Application Privacy Policy

1. Local-First Usage (No Account Required)

You can browse problems, study solutions, run scratchpad code, and track spaced-repetition progress without signing in. When you use DSA CheatSheet without an account, your progress, custom sheets, preferences, and personal notes are stored locally in your browser using IndexedDB (DsaCheatSheetLocalDB) and localStorage (such as your selected IDE theme).

Python and JavaScript scratchpad execution runs client-side inside a browser Web Worker (including Pyodide loaded from jsDelivr CDN) and is not sent to our backend servers for execution.

2. Account Information (Google & Apple Sign-In)

If you choose to sign in using passwordless social authentication (Continue with Google or Continue with Apple) via AWS Cognito (OAuth 2.0 with PKCE), we request the openid, email, and profile scopes.

• We store your authentication subject identifier (cognitoSub), verified email address, display name (if provided by your identity provider), and account creation timestamp.
• If you sign in with both Google and Apple using the same verified email address, those sign-in methods link to a single DSA CheatSheet account.

3. Cloud Sync, Notes & Collaboration Data

When you are signed in, we store and sync the data needed to provide cross-device persistence and real-time collaboration:

• Progress & Preferences: Problem status, spaced-repetition intervals/review history, custom sheets (soft-deleted sheets are retained in trash for up to 30 days before purge), and editor preferences.
• Documents & Revision History: Your Yjs note documents and saved revision snapshots are stored in PostgreSQL and synchronized over authenticated WebSocket connections.
• Sharing & Collaborator Access: If you generate an invite link, users who accept the invite can view or edit that shared document according to the role you selected (viewer or editor). Your email or display name may be visible to active collaborators on the shared document. You can revoke collaborator access at any time.

4. DSA AI Copilot (AWS Bedrock)

The AI Copilot is available only to signed-in users and is rate-limited by a daily per-user quota and global service cap.

• Ephemeral Client Chat: AI chat messages are stored only in your browser's sessionStorage (dsa-ai-chat-session) and are cleared automatically when you close the browser tab or clear the chat.
• Zero Server Prompt Storage: Our backend stores only a daily per-user query counter in Redis/Valkey to enforce quotas. We do not store or log your AI prompts, code selections, or AI responses in our database.
• Model Inference: Prompts and selected context are sent securely over encrypted transit to AWS Bedrock (Anthropic Claude) to generate responses. AWS Bedrock model invocation logging is disabled so your prompts are not logged to AWS disk or used to train base models.

5. Browser Storage, Third-Party Infrastructure & Tracking

DSA CheatSheet does not sell personal data, display third-party advertisements, or use cross-site advertising trackers. Browser storage (IndexedDB, localStorage, sessionStorage) is used strictly for authentication state, preferences, offline-first editing, and session AI chat continuity.

Cloud infrastructure is hosted on Amazon Web Services (CloudFront, S3, Cognito, ECS, RDS PostgreSQL, ElastiCache/Valkey, and Bedrock), and standard operational infrastructure logs (such as HTTP/TLS access or error telemetry) may be processed temporarily for security, availability, and abuse prevention.

6. Data Retention, Deletion & Contact

You can export your custom sheets in JSON/Markdown, delete custom sheets, revoke document sharing, sign out, or clear local browser storage at any time. To request deletion of your cloud account and associated synced records, please contact support@dsacheatsheet.com.