Privacy policy

Who runs BugClub HQ

BugClub HQ is run by me, Josh [FACT: surname]. I teach every cohort, and I'm responsible for everything on this page. The business behind it is [FACT: legal entity name], based in [FACT: city and state].

This policy covers the public site you're reading now and the course itself, where students and parents sign in. When this page says "BugClub HQ", it means both.

When you apply or join the waitlist

The application asks for:

• who's applying: a parent for their kid, or a student for themselves
• your name and email address
• the student's name, if you're a parent, or your parent or guardian's name and email address, if you're a student
• a yes or no that the student is 14 to 17 when the cohort starts
• what the student is curious about and how much coding they've done
• how you heard about BugClub HQ, if you want to say
• that you agreed to the ethics rules, and when

Along with your answers, I save the IP address and browser the application came from. I use those to spot spam and abuse.

I also save a few details about your visit: the website that sent you here, any campaign tags in the link you clicked, and the first page you landed on. Your browser holds these in the tab while you look around and sends them along with the form. They tell me which places bring families to BugClub HQ. I don't use them for anything else.

After you apply, you get a confirmation email. If a student applies, the parent or guardian they name gets a copy. I get an email saying a new application came in, and I keep notes on each application, like how the call went.

If the student isn't 14 to 17, the application doesn't go through and isn't saved.

The waitlist asks for your name and email address. If the student is too young for now, it also asks for the year they turn 14. I save the same IP address, browser and visit details as the application. I use the waitlist to email you when applications open.

Accounts

When a student is accepted, I set up an account for the student and one for their parent or guardian. A second guardian can have their own.

An account holds a name, an email address, a password, a time zone and a display setting. Passwords are stored as a one-way hash, so I can't see them. A parent account also records how you're related to the student, like parent, guardian or grandparent.

Anyone who uses the forums picks a forum name. That's the name other people in the forum see.

What students do in the course

The course is the work students do inside BugClub HQ, so I keep it:

• progress: which readings and labs they've finished, the guesses they make before a lab, the bugs they find in the practice apps and the fixes they check
• write-ups: every version they submit, any screenshots or files they attach, and my feedback on each one
• the notes in their case file
• their private thread with me, about their own write-ups and the week 7 disclosure
• forum posts, including earlier versions of a post they edited. A post they delete is hidden, but the record of it is kept.
• badges and titles
• the ethics agreement and the week 5 opt-in: the typed name of each person who signed, and when
• the week 5 footprint report, if a guardian opted in. Only the student and I see it.

Each student also gets their own copies of the practice apps to work in. Those copies are temporary. They stop when nobody's using them, and they're removed automatically after a set time.

Parents get a two-line update every week, built from what their kid actually did. It's generated from the activity above.

What parents add

• messages you send me from your parent account. Your kid doesn't see them.
• billing: who the billing contact is, and each charge, payment and refund, with the amount, the date, how it was paid and the reason for any refund. Receipts go to the billing contact by email.
• the name of the school or sponsor, if one paid for the seat
• posts in the parents' forum, if you use it
• which emails you've turned off

BugClub HQ doesn't take card or bank details. Once your kid is accepted, I'll send you an invoice. [FACT: payment method]

Live sessions and recordings

Live sessions run on [FACT: live session platform]. Cameras: Cameras are optional. Students join with theirs on or off, whichever they're comfortable with.

Everyone in a session can see and hear whoever has a camera or microphone on. Sessions are recorded for students who miss one, so whoever is on camera or speaks is in the recording. The meeting chat isn't part of the recording.

I post the recording link on the session's page inside BugClub HQ, where only students in that cohort can find it. The recording itself is stored on [FACT: where recordings are hosted]. BugClub HQ can't control who opens that link once someone has it. [FACT: whether a recording link works for anyone who has it, or only for signed-in cohort members]

Sign-in records, activity and error reports

Sign-ins. When someone signs in, BugClub HQ records the time, the IP address and how many times they've signed in. It also notes when they were last active.

Activity. For signed-in students and parents, I record which pages they open inside BugClub HQ and what they do there, like finishing a section, submitting a write-up or sending a message, with the time. On lesson pages, I also keep a running total of how long a student has each section open and in use. Parents and other students don't see that total. I use it to see where students get stuck and to fix problems. It stays in my own database. It isn't sent to an analytics company, and I don't record visits to the public site this way.

Server logs. Like most websites, the server logs each request: the page, the time, the IP address and the browser. When a form is sent, the log can include what was typed in it. Email addresses and passwords are filtered out first.

Error reports. When something breaks, a report goes to my error tracker, which runs on [FACT: where the error tracker is hosted, and confirm it's self-hosted]. A report can include the page, the IP address, the browser and what was being sent when it broke. The tracker also times requests so I can find slow pages.

Cookies and the public site

The public site has no ads, no analytics and no tracking cookies. It doesn't load scripts from other companies, and its fonts come from the same server as the site.

Most public pages set no cookies at all. Pages with a form, like the application and the waitlist, set one session cookie. It holds a security token that stops other sites from sending forms in your name. After you apply, it also remembers your application so the confirmation page can show it. It expires when you close your browser.

