Privacy Policy

Effective Date: October 22, 2026Last Updated: October 22, 2026Version: v1.0

Data Protection & Indian Privacy Compliance

This Privacy Policy explains how DEBUG//LAB collects, handles, stores, and safeguards personal data in accordance with the Digital Personal Data Protection Act, 2023 (DPDP Act), the Information Technology Act, 2000, and applicable Indian data protection frameworks. We do not sell your personal data or utilize cross-site commercial ad trackers.

1. Identity, Scope & Operator Information

This policy applies to DEBUG//LAB accessible via https://debuglab.online. The platform is developed, operated, and maintained by its founding engineering team: Utakarsh Singh Thakur, Shreyash Kumar Chaturvedi, Prakhar Dwivedi.

Under the Digital Personal Data Protection Act, 2023 (DPDP Act), DEBUG//LAB acts as the Data Fiduciary determining the purpose and means of personal data processing. Under the Information Technology Act, 2000, DEBUG//LAB operates as an intermediary and body corporate providing cloud computing tools for software development evaluation.

This policy covers all visitors, registered users, and contest participants ("Data Principals" or "Users").

2. Categories of Personal Data Collected

We adhere strictly to the principle of data minimization. We collect only the information necessary to provide, protect, and improve the platform. The categories of data collected include:

A. Account Registration & Authentication Information

When you create an account, we collect your selected username, valid email address, and a securely salted and hashed representation of your password. We never view, log, or store your plaintext password.

B. Single Sign-On (OAuth) Profile Information

If you elect to register or sign in via Google OAuth 2.0 or GitHub OAuth, we receive authorized profile identifiers from the provider, specifically your provider account ID, verified primary email address, public username, and avatar URL.

C. Coding Challenges, Submissions & Evaluation History

When you solve challenges, run test suites, or interact with sandboxes, we record your code modifications, submission diffs, execution durations, automated test pass/fail results, assertion error stack traces, and problem completion records to maintain your progress dashboard and contest rankings.

D. Assessment Integrity & Contest Proctoring Telemetry

Solely in proctored assessment or contest workspaces, client-side browser telemetry records fullscreen transitions and window visibility state changes. This telemetry is strictly used to verify evaluation integrity and fair play.

E. Technical, Session & Storage Data

We use browser localStorage to maintain your active JSON Web Token (JWT) session (auth-storage) and dark/light UI theme preference. We use sessionStorage for cryptographic OAuth state verification to prevent Cross-Site Request Forgery (CSRF). We use Vercel Web Analytics for aggregate, privacy-first web performance diagnostics without third-party tracking cookies.

F. Direct Inquiries & Support Communications

When you contact us at [email protected] for bug reports or assistance, we retain the contents of your message, email address, and diagnostic logs you provide to resolve your inquiry.

Information We Do Not Collect: We do not collect government-issued biometric identifiers, financial instruments, credit/debit card numbers, or physical location GPS coordinates.

3. Purposes of Data Processing

Your personal data is processed solely for legitimate and disclosed purposes:

To provision, authenticate, and administer your DEBUG//LAB user account.
To spin up isolated container runtimes, execute code, run automated tests, and provide real-time terminal output.
To generate contextual AI assistance and debugging suggestions upon your request.
To compute assessment scores, track learning progress, and publish contest leaderboards.
To safeguard platform infrastructure against abuse, denial-of-service, container escapes, and fraudulent activity.
To communicate service updates, email verification links, password reset tokens, and respond to support tickets.
To comply with mandatory information-security obligations under Indian law, including CERT-In directions.

4. Legal Basis, Notice & Consent Framework

Under the Digital Personal Data Protection Act, 2023, our processing of your personal data is grounded on:

Affirmative, Informed Consent (Sections 4 & 6): Obtained during registration via an unselected, mandatory checkbox accompanied by clear notice and links to this Policy and the Terms of Service.
Performance of Contract: Processing necessary to provide the interactive coding and assessment services requested by you.
Legal Compliance: Processing necessary to comply with directions issued under Section 70B of the Information Technology Act, 2000 and applicable Indian laws.

Notice & Phased Commencement Disclosure:

The DPDP Act was enacted by the Parliament of India in August 2023. Operational rules (DPDP Rules) and administrative bodies (including the Data Protection Board of India) are subject to phased notification and commencement schedules by the Central Government. DEBUG//LAB proactively designs its data practices, notice mechanisms, and consent architecture to align with current statutory requirements and upcoming compliance deadlines.

Right to Withdraw Consent: You have the right to withdraw your consent to data processing at any time by contacting [email protected]. Upon withdrawal, we will cease processing your personal data, subject to lawful retention requirements.

5. Third-Party Service Providers & Disclosures

We do not sell, rent, monetize, or trade your personal data. We disclose information only to vetted service providers who assist us in operating the platform under appropriate confidentiality arrangements:

Cloud Hosting & Delivery: Vercel Inc. (provides edge CDN delivery, frontend hosting, and aggregate telemetry).
Container Sandbox Infrastructure: Cloud execution servers running isolated Linux container sandboxes and OpenVSCode Server instances.
Authentication Providers: Google LLC (Google OAuth) and GitHub Inc. (GitHub OAuth) when you explicitly choose to authenticate via those providers.
AI Model Providers: Cloud LLM infrastructure providers used to process your on-demand code queries in the AI Assistant panel. Code context sent is limited to snippets necessary to formulate your answer and is not used for external public model training.
Communications & Email: Google Workspace / Gmail for managing user correspondence and system notifications.
Statutory & Law Enforcement: We may disclose information only if required by a valid court order, warrant, or mandatory directive issued by a competent Indian authority under the IT Act, 2000.

