Privacy Policy

From every visitor

• Server logs. The servers that host the site (Vercel for the pages, Railway for the API) record each request: IP address, browser user agent, the address requested and the time. These logs are used to keep the service running and to stop abuse.
• Queries you run. Every SQL statement sent to the Playground is stored with the time, how long it took, the number of rows returned and any error message. If you are not signed in, the stored record is not attached to an account.
• Usage analytics. Google Analytics records pages viewed, approximate location derived from your IP address (country and city level), device and browser type, the page that referred you, how far you scroll, and events such as running a query or opening a challenge.
• Advertising data. Google and its advertising partners collect data through cookies when ads are shown. See section 4.

If you create an account

• Account details. Username, email address and a hashed password (bcrypt; the password itself is never stored), plus the dates you registered, last signed in and were last active.
• Your activity. Query history, saved queries, challenge attempts, lesson and project progress, skill test answers and scores, and points, streaks and badges.
• Analytics link. While you are signed in, analytics events sent to Google Analytics include your internal account ID (a random identifier, not your name or email).

If you bought something in the past

• Nothing is sold on the site now. Earlier purchases (a Premium subscription or an ebook) were handled by Razorpay. We never saw or stored card, UPI or bank details. For those purchases we hold the Razorpay payment and order IDs, the product, the amount and currency, the email address given at checkout, and the date.

What we do not collect: your real name (unless you choose it as your username), phone number, postal address, precise location, or any government ID.

• Your username and points appear on the public leaderboard.
• A skill test result page and its certificate show your username and score to anyone who has the link.
• Your email address, queries and saved queries are not shown to other users.

Choose a username you are comfortable seeing in public.

• To sign you in and keep your account
• To save your queries, history and progress, and to mark challenges and tests
• To sort out problems with a past purchase
• To find and fix bugs, and to protect the site from abuse (for example rate limiting)
• To understand which lessons and features are used, so the site can be improved
• To show advertising, which helps pay for the site

We do not send marketing email or newsletters. We only email you in reply to a message you send us.

SQLab Hub uses Google AdSense to display ads. This means:

• Third-party vendors, including Google, use cookies to serve ads based on your prior visits to this website or other websites.
• Google's use of advertising cookies enables it and its partners to serve ads to you based on your visit to this site and/or other sites on the Internet.
• You may opt out of personalised advertising by visiting Google Ads Settings.
• You can opt out of other third-party vendors' use of cookies for personalised advertising at www.aboutads.info or, in Europe, youronlinechoices.eu.

Google explains what it collects and how it uses it in How Google uses information from sites or apps that use our services, and lists its advertising partners in its ad technology providers list.

Europe, the UK and Switzerland. If you visit from the European Economic Area, the United Kingdom or Switzerland, Google shows personalised ads only where you have given consent through a Google-certified consent message. Without consent you may see non-personalised ads, which still use cookies or similar identifiers to limit how often an ad is shown and to prevent fraud.

We do not pass your username, email address or any other account detail to Google's advertising services.

• Sign-in cookie (sqlab_token): set only when you sign in, lasts 7 days, and cannot be read by scripts. It is required to stay signed in.
• Analytics cookies (names starting _ga): set by Google Analytics to tell visitors apart. IP addresses are anonymised. You can block them with the Google Analytics opt-out add-on.
• Advertising cookies: set by Google and its partners when ads are served, as described in section 4.
• Browser storage: the site keeps a few preferences in your browser's local and session storage, such as editor font size, lesson progress when you are not signed in, and a random ID for the current browser tab. This stays on your device.

You can delete or block cookies in your browser settings. The site still works without analytics and advertising cookies; signing in needs the sign-in cookie.

Data is shared only with the services needed to run the site:

• Vercel (United States) hosts the website.
• Railway (United States) hosts the API and the database that holds accounts and activity.
• Google provides Analytics, AdSense and the web fonts. Loading the fonts sends your IP address to Google.
• Razorpay (India) processed past payments and handles any refund or cancellation of them.

These companies process data in the countries where they operate, which may be outside your own. We do not sell personal data, and we do not give it to anyone else unless the law requires it.

• Account details and activity are kept for as long as the account exists.
• Query records and payment records are kept until deletion is requested, except payment records that tax or accounting law requires us to keep.
• Hosting logs are kept by Vercel and Railway for the periods those providers set.
• Google Analytics data is kept for the retention period configured in Google Analytics.

There is no self-service delete button yet. To have your account and everything attached to it deleted, email support@sqlabhub.com from the address on the account. Deletion is carried out within 30 days.

Wherever you live, you can ask us to:

• tell you what personal data we hold about you and send you a copy
• correct your email address or username
• delete your account and its data

Email support@sqlabhub.com and you will get an answer within 30 days. If you are in the EEA or the UK you also have the right to complain to your data protection authority. If you are in India you have the rights given by the Digital Personal Data Protection Act, 2023.

Where the law asks for a legal basis: account data is processed to provide the service you signed up for; logs and abuse prevention rest on our legitimate interest in keeping the site secure; analytics and personalised advertising rest on consent where the law requires consent.

• All pages and API calls use HTTPS.
• Passwords are stored only as bcrypt hashes.
• The queries you run execute in an isolated sandbox on generated sample data. They cannot reach the database that holds accounts.

No website is perfectly secure. If you find a vulnerability, please report it to support@sqlabhub.com.

SQLab Hub is a general-audience learning site and is not directed at children under 13. You must be at least 13 to create an account. We do not knowingly collect personal data from children under 13; if you believe a child has registered, email support@sqlabhub.com and the account will be deleted.

When this policy changes, the “Last updated” date at the top changes with it.

Rahul Kumar, SQLab Hub
support@sqlabhub.com

See also the Terms, the Refund Policy and About.