Skip to content
Updated 2026-10-14

Privacy

This notice explains what Novareka (operated by Mehmet Canker (CoddyKit), the developer of the sister site coddykit.com) collects when you use the website, and why. Questions: coddy@coddykit.com.

Without an account

You can use every free lab without signing up. Your lesson progress is stored only in your own browser (local storage). We do not set advertising or cross-site tracking cookies; analytics cookies are set only if you allow them (see below).

With an account or a purchase

  • Account data: an account identifier and, when you sign in, your email address and (with Google) your name. You can sign in with Google or with a one-time link we e-mail you; both run through Google Firebase Authentication, which sends the link and keeps the sign-in record. We never receive a Google password. While a link is pending, the address you typed is kept in this browser only until you open the link. We never ask for a password. Guest progress in your browser is added to your account when you sign in.
  • Learning data: which lessons and levels you completed, and any scene you choose to share.
  • Subscription status: plan and renewal date, received from RevenueCat. Payments are processed by Paddle.com, our merchant of record, which collects your billing details under its own privacy notice. We never see or store card numbers.
  • Session cookie: one strictly-necessary, httpOnly cookie that keeps you signed in.

Schools and classes

With the Teacher plan, a teacher creates a class and gives students a join code. Students under 13 should join only through their school, using their teacher’s code: the school (or teacher) decides to use Novareka in class and is responsible for any consent its rules require.

  • What a student gives us: only a display name they type when joining (a first name or nickname, up to 40 characters). No e-mail address, account or other details are needed; joining works with the anonymous guest identity in that browser.
  • What the teacher sees: that display name, when the student joined, which lessons in the student and explore labs they finished and when, their learning streak, practice-exam scores and certificates — data the site already records for every learner. “Learning minutes” are estimated from each finished lesson’s listed length; we do not time students. The kids zone is never part of a class.
  • School plan: the person who buys it is the school admin. The admin sees the same information for every class of the school, plus the names teachers type when they join the school. Teachers join a school only with a signed-in account.
  • What the student sees: the class name, the name the teacher chose to show (for example “Ms. Rivera”) and the lessons assigned to the class. Never the teacher’s e-mail address.
  • Teachers and schools must use class data only for teaching that class, and must not ask students to type their full name, e-mail or other personal details as their display name.
  • Leaving and deletion: a student can leave a class at any time on the account page; a teacher can remove a student. Deleting an account deletes the classes it teaches and its class memberships. When a teacher archives a class, students no longer see it.
  • Join-code protection: to stop people guessing codes we count wrong codes per browser identity and per network address for one hour, stored only as one-way hashes and deleted after two hours.
  • Questions about the School plan sent with the short form are e-mailed to our support inbox (coddy@coddykit.com) and used only to answer them.

Product measurement

We count anonymous, aggregate events per day (for example “a lesson in the Orbits lab was completed”). These counters contain no identifiers, no IP address and no cookies. The kids zone sends nothing.

Analytics cookies (only with your permission)

If you choose Allow in the cookie banner, we use Google Analytics for Firebase to understand which pages and labs are used, so we can improve them. It sets first-party cookies (such as _ga) and sends page views, a few product events (for example “a PRO lesson’s plan offer was shown”, “a plan button was clicked”, “a purchase completed”, “signed in” (with only the method, Google or e-mail link), “a sign-up offer was shown, dismissed or clicked”, “a lesson was completed”, “an exam was started”, “the tutor’s daily limit was reached”, with only the lab, lesson, plan and price as details), an approximate location derived from your network address, and device and browser type to Google under the Google Privacy Policy. We do not send your name, email or account identifier, and we do not use it for advertising. If you choose No thanks, nothing is loaded. You can change your choice at any time with “Cookie settings” in the footer. Analytics never runs in the kids zone.

AI tutor (“Why?” helper)

On lesson pages you can ask an AI tutor a question. It is not available in the kids zone.

  • What is sent: our server sends your question, the text of the lesson you are on and, if you answered a quiz on that page, the quiz question and the option you picked, to our AI model provider (OpenAI) to generate the answer. We do not send your name, email, account identifier or IP address. Please don’t type personal information into the question box.
  • What we keep: only a count of how many questions were asked today, so we can apply the daily limit. The count is linked to a random identifier in a strictly-necessary, httpOnly cookie used only by the tutor (or to your account, if you are signed in) and to a one-way hash of your network address. Counts are only used for the current day (UTC); they are kept in our database (Supabase) under a one-way hash — never the raw identifier or network address — and deleted after a few days. We do not store your questions or the answers; our logs record only technical details such as the question’s length and whether the request succeeded.
  • The provider: OpenAI processes the text under the OpenAI Privacy Policy. Content sent through the OpenAI API is not used to train OpenAI’s models by default.
  • AI answers can be wrong. They are not professional advice.

Reporting a mistake

The “Report a mistake” button on lessons, labs and guides sends what you write to our support system so we can read and answer it. With it we send the page address, the lab, lesson or guide you were on, any text you had selected, your browser type, and — only if you type one — your e-mail address, which we use solely to reply. A random key is stored in a first-party cookie (nvr_fb, one year) so we can link your reports together and limit abuse; we keep only a hash of it. The button is never shown in the kids zone.

Processors

Hosting and delivery (Cloudflare), database (Supabase), sign-in and sign-in e-mails (Google Firebase Authentication), subscription status (RevenueCat), payments as merchant of record (Paddle.com), AI tutor answers (OpenAI), and — only if you allow it — website analytics (Google Analytics for Firebase). Each processes data only to provide its part of the service.

Your rights

You can ask for a copy of your data or delete your account at any time by writing to coddy@coddykit.com. Depending on where you live (for example under the GDPR, UK GDPR, CCPA or KVKK) you may also have the right to correct, restrict or object to processing and to complain to your data protection authority.

Children: see the kids privacy notice.