Get early accessJoin

Legal

Privacy Policy

Last updated: November 4, 2026

This policy explains what information Undeprecated collects when you use undeprecated.dev, how we use it, who helps us process it, and the choices you have. Undeprecated is operated by Tech Shepherd LLC ("we", "us"). The short version: we collect what we need to run your practice sessions, we do not show ads, and we do not sell your data.

1. Information we collect

Account information

  • Email address. You sign in with a one-time link we email to you. We store your email address and that it has been verified.
  • GitHub profile (optional). If you choose to sign in with GitHub, GitHub shares your GitHub user ID, name, email address and profile picture URL with us. GitHub access tokens are stored encrypted and are not used after sign-in. We never receive your GitHub password.
  • Preferences. Your time zone, the tracks (languages and frameworks) you choose, and your preferred session length.

Sign-in sessions

When you sign in we create a session record that includes the IP address and browser user agent the sign-in came from, so we can keep your account secure. Sessions expire after 30 days without use, and when you sign out. Sign-in links expire after 10 minutes and are stored only in hashed form.

Practice data

  • The sessions you start and finish, the exercises served, and the answers and code you submit.
  • Scores, grading results and feedback, skill ratings, your review schedule (spaced repetition) and streaks.
  • Timings: how long each answer took, measured on our servers, and the time your browser reports.
  • Integrity signals: counts of blocked paste and drop attempts, unusually large single insertions, keystroke counts (not what you typed, only how many keys), and how many times and for how long you left the practice tab or window. We record these so scores can be trusted. They do not by themselves change your score. If you practice under a team plan, your organization's managers may see these signals alongside scores, according to the visibility settings your organization chooses.

Waitlist and stack requests

If you join the waitlist or request a technology, we store what you enter: your email address, whether you are signing up as an individual or a team, your company (optional), the technology requested and any notes.

Abuse prevention

To stop spam and automated abuse, our public forms and sign-in are protected by Cloudflare Turnstile and by rate limits. For form submissions we store a keyed, salted hash (HMAC-SHA-256 with a secret key) of your network address instead of the address itself, so the stored value cannot be turned back into your IP address. It is used only to limit how often one network can submit.

Payments

When paid plans are available, payments are handled by Stripe. Card details are entered on Stripe's pages and go directly to Stripe; we never see or store your full card number. We give Stripe your email address and an internal account ID to create your customer record, and we store your Stripe customer ID and your subscription's plan, status, billing interval and renewal or cancellation dates.

Technical data

  • Our hosting provider records standard request information (such as IP address, URL, time and user agent) for operating and securing the service. Our own error logs record the method, path, status and timing of failed or slow requests, never request bodies, cookies or query strings.
  • Code you type but have not submitted is saved in your browser's local storage on your device, so a reload does not lose it. It is not sent to us until you submit.

2. Cookies

We use only cookies that are needed for the service to work: a sign-in session cookie (HttpOnly, Secure, SameSite=Lax) and a short-lived cookie that caches your session for a few minutes. Cloudflare Turnstile may use cookies or similar storage to tell people from bots, and Stripe sets its own cookies on its checkout pages. We do not use advertising cookies, tracking pixels or third-party analytics.

3. How we use information

  • To provide the service: sign you in, run and grade your practice sessions, and schedule reviews.
  • To send the emails you ask for, such as sign-in links, and service messages about your account.
  • To keep the service secure and prevent spam, cheating and abuse.
  • To process payments and manage subscriptions, when paid plans are available.
  • To improve exercises using aggregate statistics, such as how often an exercise is answered correctly.
  • To respond to your requests and to meet legal obligations.

We do not sell your personal information, we do not share it for advertising, and we do not show ads. We do not train AI models on your submissions.

4. AI grading

Some answers are graded with the help of an AI model. When you submit Salesforce Apex code for a rubric-graded exercise, the code you submitted is sent, together with the exercise and its grading rubric, to a DeepSeek model hosted on Microsoft Azure AI Foundry, which returns a score and feedback. Your name and email address are not included. Code in other languages is compiled and run against test cases in an isolated sandbox on Cloudflare's infrastructure. To avoid grading identical code twice, we keep a cache of grading results keyed by a one-way hash of the exercise and the code; the cache does not identify who submitted it.

5. Who processes your information

We use these service providers, who process information on our behalf only to provide their services to us:

  • Cloudflare: hosting, database, code-running sandboxes, Turnstile bot protection and sending sign-in email.
  • Microsoft (Azure AI Foundry): hosts the DeepSeek model that grades Apex code submissions.
  • GitHub: only if you choose to sign in with GitHub.
  • Stripe: payment processing and subscription billing, when paid plans are available.
  • Google Fonts: our pages load fonts from Google's servers, so Google receives your IP address and browser details when the fonts load.

We may also disclose information if required by law, to protect the rights, safety or property of our users or others, or as part of a merger, acquisition or sale of assets, in which case this policy will continue to apply to your information.

6. How long we keep information

We keep account and practice data while your account is active. If you ask us to delete your account, we delete your account and practice data within 30 days, except for records we must keep for legal, tax or accounting reasons (such as payment records). Copies in backups are overwritten on their normal schedule. Waitlist entries are kept until you ask us to remove them or the waitlist closes.

7. Your choices and rights

You can ask us to access, correct, export or delete your personal information at any time by emailing privacy@undeprecated.dev from the address on your account. We may need to confirm your identity before acting on a request. Depending on where you live (for example in the European Union, the United Kingdom or California), you may have additional rights, such as objecting to or restricting certain processing, and the right to complain to your local data protection authority. We will not treat you differently for exercising your rights.

8. Security

All traffic is encrypted with HTTPS. Session cookies cannot be read by page scripts, GitHub tokens are encrypted at rest, sign-in links are stored only as hashes, and answer keys never leave our servers. No system is perfectly secure, but we work to protect your information and will notify you of a breach affecting it as required by law.

9. Children

Undeprecated is meant for working software engineers and is not directed to children under 16. We do not knowingly collect personal information from children under 16. If you believe a child has given us information, contact us and we will delete it.

10. Where information is processed

We are based in the United States. Our providers may process information in the United States and in other countries where they operate. By using the service you understand that your information may be processed outside the country where you live.

11. Changes to this policy

We may update this policy as the service changes. We will change the "Last updated" date above and, for material changes, tell signed-in users by email or in the app before the change takes effect.

12. Contact

Questions or requests about privacy: privacy@undeprecated.dev. Tech Shepherd LLC, operator of Undeprecated.