Privacy
Last updated: 29 October 2026. This page is kept in English only, so the wording stays exact for everyone.
What we collect
When you create an account: your name, your email address, and your password — stored only as a salted hash (a one-way scramble that cannot be turned back into your password, not even by us).
As you use the site: your chosen interface language, and which lesson steps you have completed, when you completed them, and the experience points (XP) each one earned. This is what powers your progress bar, level, streak and achievements.
When you send a course's final project for review: the code you wrote for it, when you sent it, and the reviewer's status and note. A notice with your name, your email address, the course and the code is emailed to the site administrator ([email protected]) so it can be reviewed and answered.
If you publish a site from the Playground (where turned on): the HTML, CSS and JavaScript you wrote for it, and the address you chose. Unlike everything else on this page, this is not private — it is served, as you wrote it, to anyone who visits that address, which is the whole point of publishing it.
If you turn on study reminders: the time zone of your device and the time you chose (so the reminder comes at your time), when you last used the site (so no reminder comes on a day you already visited), which reminders you chose, and — for notifications on a device — the address your browser's push service gave for that device. Reminder emails are sent through Brevo; device notifications go through your browser maker's push service (for example Google, Mozilla or Apple) and contain only the reminder text. Every reminder email has a link to stop them, and you can turn any reminder off on your study routine page.
Trying a lesson without an account
You can try the first lesson of a course without signing up. Nothing about it is sent to us: the lesson you finished is remembered only in your own browser, and is added to your account if you then sign up or log in.
Advertising
TOMPA is free, and it is paid for by advertising served by Google AdSense. Google and its partners (third-party vendors) use cookies and similar technologies to serve ads on this site, including ads based on your previous visits to this and other websites. Google's use of advertising cookies enables it and its partners to serve ads to you based on those visits.
You can opt out of personalised advertising at any time in Google's Ad Settings, and from many other vendors' personalised advertising at www.aboutads.info. To learn how Google uses information from sites that use its services, see How Google uses information from sites or apps that use our services.
If you visit from the European Economic Area, the United Kingdom or Switzerland, you are asked for your consent before advertising cookies are used, through a consent message from a Google-certified consent platform, and you can change your choice at any time with the "Privacy and cookie settings" link at the bottom of the page. Advertisers never receive your name, email address, progress or code from us.
What we do not do
There is no payment information to collect, because the site is free. We do not use third-party analytics, we do not build a marketing profile of you ourselves, and we never sell your account data or share it with anyone outside of running the site.
Cookies and local storage
One cookie of our own (tompa_session) keeps you signed in. It is required for the site to work, expires after 30 days of inactivity, and is not used for advertising. When ads are shown, Google and its partners may set their own advertising cookies, as described above. Your browser's local storage separately keeps a few things only on your own device — your theme, your language choice, unsubmitted lesson drafts and a lesson tried without an account — none of which is sent to us.
Fonts
The site's typefaces are loaded live from Google Fonts. Loading a font this way can expose your IP address and browser details to Google's servers, under Google's own privacy policy; we do not receive that information.
Security logs
Sign-in, registration, project submission and admin attempts are briefly rate-limited in the server's memory to stop abuse; this is never written to the database. Separately, a security log in the database records administrator actions (such as granting admin access, resetting a password or reviewing a project), project submissions, and any rejected attempt to use the administrator key, with a timestamp (and an IP address for key attempts). This log exists only to detect misuse, not to track learners.
To keep the site running well, a short activity log records what happens on it (for example signing in, finishing a lesson, a reminder being sent, or an error), with your name and a few words about it. It is visible only to the site administrator and every entry is deleted automatically after 3 days.
Where it is kept
In the site's own database, on its own server — not with a third-party data broker. The administrator cannot read anyone's password; they can only reset it. Emails are sent through our email provider (Brevo) only to deliver the messages described on this page.
How long we keep it
For as long as your account exists. Deleting your account from the Account page permanently and immediately removes your profile, lesson progress, final projects and any published site from the database; unpublishing a site on its own does the same for just that site.
Children
TOMPA is made for a general audience of learners, and you must be at least 13 to create your own account (see the Terms of Service). Younger learners can use an account that a parent or guardian creates and manages. We do not knowingly collect personal information from a child under 13 without a parent or guardian's involvement; if you believe this has happened, write to us and we will delete it.
Your choices and rights
You can change your name and language, or permanently delete your account and all your data, from the Account page. You can also ask us for a copy of your data or to correct it, and control advertising cookies as described above.
Changes to this policy
This policy may be updated as the site changes. The date at the top of this page shows when it was last revised.
Contact
Questions about your data: [email protected].