The visit details from the application section sit in your browser's session storage, not in a cookie. They stay in your browser unless you send a form, and they're cleared when you close the tab.

Inside BugClub HQ, signing in sets a session cookie that keeps you signed in. There are no other cookies.

Some course videos are hosted on YouTube. The player doesn't load until you press play, and it uses YouTube's privacy-enhanced mode. The preview image does come from YouTube's image server, though, and once a video plays, YouTube gets the same details any website gets from your browser, like your IP address.

Who sees what

Me

I read applications, write-ups and messages, and I review every forum post before it goes up. To fix a problem, I can view BugClub HQ the way a specific student or parent sees it, which means I can see anything in their account, including notes. [FACT: when you use this view, e.g. only to fix a problem someone reported] [FACT: confirm nobody else has instructor access]

Parents

Progress by week, the weekly update, where each write-up stands, what's coming up, badges and titles, whether the ethics agreement is signed, and recent activity like bugs found and write-ups submitted. Parents don't see what's in a write-up or my feedback on it, their kid's notes, the private thread between their kid and me, or the student forum. A parent can ask me about anything in the private thread.

Other students

The forum name a student picks and the posts I've approved in the student forum, plus whoever has a camera or microphone on in a live session. Students can't message each other. In the forum, I see real names. Other students see forum names.

Other parents

Only what you post in the parents' forum. If you turn it on, your posts show "Parent of" with your kid's forum name. Parents only ever see their own kid's progress.

Anyone else

The services in the next section, each for its own job. Beyond that, nobody, unless the law requires it. [FACT: legal disclosure wording from counsel] I don't sell or rent anyone's information, and I don't use it for advertising. [FACT: confirm these commitments]

Services that handle data for me

BugClub HQ runs on a few outside services. Each one gets only what it needs for its job.

• Hosting: [FACT: hosting provider and where the servers are]. This runs the site, the course, the database and uploaded files like write-up screenshots, which sit on the app's own server.
• Lab servers: the servers that run the practice app copies. [FACT: where the lab servers are hosted]
• Email: [FACT: email delivery provider] sends confirmation, account, course and billing emails.
• Error tracking: described above.
• Live sessions: [FACT: live session platform].
• Recordings: [FACT: where recordings are hosted].
• Course videos: YouTube, as described above.
• Payments: [FACT: payment processor, if any].

Each of these services has its own privacy policy. [FACT: whether you have data processing agreements with these services]

Students under 18

Every student is 14 to 17. BugClub HQ isn't for anyone younger, and an application won't go through unless you confirm the student is 14 to 17 when the cohort starts. If a student is too young for now, a parent can join a list to hear when they're old enough.

A parent or guardian is part of every application. If a student applies, the parent or guardian they name gets a copy of the confirmation email. Before week 1, a parent or guardian signs the ethics agreement with the student. The one exception to practice-only targets is week 5, when students look up what's public about themselves, and only with a guardian's opt-in. Without it, they use a sample profile.

Everything on this page covers students' information, and a parent or guardian can use every right below on their kid's behalf. If you think I have information about a child under 14, email me and I'll delete it.

[FACT: whether school-sponsored seats bring in student privacy laws, such as FERPA or state laws like SOPIPA]

Your rights as a parent

You can ask me to:

• show you what I have about you or your kid
• fix something that's wrong
• delete your information or your kid's
• take back the week 5 opt-in, any time before week 5, by messaging me from your parent account
• tell you about anything in your kid's private thread with me
• turn off the forums for your kid

Email hello@bugclubhq.com from the address on your account, so I can tell it's you. I'll answer within [FACT: how fast you answer these requests].

There's no delete button. I delete things by hand. Deleting a student's account ends their access to the course and to their case file, so I'll check with you first. I may need to keep some records, like payments. [FACT: which records you must keep, and for how long]

Some things you can do yourself. In your account settings, you can change your name and time zone and turn off most emails. Billing emails always send.

[FACT: any state privacy rights that apply, and whether students can make these requests themselves]

How long I keep things

• applications that don't lead to a seat: [FACT: retention period]
• waitlist sign-ups: [FACT: retention period]
• accounts and course work after the cohort ends: the case file stays so students keep their work. [FACT: for how long]
• live session recordings: [FACT: retention period]
• billing records: [FACT: retention period]
• activity records: [FACT: retention period]
• server logs and error reports: [FACT: retention period]

The practice app copies are the only thing removed automatically. Everything else on this list I delete by hand when its time is up.

Keeping it safe

The site and the course only load over an encrypted connection. Passwords are stored as one-way hashes. Applications, write-ups and everything else on the instructor side open only for the instructor account.

No system is perfect. If I learn that someone got to information they shouldn't have, I'll tell the families affected. [FACT: breach notice commitment and timing]

Changes to this policy

When I change this policy, I'll update the date at the top. If a change affects how I use information I already have, I'll email parents with accounts before it takes effect. [FACT: confirm this commitment]

How to reach me

Email hello@bugclubhq.com. You can also write to [FACT: mailing address].