The Trust Builder

Privacy Policy

Last Updated: November 2026

Our Commitment

At PythonMastery.io, your code is yours. It runs in your browser, not on our servers, so we can't see it or store it.

Your code never leaves your browser. Pyodide (WebAssembly) runs it on your own device.

1. Information We Do Not Collect

Unlike traditional cloud-based IDEs, PythonMastery.io is a serverless application. We do NOT collect or store:

  • The content of your Python scripts.
  • The output and results of your code execution.
  • Uploaded datasets or created files.
  • Account details. There is no registration or login.

The one exception is the feedback form: if you choose to open it and send us a message, we receive whatever you type into it and the address of the page you sent it from, including the name and email address if you fill those optional fields in. See Section 4. The error finder’s Send this error to us button opens the same form with only the final line of your error filled in, file paths blanked out. Nothing is sent until you press Send.

2. Local Storage & Session Data

We use your browser's Local Storage to save your preferences (theme, editor settings such as the Python version you chose in the editor, and which download site gives you Python fastest), your session state (open files, code history) and your learning progress (which lessons you have opened or finished, and on the Python roadmap, the line you chose and the checklist items you ticked). When you click Explain this error, the error and the code that raised it are kept there for the moment it takes the error finder to open, which reads them and deletes them straight away. This data lives entirely on your device. We have no server-side database that mirrors or replicates it.

In Safari, Firefox and every browser on iPhone and iPad, the site also installs a small service worker (/pm-relay-sw.js) when Python starts. It only passes the answers you type for input(), and the Stop button, from the page to Python on your device. It stores nothing, sends nothing to us or to anyone else, and does not touch any other request. Clearing this site’s data removes it.

This site sets no cookies of its own. When analytics runs, Google Analytics sets its own cookies to recognise a returning visit. See Section 4 for when that happens and how to turn it off.

Data files you upload. If you load a CSV, JSON or other data file into the editor, it is written to storage on your own device, held by your browser, so it is still there when you come back. It is never sent to us or to anyone else. It does not leave your device. It is not a session cookie: it stays after you close the tab, quit the browser or restart the machine, until you remove it. Use the Clear data files button on the data row above the editor to delete every data file from this device at once, or the × on a single file. That button removes your uploaded data files only. It does not touch your code tabs, theme, editor history or lesson progress.

Other ways these files go away. Because they are ordinary site data, anything that clears site data for this site clears them too: Edge’s Clear browsing data with “Cookies and other site data” selected, deleting this site’s data from the padlock menu, or removing the browser profile. They live in one browser on one device, so another browser, another computer or a private window will not see them. A browser may also reclaim the space on its own if it runs low on disk, and if your browser refuses storage altogether the files are held only while the page is open. The data row says which is happening. See working with your own data for how uploaded files are read, listed and removed.

3. Transparency & Sharing

When you use our Share feature, your code is compressed and appended to the URL fragment. Clicking that link restores the state for the recipient. We do not store these shared snippets on our servers. They exist only in the generated link itself.

Embedded code boxes. A website can show one of our runnable Python boxes (see Embed Python). The code is carried in the box’s link in the same way, so we store nothing. The box sets no cookies, runs no analytics, and keeps nothing in the reader’s browser storage. Python is only downloaded, from jsDelivr or npmmirror, when the reader presses Run. What the reader types into the box stays in the box. The website around it cannot read it, and neither can we. If the reader follows the box’s “Open in full editor” link, or a “Run in PythonMastery” README badge, they arrive on this site like any other visitor, under the analytics rules in section 4. Those links are labelled as coming from an embed or a badge.

4. Third-Party Services

To deliver a reliable, high-quality experience, we use the following third-party services:

  • Pyodide / WebAssembly: Runs CPython in your browser at near-native speed. No Python code is sent to any external server.
  • Google Analytics (GA4): Counts page views and visits so we can see how the site is used, with IP anonymisation and no advertising features. It never sees your code. In the EU, Iceland, Liechtenstein, Norway, the UK and Switzerland, where the law asks for your consent first, it runs only if you accept. If you decline, or ignore the question, the script is never loaded. Everywhere else it is on by default, and the controls below turn it off. Which rule applies is decided by our host, Cloudflare, from the country of your connection. Nothing else about you is looked up for it, and if the country can’t be told, you are asked.
  • Google Fonts: Loads the Inter and JetBrains Mono typefaces from Google's CDN. Your IP address is shared with Google as part of this font request.
  • FormSubmit: Delivers the feedback form to our inbox. The message you write, and the name and email address if you supply them, pass through FormSubmit's servers. Nothing is sent unless you press Send Feedback.
  • Weather backdrop (ipapi.co and Open-Meteo): The editor's ambient weather effect needs a rough location. Your IP address is resolved to an approximate city (by our own edge function where available, otherwise by ipapi.co), and those coordinates are sent to Open-Meteo for the current conditions. No precise GPS location is requested and nothing is stored.
  • jsDelivr: Serves the Python runtime (Pyodide), the packages it includes (such as numpy and pandas) and, only when you use them, the charting and code-snapshot libraries. As with any CDN, your IP address is visible to it as part of the download.
  • npmmirror: Keeps an exact copy of the files Python needs to start. Downloads can be slow in some regions, so we added this second copy to serve you better and make Python start faster wherever you are. The first time Python starts, your browser checks which copy answers fastest and downloads Python from that one. It checks again about once a week, and after a download fails. If the copy you used last time is almost as fast, your browser keeps using it, so it does not download Python again. Your browser remembers which copy it uses; the embedded code boxes forget it when you close the page. In the editor, Python 3.11 and 3.12 always come from jsDelivr. npmmirror is a public copy of the npm package library, run by the cnpm project. Like any site you download from, it can see your IP address.
  • How quickly Python starts (sent to Cloudflare, our host): Each time Python starts on a page, or fails to start, your browser sends us a short note about it. The note says which page it was (the editor, a lesson or the notebook), which Python version, which download site the files came from (jsDelivr or npmmirror), how long it took, and whether it worked. It also says whether this was a second try, and whether your browser picked a new download site or used the one from your last visit. Cloudflare adds the country you are visiting from. The note never includes your code, your IP address or anything else that could identify you. We read these notes for one reason only: to find where Python starts slowly, so we can make it faster for you. The small code boxes that other websites embed do not send this note.
  • PyPI: When you install a package in the editor, it asks PyPI (pypi.org) for that package’s details, so it can tell you if the version that arrived is not the current one. A package that Pyodide does not include is also downloaded from PyPI (pypi.org and files.pythonhosted.org). PyPI sees your IP address and the name of the package. Nothing is sent to PyPI unless you install a package.
  • ❤️ Like button (Cloudflare): The like counter runs entirely on Cloudflare's servers. Every page asks it for the current count, so Cloudflare sees your IP address on each visit, as with any server. When you press like, it also records which page you liked. To stop anyone spamming the counter, it is scrambled into a one-way code that can't be turned back into the address, kept for 24 hours, then deleted. Each connection can add up to 20 likes a day, so people sharing a school, college or office network can each still like the site. The button itself lets each browser like once. Your actual IP address is never stored, and none of it reaches our own servers.

Analytics: not decided yet.

Turning it off stops it at once on this page and deletes the cookies it set. Your choice is kept in this browser’s local storage, not in a cookie.

 · 

That is the complete list. The site contacts no other external service. We currently serve no ads at all. When that changes, this section will name the ad network before a single ad loads.

5. Contact Us

Have questions about your privacy or want to collaborate? Reach out to the founder directly:

Contact: use the . It reaches the person who maintains this site.