Privacy

LexipawsPY is built and run by Neolix Studio in Slovakia. One person builds it and one person operates it. There is no analytics team, no advertising network, and nobody here who wants your data for anything other than showing you your own progress.

This page says exactly what is held, where it is, who else can see it, how long it lasts, and how to take it or have it removed. It was written by reading the running application and listing the files it actually writes, so it describes the thing rather than the intention.

It describes the hosted service. The same application can be installed on your own computer, and an install like that sends nothing anywhere: there is no account, no mail, and no backup off the machine.

What is held about you

Your account

When you register we keep one record: an internal id, your email address, your password as an Argon2id hash, the date you registered, the date you confirmed your address, and — while a verification or password-reset link is live — a one-way digest of that link.

Your password itself is never stored and never written to a log. The digests cannot be turned back into the links they stand for.

The internal id is what names everything else, so your address never becomes a filename and changing it would not disturb your progress.

Your progress

One file, named by that internal id, holding:

• experience earned, and which lessons you have passed;
• how many hints you opened on each lesson, and what that cost;
• which concepts you are holding, and when a drill is next due;
• your streak, the last day you were active, and any banked freezes;
• craft awards you hold and the evidence recorded for each;
• what you wrote for a project step, kept because a project is yours to take away and until you do, this is the only copy;
• your own words, where you have flagged a lesson as unclear. Up to a thousand characters each and the two hundred most recent.

The last two are the ones worth noticing: they are not statistics about you, they are things you typed.

What happened, and when

An activity log, one line per event, kept so that lessons can be improved: a lesson passed, a hint opened, a lesson flagged, experience awarded, a streak moved, an account registered, verified or signed in, and code run.

Each line names you by the internal id and nothing else. It holds no address, no password, no link, not a line of the code you wrote and not a word of what you typed. That is enforced in the code rather than promised here: the module that writes the log refuses a line carrying any of those, and a test reads the bytes on disk to check.

Unsent mail

If the service is ever running without a mail provider configured, verification and reset mail is written to a file on the server instead of being sent. Such a file holds your address and a live link. This is not how the hosted service is meant to run, and these files are deleted along with everything else when you delete your account.

What is not held

• No analytics and no tracking. No analytics provider, no tag manager, no pixel, no fingerprinting, no advertising, and nothing is shared with anybody for marketing. Nothing you do here is measured for the benefit of a third party.
• No cookie banner, because there is nothing to consent to. The service sets two cookies and both are strictly necessary: lexipaws_session, which keeps you signed in and says which account and which password epoch, and lexipaws_csrf — named __Host-lexipaws_csrf over a secure connection — which stops another website submitting forms in your name. Neither is used to track you and neither follows you anywhere. If analytics are ever added, this page changes and you will be asked first.
• No payment data. Nothing is for sale yet. When a subscription exists it will be sold through a merchant of record, which means the payment details go to them and not to us, and this page will say who they are before that happens.
• No IP address of yours is stored by this application. The platform it runs on keeps ordinary web-server request logs, which include IP addresses; see below.

Why it is held

• Your account exists so that you can sign in and so that your progress is yours rather than whoever is at the keyboard.
• Your progress exists so the application can show it to you, unlock what comes next, and schedule your drills.
• Your flagged notes exist so that a confusing lesson gets rewritten. They are read by the owner, in your own words, alongside your address.
• The activity log exists so that questions like "where do people give up" can be answered at all. A file of current state cannot answer them, and they cannot be answered retroactively.

Who else can see it

Three suppliers, each doing one job:

• Railway hosts the application and the disk your progress sits on. Their platform keeps the ordinary request logs of a web server, which include IP addresses, on their own retention. The servers are in the United States — see below.
• Resend sends verification and password-reset mail. They receive your address and the contents of that mail, and keep their own delivery records on their own retention.
• Cloudflare R2 holds the nightly backups described below. What is stored there is encrypted before it leaves our server, so they hold bytes they cannot read.

Nobody else. Nothing is sold, and nothing is handed over except where a law requires it.

