Last updated October 3, 2026
Privacy Policy
Hatch is a free Python course. We collect only what we need to run your account and save your progress. We do not run ads, we do not track you across other sites and we never sell your data.
1. Who we are
Hatch (the website at hatch.staraep.fun and the Hatch iPhone and iPad app) is run by an independent developer operating as StarAEP, who is the “controller” of your personal data. You can reach us about anything in this policy at info@staraep.fun.
2. The short version
- You need an account to use Hatch. We keep your email address, a display name, your progress and a few security details.
- You must be 13 or older. If you are 13 to 15, a parent or guardian has to approve your account.
- There is no advertising, no analytics, no tracking pixels and no third-party trackers.
- We never sell or rent your data, and we do not share it for advertising.
- You can delete your account and everything we hold about it at any time, inside the app (Profile, then Delete account).
3. What we collect and why
| Data | Why we need it | Notes |
|---|---|---|
| Email address | To create your account, sign you in, send your verification and password-reset codes, and answer your requests. | If you use Sign in with Apple and choose to hide your email, we only receive Apple's private relay address. |
| Password | To sign you in. | Never stored in readable form. We keep a salted, slow one-way hash (PBKDF2-SHA256). We also check new passwords against a breached-password list (see section 5). |
| Username | A public handle so friends can find you and send you a request. | Chosen by you, unique, and visible to other learners in your age group. Please do not use your real name. Names that are offensive are refused, and you can change it once a week. |
| Display name | To show on your profile and, if you take part, the weekly leaderboard and your friends’ lists. | Optional. Other learners can see it, so please use a nickname rather than your full name. Offensive names are not accepted. |
| Friends, requests and blocks | To let you follow friends’ weekly XP and to stop people you block from finding you. | Who is your friend, pending requests, and who you blocked. Only you can see your blocked list. Friends see your username, display name, avatar and weekly XP. |
| Apple user identifier | To recognise you when you use Sign in with Apple. | An opaque ID from Apple, plus an encrypted token so that we can tell Apple when you delete your account. |
| Age group | To keep Hatch to people aged 13 and over, and to ask a parent to approve 13 to 15 year olds. | You enter your birth month and year once. We use them to work out an age group (13 to 15, or 16 and over) and do not store the date itself. If you are under 13, nothing is stored. |
| Parent or guardian email (13 to 15 only) | To send them an approval code. | Used only for that. Deleted from our records as soon as they approve, or when the unapproved account is deleted after 14 days. |
| Your learning progress | To save lessons, XP, streaks, quests, mastery, achievements, items you unlocked, and the code you typed in lessons, and to sync them between your devices. | Stored on your device and in your account. Also used to rank the weekly leaderboard, using only your weekly XP, display name and avatar. |
| Preferences | Theme, motion and editor settings. | Stored on your device and synced with your progress. |
| Devices and sessions | To keep you signed in and let you sign out other devices. | A random session token (stored hashed), when it was last used and the browser or device description your device sends. |
| Security data | To protect your account. | If you turn on two-factor authentication: an encrypted authenticator secret and hashed recovery codes. We also store a record of failed sign-ins so we can slow down password guessing. |
| IP address | To limit abuse such as password guessing and mass sign-ups. | Failed-attempt counters keyed by IP address are deleted after 24 hours. Our web server logs keep IP addresses with the last part removed for up to 14 days. |
| Terms acceptance | To prove which Terms you agreed to, and when. | Version number and date. |
We do not collect your precise location, contacts, photos, microphone, camera, advertising identifier or payment details. Hatch has no purchases.
4. Our legal bases (EEA and UK)
If the GDPR or UK GDPR applies to you, we process your data because:
- it is necessary to provide the service you asked for, including your account, sign-in and progress sync (contract);
- it is in our legitimate interest to keep Hatch secure and prevent abuse, and we have limited that use to what is necessary (legitimate interests);
- a parent or guardian approves the account of a person aged 13 to 15 (consent); you can withdraw consent at any time by deleting the account or writing to us;
- the law requires it, for example responding to a valid legal request (legal obligation).
5. Who we share data with
We use a small number of service providers who handle data for us and may only use it to provide their service:
| Provider | What it does | What it receives |
|---|---|---|
| Hostinger | Hosts the Hatch servers and database. | All account and progress data, stored on our server. |
| Resend | Sends our emails (verification, password reset, parent approval). | The recipient email address and the text of the email. |
| Apple | Sign in with Apple, if you choose it. Apple also distributes the iPhone and iPad app. | What you authorise in the Apple sign-in sheet. Apple's own privacy policy applies to its services. |
| Have I Been Pwned | Checks whether a new password appears in known data breaches. | Only the first 5 characters of a one-way hash of the password. Never the password, and never your email. |
| Cloudflare | Provides DNS (the address book that points hatch.staraep.fun to our server). | Standard DNS lookups; your Hatch traffic does not pass through Cloudflare. |
We do not sell or rent personal data, and we do not “share” it for cross-context behavioural advertising (as those terms are defined in California law). We may disclose information if the law requires it, to protect someone’s safety, or to defend our rights. If Hatch is ever transferred to someone else, this policy and your rights would continue to apply to your data.
