IP address | Attached to a session and to staff actions, for abuse and security investigation. | No |
| Which problems you opened and solved, and when | Your streak, your progress, and the recommendation of what to do next. | No |
We do not collect your phone number, your date of birth, your gender, your address, or anything from your device beyond what a browser sends to any website.
Who else sees it
Your college, if you tell us which one you attend. Staff at that college can see your display name, year, XP, streak and when you last solved something. They cannot see your email address, your code, or anything you wrote. If you turn the leaderboard off in settings, they cannot see you at all.
Other students see whatever your public profile shows: your name, your solved count, and the links you chose to add.
Cloudflare sits in front of the site and sees the same request your browser makes to us, in order to filter abuse. It also counts page views through its own analytics script, which sets no cookies, does not build a profile of you, and cannot follow you to any other website. Our hosting provider (Oracle, in Mumbai) runs the machine the data sits on.
We do not sell your data, we do not share it with advertisers, and we have no arrangement under which anybody pays us for access to it.
How long we keep it
Your account and your progress are kept while your account exists. Submissions follow a published retention rule rather than accumulating forever:
| Kept | For how long |
|---|---|
| Every accepted solution | As long as your account exists. It is your proof you solved it |
| Your five most recent attempts per problem | As long as your account exists |
| Anything less than 30 days old | At least 30 days |
| Other attempts | The code and output are erased after 30 days; the verdict and date remain |
The verdict and date survive because your streak, your profile and your activity map are computed from them. Deleting those rows would silently rewrite your own history.
What you can ask us to do
Under the DPDP Act you have these rights, and here is how each one works today:
| Right | How |
|---|---|
| See what we hold about you | Email [email protected]. We reply within 30 days with an export. |
| Correct something wrong | Most of it you can edit yourself in Settings. For anything you cannot, email us. |
| Delete your account and data | Email [email protected]. We erase your account, profile and submissions within 30 days. |
| Withdraw consent for the optional parts | Clear the field in Settings. College, links and picture are all optional and removable. |
| Complain | Email [email protected] first. If we do not resolve it, you may escalate to the Data Protection Board of India. |
Deletion and export are handled by a person today, not a button. We would rather say that than imply a self-service flow that does not exist. Both are honoured within 30 days of asking.
If you are under 18
The DPDP Act requires verifiable consent from a parent or guardian before a child’s data is processed, and it prohibits targeted advertising to children.
This site is intended for people aged 18 and over. We do not knowingly create accounts for anybody younger, and we do not run targeted advertising at all. If you are under 18, please do not sign up without a parent or guardian doing it with you. If you believe we hold a child’s data, email [email protected] and we will remove it.
Security
Passwords are hashed and cannot be read by us. Staff accounts require a second factor. The site is served over HTTPS only. Backups are encrypted at rest on the host and are tested by restoring them, because an untested backup is not a backup.
No system is perfectly secure. If something goes wrong that affects you, we will tell you what happened and what we did, rather than hoping you do not notice.
Changes
When this page changes materially we will say so on the site rather than quietly updating the date. The current version is dated 7 October 2026.