Privacy policy
Last updated
VimNinja is a Vim course that works without an account. This policy says what we store when you use it, why, for how long, who else handles it, and what you can do about it. It describes what the service actually does today. The terms of use cover everything else.
- No account needed: without one, your progress never leaves your browser.
- No ads, no tracking cookies.
- We never see your card details, and we never sell your data.
- Export or delete everything from your account page, any time.
Who we are
VimNinja (vimninja.com) is run by Jai Pandya, sole proprietor of Mutables, in India ("we", "us"), who decides how and why your personal data is used: the data controller (data fiduciary, in India's terms). For anything about your data, including questions, requests and grievances, write to support@vimninja.com; Jai Pandya is the contact for grievances and replies within one month.
Without an account
Everything stays in your browser's local storage: your settings, progress, review schedule, golf scores, finished runs waiting to sync, an unsent feedback draft, and a log of the last errors the site hit on this browser (keys starting with vn:). Nothing of it is sent to us unless you sign in or send a bug report. Clearing your browser's site data removes it.
Like any website, ours receives your IP address and browser details with every request. Cloudflare, which hosts the site, uses them to deliver pages and to protect the service; we use your IP address to rate-limit forms and sign-in against abuse. To show a price, we use the country Cloudflare infers from your connection; it isn't stored.
With an account
- Account: your email address and sign-in sessions (each with the IP address and browser it was created from); with Google sign-in, also the name and profile picture Google shares and your Google account ID; with a password, a hash of it (never the password itself).
- Learning data: lesson progress, the keys you pressed in finished exercises (so the server can check the result), practice rounds, your review schedule and XP per command, golf scores and solutions, and the days you were active.
- Profile: the leaderboard name and GitHub username you choose (both optional), and whether you opted out of leaderboards.
- Purchases: your order (item, amount, currency, date, status, and the payment provider's reference for it). Payment, card details, billing address and tax are handled by Lemon Squeezy and never reach us.
Feedback
When you send feedback, we store the message, its kind, the page you sent it from and, if you're signed in, your account. A bug report also carries this browser's errors from the last day (error messages and the pages they happened on), so we can find the problem.
Accounts from the previous VimNinja
If you had an account on the earlier version of VimNinja, we moved over your email address, name, profile picture, the link to your Google account (so the same Google sign-in finds you), when you signed up and whether you had bought Pro. Progress in the old exercises was not moved: the course is new. You can delete the account from your account page like any other.
Why we use it
- To run the service you asked for (your account, syncing progress, Pro, leaderboards you take part in): because it's needed to provide the service under our terms.
- To sell and honour Pro: to fulfil the purchase, and because tax and accounting law require records of it (kept by Lemon Squeezy, the merchant of record).
- To keep the service secure and working (rate limits, spam checks on feedback, fixing bugs you report): our legitimate interest in a service that works and isn't abused.
- To publish statistics about how people learn Vim (for example, which commands take the most keystrokes over par, or which ones people learn last): only as totals and averages across many accounts, never anything that identifies you, and only from signed-in accounts' learning data. Our legitimate interest in improving the course and sharing what we learn.
- To email you about the service (see Email below): our legitimate interest in telling users about the product they use. You can unsubscribe from announcements at any time.
We don't use your data for advertising, sell it, or make automated decisions about you that have legal or similarly significant effects.
How long we keep it
- Your account and its data: until you delete the account. Deleting it deletes everything stored with it: profile, progress, scores, sessions, orders and imported data from the previous VimNinja.
- Finished exercises and practice rounds (the keys you pressed): deleted after 180 days. Your progress, review schedule and XP, which are worked out from them, stay.
- Sign-in sessions: a session expires 30 days after you last used it; signing out ends it sooner.
- Feedback: as long as it's useful for improving VimNinja. If you delete your account, it's kept without the link to you.
- Purchases: Lemon Squeezy keeps its own record of an order for as long as tax law requires, even after you delete your account.
- Backups: the database's backups, kept to recover from accidents, roll off within 30 days.
Who processes your data
- Cloudflare hosts the site, stores account data, keeps short-lived request logs and runs the rate limits. If we switch on Cloudflare Turnstile for the feedback form, it also checks there that you're human.
- Lemon Squeezy runs checkout as the merchant of record: payments, receipts, invoices and sales tax. It has its own privacy policy for the data it collects at checkout.
- Google signs you in when you choose "Continue with Google".
These companies may process data outside your country, including in the United States. Where the law requires it, such transfers rely on safeguards like the European Commission's standard contractual clauses or the EU–US Data Privacy Framework.
What's public
Only golf leaderboards: your chosen display name (or "anonymous"), your optional GitHub username, your score and time. Your solutions are shown only to players who have solved the same hole. Your email is never shown.
We may also publish aggregate statistics (see "Why we use it"): numbers across many learners, with no names, emails, solutions or anything else that points to one person.
Cookies and tracking
Signing in sets cookies that keep you signed in: a session cookie, and a short-lived signed copy of it so pages don't have to look the session up every time. They're strictly necessary and only exist while you're signed in. Cloudflare may set a strictly necessary security cookie when it needs to tell people from bots.
There are no advertising or third-party tracking cookies. The site's code has a hook for counting a few product events (a lesson finished, a hole solved), but today it only keeps them in the open page's memory: nothing is stored, sent anywhere or tied to you, and it sets no cookies.
Your rights
Depending on where you live, you have the right to:
- access the data we hold about you, and take it with you: your account page exports everything stored with your account as a JSON file;
- correct it: change your leaderboard name on your account page, or ask us to fix anything else;
- delete it: delete the account from your account page, which deletes all of its data;
- object to or ask us to restrict how we use it, and unsubscribe from announcements;
- complain to a data protection authority: in India, the Data Protection Board of India; elsewhere, the supervisory authority where you live. We'd appreciate the chance to sort it out first.
For anything the account page doesn't do, write to support@vimninja.com. We may need to confirm it's your account, and we'll answer within one month.
Children
VimNinja isn't directed at children under 13, or under 16 in the European Union and the UK, and we don't knowingly collect their data. Without an account, nothing is collected anyway. If you think a child has made an account, write to us and we'll delete it.
Security
The site is served only over HTTPS. Passwords are stored as salted hashes, sign-in cookies can't be read by scripts, and only we can reach the database. Payment details never touch our servers. No system is perfectly secure; if something goes wrong that affects your data, we'll tell you and the authorities as the law requires.
We email you about your account and the service: receipts (sent by Lemon Squeezy when you buy Pro), messages your account needs, and occasional announcements about VimNinja itself, such as moving to the new version. Announcements are sent through an email delivery service that handles your address only to send them. Every announcement has an unsubscribe link. We don't send marketing for anyone else or sell your address.
The browser extension
The VimNinja extension collects nothing and sends nothing: it makes no network requests at all. Your progress, settings and reminder times stay in the extension's own storage on your computer, apart from the website's, and uninstalling it removes them. Reminders are worked out on your computer from that progress. It asks to show notifications only when you choose a reminder, and never reads your tabs or the pages you visit.
Changes to this policy
When what we do with data changes, this page changes with it, with a new date at the top. If a change matters to you, such as a new kind of data or a new company handling it, we'll tell you by email or on the site before it applies.
Contact
Questions, requests or worries about your data: support@vimninja.com.