6. Children and teens
- Hatch is for people aged 13 and over. If someone enters a birth month and year that makes them under 13, we do not create an account or keep what they entered.
- People aged 13 to 15 need a parent or guardian to approve the account. We email the parent a code, and the account stays locked, with no cloud features, until the code is entered. Accounts that are never approved are deleted after 14 days.
- Parents and guardians can ask us to see, correct or delete a teen’s data, or to stop collecting it, by writing to info@staraep.fun. We may ask a few questions to confirm who you are.
- If we learn that we hold an account for someone under 13, we delete it.
7. What other learners can see
The weekly leaderboard shows other learners in your league your display name, avatar and that week’s XP. It never shows your email address or your age. Choose a nickname if you do not want to be recognised.
Friends work by request: nobody becomes your friend unless you both agree. You can only find, and be found by, people in the same age group (13 to 15, or 16 and over), by exact username. There is no public search or list of users, and Hatch has no chat or messages. A friend sees your username, display name, avatar and this week’s and lifetime XP. You can remove a friend or block someone at any time. A blocked person cannot find you, send you requests or see you on leaderboards. To report a name that breaks the rules, email info@staraep.fun.
8. How long we keep data
| Data | Kept for |
|---|---|
| Account, progress and the last 3 progress backups | Until you delete your account. Deleting removes them from our database and storage. |
| Friends, requests and blocks | Until you remove them or delete your account. Deleting your account removes you from everyone else’s lists as well. |
| Accounts whose email was never verified | 30 days, then deleted automatically. |
| Teen accounts a parent never approved | 14 days, then deleted automatically. |
| Emailed codes | 15 minutes (parent approval codes: 3 days), then unusable and cleared. |
| Sign-in sessions | 90 days from sign-in, or until you sign out or delete the account. |
| Failed-attempt counters (with IP address) | 24 hours. |
| Web server logs (IP address shortened) | Up to 14 days. |
| Emails at Resend | Resend keeps delivery logs for a limited time under its own policy. |
| Data on your own device | Until you sign out and clear it, or delete the app. |
9. Security
Traffic to Hatch is encrypted (HTTPS). Passwords are hashed, authenticator secrets and Apple tokens are encrypted, emailed codes are stored hashed, repeated failed sign-ins are slowed down, and you can turn on two-factor authentication. No system is perfectly secure. If a breach affects your data we will tell you and the authorities as the law requires.
10. Your rights
Wherever you live, you can ask us to:
- tell you what we hold about you, and give you a copy in a common format (your progress: Settings, then Export my progress; everything else: email us);
- correct data that is wrong (your display name you can change yourself in Profile);
- delete your data (do it yourself under Profile, then Delete account, or write to us);
- restrict or stop certain processing, or object to it;
- withdraw consent you gave us, without affecting what happened before.
California and other US states. You have the right to know, access, correct and delete your personal information, and to opt out of its sale or sharing. We do not sell or share personal information, so there is nothing to opt out of, and we do not use or disclose sensitive personal information for anything beyond running the service. We will not treat you differently for using your rights.
EEA, UK and elsewhere. You also have the right to data portability and to complain to your local data protection authority.
To use a right, email info@staraep.fun from the address on your account. We will reply within 30 days. We may need to confirm it is really you before sharing or deleting anything. You can also save a copy of your progress yourself with Export my progress under Settings, then Your data. That file covers learning progress only; for your account details, email us.
11. Where data is processed
Our servers and providers may be in countries other than yours, including the United States. Where the law requires safeguards for international transfers, we rely on our providers’ standard contractual clauses or equivalent protections.
12. Do Not Track and Global Privacy Control
We do not track you across websites or build advertising profiles, so there is nothing for a Do Not Track or Global Privacy Control signal to switch off. We honour them anyway by not changing anything about how we handle your data.
13. Cookies and local storage
Hatch does not use cookies. It stores your progress and sign-in on your own device. See our Cookies and local storage notice for the full list.
14. Changes to this policy
When we change this policy in a way that matters, we will update the date at the top and, if the change is significant, tell you in the app or by email before it takes effect.
15. Contact
Questions, requests or complaints: info@staraep.fun. See also our Terms of Service.