6. Data Retention & Erasure Procedures

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected or to comply with statutory legal requirements:

Active Account Data: Retained for the lifetime of your account to allow you to log in, practice challenges, and view historical scores.
Account Erasure Requests: You may request complete account deletion by emailing [email protected]. Upon verification of your identity, we will permanently erase or anonymize your personal credentials, profile details, and challenge submissions within thirty (30) days.
Security & Audit Logs: Diagnostic and security logs are retained for reasonable operational periods and in compliance with CERT-In directions under Section 70B of the IT Act, after which they are systematically deleted.

7. Technical & Organizational Security

We implement comprehensive technical and organizational safeguards in accordance with Section 43A of the Information Technology Act, 2000 (SPDI Rules) and Section 8(5) of the DPDP Act, 2023:

Encryption in Transit: All HTTP communications between your browser and our servers are encrypted using modern Transport Layer Security (TLS 1.2+ / HTTPS).
Credential Protection: Passwords are cryptographically salted and hashed using industry-standard hashing functions prior to database persistence.
Session Security: Access tokens utilize signed JSON Web Tokens (JWT) with finite lifespans, and OAuth requests use cryptographically random nonce states to prevent replay attacks.
Sandbox Isolation: Code execution occurs within isolated ephemeral containers with strict memory, CPU, and network egress boundaries.

Security Disclaimer: While we implement reasonable and verified security controls, no method of transmission over the internet or cloud storage is completely impregnable. Users are encouraged to maintain strong, unique passwords.

8. Personal Data Breach Response

In the event of a confirmed personal data breach affecting DEBUG//LAB:

We will promptly take remediation steps to contain, isolate, and mitigate the incident.
We will notify the Indian Computer Emergency Response Team (CERT-In) in compliance with directions issued under Section 70B of the IT Act.
We will inform the Data Protection Board of India (DPBI) and affected Data Principals in the form and manner prescribed under Section 8(6) of the DPDP Act, 2023 and the DPDP Rules as they come into force.

9. Data Principal Rights Under Indian Law

Under the Digital Personal Data Protection Act, 2023, you enjoy statutory rights regarding your personal data:

Right to Access (Section 11)

You may request a summary of the personal data being processed about you and details of third-party disclosures.

Correction & Erasure (Section 12)

You have the right to correct inaccurate data, complete incomplete records, or request erasure of your data when no longer needed.

Grievance Redressal (Section 13)

You have the right to access an effective grievance redressal mechanism provided by DEBUG//LAB.

Right to Nominate (Section 14)

You may nominate an individual who shall, in the event of death or incapacity, exercise your data rights.

To exercise any of these statutory rights, please send a written request to [email protected]. We may require reasonable verification of your identity before processing your request.

10. Grievance Redressal Desk & Official Contact

In accordance with Rule 3(2) of the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 and Section 13 of the DPDP Act, 2023, you may address privacy concerns, inquiries, and grievances to our Grievance Desk:

Platform Maintainers & Grievance Desk: DEBUG//LAB Team

Official Email Address: [email protected]

Acknowledgment Timeline: Within 48 hours of receipt.

Resolution Timeline: Within thirty (30) days from the date of receipt.

If you are not satisfied with the resolution provided by DEBUG//LAB, you may also approach the Data Protection Board of India (DPBI) pursuant to Section 13(3) and Section 18 of the DPDP Act, 2023 once the Board's grievance procedure is formally notified.

11. Cross-Border Data Processing

DEBUG//LAB operates using modern global cloud infrastructure (such as Vercel and distributed container execution environments). Consequently, personal data may be stored or processed in servers located outside India. Any cross-border data transfer complies with Section 16 of the DPDP Act, 2023, ensuring that data is not transferred to any foreign country or territory specifically restricted by the Central Government of India.

12. Protection of Children & Minors

Under Section 9 of the DPDP Act, 2023, an individual under 18 years of age is defined as a child. DEBUG//LAB requires that individuals under 18 obtain verifiable parental or guardian consent before using the platform.

We do not undertake tracking, behavioral monitoring, or targeted advertising directed at children, nor do we process children's data in any manner detrimental to their well-being. If a parent or guardian becomes aware that their minor child has registered without requisite consent, please contact us at [email protected] for prompt account deletion.

13. Browser Storage, Cookies & Web Telemetry

DEBUG//LAB uses standard browser storage mechanisms strictly for functional and security purposes:

Storage Item	Type	Purpose
auth-storage	localStorage	Maintains your authenticated session JWT token and user profile object.
theme	localStorage	Remembers your dark or light visual interface preference.
debuglab.consent_record	localStorage	Records your affirmative acceptance of Terms and Privacy versions.
debuglab.oauth_state.*	sessionStorage	Cryptographic CSRF tokens to validate incoming Google/GitHub OAuth redirects.
Vercel Analytics	Cookieless Telemetry	Aggregate performance metrics (page load, errors) without cross-site tracking.

We do not use third-party marketing cookies, tracking pixels, or cross-site advertising networks.