About this policy
s4.codes is a software learning site run by Asfar Ali, trading as s4.codes. This policy describes the information the site handles when you browse, create an account, use learning or community features, buy a course, or contact us.
s4.codes is not meant for children under 13 and does not knowingly collect their information. If you believe a child under 13 has created an account, email hello@s4.codes and the account will be deleted.
The policy covers the information handled by the site and the services that support its features. Provider notices linked below explain how those providers handle information under their own policies.
Information we handle
When you sign in with GitHub or an email link, Firebase Authentication processes the sign-in and the site receives account details made available by the provider, including an account identifier, email address, display name and avatar. You may add a professional role or company name to your profile. Your profile also stores your two email preferences.
Firestore stores account records, course enrollments and purchase references, lesson progress and resume positions, and signed-in playback events. A completed paid purchase record includes the course, payment reference, amount, currency, the version of the Terms in force at purchase, and detected pricing country and tier when available.
Community records include article likes, course ratings and reviews, and article comments. Reviews and comments may include your display name, avatar and the profile details you chose to provide. Reviews and comments are publicly visible on the relevant course or article unless hidden by moderation; article pages show like totals, while your liked articles are listed in your account.
A contact form submission includes your name, email address, enquiry category and message, which are written to the site's inbox. To limit how often sign-in emails and contact messages can be sent, the site counts requests by IP address and, for sign-in, by email address. These counts are stored only under one-way hashes and are deleted automatically, usually within a day after the limit period ends.
How information is used
The site uses account information to sign you in, maintain your profile and preferences, provide course access, save progress, keep purchase and refund records, display community contributions, moderate content, and respond to contact or support requests.
When you view or buy a course, the server reads a country code supplied in the hosting request headers, so that course prices can be set by region. Prices are currently the same everywhere. The country and pricing tier may be saved with a completed purchase. This is a country-level signal, not device GPS data.
Service providers
Firebase Authentication and Cloud Firestore provide sign-in and account data storage. Firebase's documentation says Authentication may process IP addresses and user-agent information for authentication, account management, security and abuse prevention.
Paddle.com is the online reseller and Merchant of Record for course orders. It provides the checkout, takes the payment, handles sales tax and invoices, and sends its own receipt email. Paddle's checkout script is loaded from Paddle only when you start a purchase. Paddle receives the information needed to complete a transaction, which may include contact, billing and payment details, and handles it under its own privacy policy. The site receives verified transaction details needed to record a purchase and provide course access.
Mux hosts and streams course videos. Paid lessons use signed playback URLs. Mux may process playback request information such as IP address, browser or device details and coarse location inferred from the request.
Resend delivers email sign-in links, welcome messages, purchase receipts, contact notifications and replies, and course or article announcements. To send these messages, it receives recipient addresses and message content.
Vercel hosts the application and provides Web Analytics and Speed Insights. Those products measure site visits and performance. Their provider notices describe their own data practices in more detail.
Video and site measurement
Mux handles video hosting and playback delivery. The application does not use the Mux Data analytics SDK. Separately, when a signed-in learner plays a lesson, the player sends play, pause, seek, playback-rate and session events to the site's API. Those events are stored in Firestore with the learner account, course, video and playback position for course engagement reporting.
Vercel Web Analytics measures page views and may report information such as referrer, browser and coarse location. The site also sends custom events to Vercel Analytics. Current events include contact-dialog opens, successful contact submissions with the selected enquiry category, and notify-dialog opens with the selected course when available. These event properties do not include the name, email address or message typed into the contact form. Vercel Speed Insights measures page performance, including Web Vitals.
Email preferences
The account stores two separate email settings. Course-launch and marketing announcements are enabled by default and can be switched off. New-article announcements are off by default and require an opt-in. Sign-in links, welcome messages and purchase receipts are service emails and are not controlled by those two settings.
You can change the settings in account preferences. Announcement emails also include a category-specific unsubscribe link. Changing an email preference does not change course access.
Retention and requests
The current implementation does not publish fixed retention periods for account, course, purchase, community or contact records. Playback-event records expire after 180 days. Automatic cleanup is enabled for expired playback-event and temporary rate-limit records. Deletion is not immediate, so expired records may remain until cleanup runs.
To request access to, correction of, or deletion of information held by the site, email hello@s4.codes. There is no self-service account-deletion control. Requests are completed within 30 days; some transaction, refund, security or other records may need to remain where required or permitted.
The service providers listed above may also hold information under their own privacy practices. Their linked notices explain how to contact them about information they process independently.