Privacy policy
Effective 15 November 2026
The short version: we collect only what WidgetVerse needs to keep your account and progress, we don't use analytics or advertising, we don't sell your data, and the code you write runs on your own computer.
Who we are
WidgetVerse is made by Zyntoka, operated by Clark Joy Pesco, Philippines ("we", "us"). We are responsible for the personal data described here. Contact us at support@zyntoka.com.
This policy covers the WidgetVerse app, its account server at api.zyntoka.com, and this website.
What we collect
Your account
- Username, email address, and password. Your password is stored only as a secure one-way hash; we can never see it.
- A sign-in for each device you use, with a name like "WidgetVerse on Windows" and when it was last used. Sign-ins expire after 90 days, or when you sign out.
Your progress
When you're signed in, your hero is synced to your account so it's safe and available on your other computers: your hero's name and avatar, the experience level you chose, XP, level, streaks, completed lessons, challenges, worlds, bosses, and projects with their scores and dates, achievements, daily quests, and accepted projects.
Messages to the AI mentor
When you ask the mentor something, your message is sent through our server to Anthropic, which generates the reply. To tailor its help, the message includes context about your learning: your level, rank, chosen experience level, current world, and how many lessons you've completed; the challenge and code you're asking about, if any; and, unless you turn it off in Settings › Privacy, your recent mistakes and weak areas. Your username and email are never sent to the mentor. Our server does not store mentor conversations. They are kept on your device.
Technical information
Like any web service, our server and Cloudflare (which protects it) receive your IP address and basic request details. We use them to keep the service secure and to limit abuse, for example by limiting repeated sign-in attempts. Server logs are kept for up to 14 days.
What stays on your device
Your unfinished code, challenge attempts, settings, and mentor conversations stay on your computer. Code you run in the Coding Arena runs on your own computer with your Flutter SDK and isn't sent to us. You can see everything the app stores on your device in Settings › Privacy, and copy it with Copy my data.
What we don't do
No analytics, no advertising, no tracking across apps or websites, and we never sell your data. This website uses no cookies and loads nothing from other companies.
Why we use it
| Purpose | Data | Legal basis |
|---|---|---|
| Creating your account and signing you in | Account, sign-ins | Providing the service you asked for (contract) |
| Saving and syncing your progress | Progress | Contract |
| Answering your mentor questions | Mentor messages and learning context | Contract |
| Password reset emails | Email address | Contract |
| Security and preventing abuse | IP address, request details | Our legitimate interest in a safe service |
Who processes it for us
We use a small number of service providers, each only for the job below and under their own data protection terms:
| Provider | What they do |
|---|---|
| Hostinger | Hosts our server and its database (Kuala Lumpur, Malaysia) |
| Cloudflare | Protects and routes traffic to our server and this website, and stores our encrypted backups |
| Brevo | Sends password reset emails |
| Anthropic | Generates the AI mentor's replies |
Your account and progress are stored on our server in Malaysia, and some of these providers process data in other countries, including the United States. Where the law requires it, these transfers are covered by appropriate safeguards, such as contractual commitments to protect your data.
How long we keep it
- Account and progress: until you delete your account.
- Sign-ins: until you sign out, or 90 days.
- Server logs: up to 14 days.
- Backups: encrypted database backups are kept for up to 30 days, so deleted data disappears from them within 30 days.
Your choices and rights
You can ask us to access, correct, export, or delete your personal data, or object to how we use it. To delete your account, open Settings › Account › Delete account in WidgetVerse and confirm with your password. It immediately deletes your account, its synced progress, and its sign-ins on every device from our server, and erases your hero from that computer. If you can't sign in, email support@zyntoka.com from the address on your account and we'll delete it within 30 days. Uninstalling the app, or deleting your hero in Settings › Account, removes the data stored on your computer.
If you're unhappy with how we handle your data, please tell us first. You can also complain to a data protection authority: in the Philippines, the National Privacy Commission, or the authority where you live.
Security
All connections use HTTPS. Passwords are hashed, your sign-in on your computer is encrypted so only your Windows user account can read it, and backups are encrypted before they leave the server.
Children
WidgetVerse is not directed at children under 13, and we don't knowingly collect their personal data. If you believe a child under 13 has created an account, contact us and we'll delete it.
Changes
If we change this policy, we'll update it here and change the effective date. For significant changes, we'll let you know in the app or by email.