An educational computer science platform for schools Student & educator login
The Python Group for Educational Narratives

Privacy Policy

Last updated 16 October 2026

The Python Group for Educational Narratives ("PyGPEN", "we") runs PygameOnline at pygpen.org, a website where students learn to program in Python. This policy explains what information we keep, why, and who can see it. Our Data Policy lists every kind of record in detail and how long we keep it.

  • We do not ask for students' names, email addresses, birthdays, phone numbers, addresses or photos.
  • Each account is just a username and a password. We store passwords only as a one-way hash, so nobody, including us, can read them.
  • We have no advertising, no analytics or tracking services, and no "Log in with Google" or other outside sign-in. Every page and program is served from our own server.
  • We never sell, rent or share student information, and we never use it for anything except running the site.
  • Teachers can download or delete a student's data at any time. Accounts nobody has used for 365 days are deleted automatically.

What we keep

  • Account: a username, a hashed password, the date the account was made and the date it was last logged in to. Usernames must not be a real name or an email address, and the site refuses usernames that contain "@".
  • Classes: which classes a student belongs to, and which teacher runs each class.
  • Student work: projects (code, images students upload, a small picture of the running program, titles and descriptions) and card art students draw.
  • Learning progress: typing practice results, debugging exercise attempts, achievements, game scores, saved games, card collections and points (XP).
  • Activity in the games gallery: likes, reports of inappropriate games, and a count of plays.
  • Staff records: a log of actions teachers and staff take on an account (for example a password reset), so the school can see who did what.

We do not store IP addresses, locations, device identifiers or browsing history in our database. Like every web server, ours may write IP addresses to a short-lived technical log used only to keep the site secure and working; that log is not linked to accounts and is deleted within 30 days.

The site cannot stop someone typing personal information into their code, a project description or a report. Students should never put their real name, contact details or photos of people into their work. Games are checked by a moderator before anyone else can see them, and teachers and staff remove anything personal they find.

Cookies

We use only the two cookies the site needs to work, and no advertising or tracking cookies:

  • sessionid keeps you logged in, for up to 14 days or until you log out. Visitors who play a published game without logging in also get one, so a play is counted once a day. We keep only a one-way hash of it, and delete play records after 30 days.
  • csrftoken protects forms from being sent by other websites.

Who can see student information

  • The student sees all of their own work and progress.
  • The student's teacher sees the students in their own classes: their projects (read-only), progress, and when they joined and last logged in. Teachers can reset passwords, reset progress, and download or delete student accounts.
  • Site staff (administrators and moderators) can see accounts to support schools, moderate games and card art, and keep the site safe.
  • Everyone, including the public: when a student chooses to publish a game and a moderator approves it, anyone on the internet can play it and read its code, title, description and the student's username. Approved card art shows the artist's username to other users. Students can unpublish a game at any time.

If another student copies ("remixes") a published game, the copy belongs to them and stays when the original is deleted.

How we use it

Only to run PygameOnline: to let students save and run their work, show progress, let teachers manage their classes, and moderate the gallery. We do not use student information for advertising, profiling, selling, or training artificial intelligence.

Sharing

We do not share student information with anyone, except where the law requires it. Our server is run by a hosting company that stores the data for us and has no right to use it. We will tell schools if this changes.

Schools, parents and children

PygameOnline is meant to be used by schools. When a school or teacher sets up accounts, they do so for an educational purpose, and the school stays in control of its students' records, as the Family Educational Rights and Privacy Act (FERPA) allows. For students under 13, the school gives consent for educational use on the parents' behalf, as the Children's Online Privacy Protection Act (COPPA) allows. Because we don't collect names, contact details or other personal information, there is very little to protect, and we keep it that way on purpose.

Parents and students can ask to see, download, correct or delete a student's data. The quickest way is to ask the teacher, who can do all of this directly. Logged-in students can also download their own data from their account page.

Security

The site is served over an encrypted (HTTPS) connection. Passwords are salted and hashed with PBKDF2-SHA256. Every page checks who is asking before showing any student's work, and every teacher or staff change to an account is recorded. If we ever discover that student information has been exposed, we will tell the affected schools without delay.

Changes

If we change this policy, we will update the date at the top. We will not start collecting new kinds of personal information without telling schools first.

Contact

Questions or requests: ask your teacher, who will pass them to the site administrator.