Last reviewed: 2026-07-31. Every course remains readable without an account. Signing in only adds private role-preference and course-progress features.
Data used
- Supabase Auth: the minimum account and session data needed for GitHub OAuth, including the provider identifier and an email when GitHub supplies one. This site does not copy an avatar, public profile, or display name into its application tables.
- Role preference: the authenticated user ID, one optional role-track identifier, and a server-written update time.
- Course progress: the authenticated user ID, stable course ID, “in_progress” or “completed”, and a server-written update time. No row means “not_started”.
The application does not store personal notes, study time, scores, avatars, public nicknames, social relationships, or anonymous-visitor progress. These fields are used only to restore the current user’s private learning state across devices.
Storage and service providers
The static course site is hosted on GitHub Pages. Account, database, and account-deletion processing use Supabase. The browser Supabase client stores its session in this site’s localStorage; signing out or deleting the account removes that local session. Tokens, emails, and progress are not written into static HTML, search indexes, analytics, or build manifests. GitHub and Supabase may separately process operational or security data under their own GitHub Privacy Statement and Supabase Privacy Policy.
Your controls
The account dialog can export progress as JSON, clear the role preference and all course progress, sign out, or permanently delete the account. Account deletion is performed by an authenticated server-side function; the two application tables reference the Auth user with cascading deletion. A repeated request after successful deletion is rejected because the old session is no longer valid.
Availability and email
This project uses Supabase Free and has no paid availability or backup guarantee. A low-activity project can be paused, so sign-in and progress may temporarily fail while public course content remains available. Production setup requires the hosted Auth Email provider to remain disabled, and the production build omits and rejects the magic-link flow until a suitable sending domain and SMTP service exist. Local development tests it only through Mailpit, which does not deliver mail externally.
For a privacy request or problem, open an issue in gaos6e/AI-Agent-Engineer. Do not include tokens, passwords, private email content, or other sensitive data in a public issue.