Where it is, and the one thing we got wrong

The servers are in the United States, not in Europe. The application and the disk holding every progress file run in Railway's US East region; the second container that runs submitted code is in the same region.

This is written here plainly because it was not what anybody intended. The decision record for the hosting says that Railway's EU West region would satisfy data residency — and it would, but it is not the region this was ever deployed to. Nobody checked the configuration against the intention until this page was written.

So personal data described above, including children's accounts and the words learners typed, is being processed outside the European Economic Area today. What that requires in order to be lawful is one of the questions being put to a professional, alongside whether the right answer is simply to move it, which is what we expect to do. Moving it means moving the disk, which is not a thing to do carelessly while people's progress is on it.

The nightly backups go to Cloudflare R2, encrypted before they leave the server, so what is stored there cannot be read by the storage provider wherever it sits.

How long it lasts

Your account and your progress are kept while your account exists. We do not currently delete inactive accounts; if that changes this page will say so before it happens.

The backups are the part that needs a precise answer. Every night an encrypted copy of the account records and the progress files is sent off site. One object per night, and they age out on a fixed schedule: every one of the last fourteen days is kept, then one per week for up to 120 days, after which it is deleted.

So the longest a backup taken today can exist is 120 days. That number is read directly out of the code that deletes them, so it cannot drift away from what actually happens.

The activity log is not deleted. See below for what that means once your account is gone.

Taking your data with you

Sign in and open Your data from the top of any page. The download is a single JSON file holding your account record, your progress file as it stands on the disk, and every line of the activity log that is about you.

It leaves out your password hash and the digests of any live link. Neither can be turned back into the thing it stands for, and a password hash is useful to nobody except somebody attacking it offline.

Deleting your account

The same page. You will be asked for your password, because this cannot be undone.

What is deleted immediately, in this order:

1. Your progress file — your experience, your notes, what you wrote for a project step — and any salvage or partial copy of it sitting beside it on the disk.
2. Any unsent mail on the server addressed to you.
3. Your account record: your address and your password hash.

Your session stops working as soon as the account record is gone.

The order is deliberate. If the server were interrupted half way through, what is left behind is an account that can sign in with nothing behind it — which you can delete again — rather than your own words sitting in a file that nobody can reach or identify.

What is not deleted, and for how long:

• The backups. A deletion today cannot reach into last night's encrypted archive. Those copies age out on the schedule above, so everything held about you is gone from the backups within 120 days of the night of your deletion, and sooner for most of them. They are encrypted and are only ever opened to restore the service.

• The activity log. The lines about you are kept. They hold no address, no words and no code — only your internal id, a timestamp and what kind of thing happened. Once your account record is gone, nothing links that id to you, and what is left is a count of lessons passed by somebody.

  One honest caveat: for as long as a backup from before your deletion still exists, somebody with access to both that backup and the log could join them back up. After the window above, they cannot.

• Mail already sent. A verification or reset mail already in your inbox is yours, and the delivery record at Resend is theirs.

If you would rather the activity log was purged as well, write and ask; it is a small job done by hand and we would rather do it than argue about it.

Children

Some of the learners here are children, and some accounts are made by a parent for a child.

This section is the one we are least sure of, and we would rather say so than guess. Two questions are open and are being put to a professional: what lawful basis properly covers a child's account on a service like this one, and from what age a child in Slovakia can agree to it themselves rather than a parent agreeing for them. Until that is answered, this page does not state a conclusion.

What is true today: nothing here is advertised to anybody, nothing is profiled, and the only personal data a child's account holds is the list above. If you are a parent and want your child's account exported or deleted, write and it will be done.

Your rights, and asking

You can ask for a copy of what is held about you, for it to be corrected, or for it to be deleted. The first and the last are self-service on the Your data page and take effect at once; anything else, write.

Contact: hello@lexipaws.eu

If you think this has been handled badly you can complain to the Slovak data protection authority, the Úrad na ochranu osobných údajov Slovenskej republiky.

Changes

This page lives in the application's own source code, so every change to it is a dated commit in version control rather than a silent edit. Anything that changes what is collected or who sees it will be said plainly to everybody with an account before it takes effect.

Last changed: 25 October 2026.