Privacy
What Heyrian records, and why.
Policy version 2026-10. Not published yet: the date it takes effect is still open.
Who runs this site
Heyrian is run by TODO(owner): the legal entity’s name and address. Questions about this policy, and requests about your data, go to TODO(owner): a contact address.
This one policy covers Heyrian (heyrian.dev) and Primerian (primerian.dev). They are separate sites on separate domains, each with its own cookies and its own choices: allowing analytics on one doesn’t allow it on the other.
What is recorded without asking
To keep the site working, two things are recorded for every visitor, with nothing that identifies you and nothing stored on your device:
- Anonymous page views: the page’s address (without anything after a
?or#), the site you came from (its name only), your country, whether your screen is narrow, medium or wide, and the hour. No id, no cookie, no IP address, nothing that ties one page view to another. - Anonymous errors: what went wrong and where, your browser and operating system (name and major version only), whether you were signed in (yes or no), and the minute. To explain an error, it also carries the last few things that happened on that page, such as “button Run clicked”, kept in memory for that page only. Email addresses and anything that looks like a password or token are removed by our server before it is passed on, and again before it is stored.
TODO(owner): SPEC.md §13.1, confirm that anonymous page views and errors before consent (no cookie, no storage, no IP, times rounded) need no consent in the EU, UK and Switzerland, and that the in-page history on anonymous errors is acceptable.
Signing in is needed for some features, so a signed-in reader may be shown a feature that’s being tried out, chosen by their account rather than by a cookie. Nothing records which version you saw unless you allow analytics. TODO(owner): SPEC.md §13.1, confirm this is acceptable without analytics consent.
What is recorded with your permission
With analytics on, Heyrian also records how the site is used, tied to a random id:
- pages viewed, how long a page stayed open and how far you scrolled, and how fast pages loaded;
- your browser’s language, its light or dark theme, and your screen size;
- which version of a feature being tried out you saw;
- a short list of named events: a lesson started, a section of it reached, a lab run or traced (the language and how the run ended), an exercise submitted (right or not), a search (where, and how many results, never what you typed), the link in a site notice followed, and on Heyrian the upgrade page viewed;
- if you’re signed in, your account, so your visits on different devices count as one reader.
Never recorded: what you type into forms or the search box, the code you write, your IP address, or the full details of your browser. Clicks are recorded as the button’s or link’s label only.
Where you are decides the default
- The EU, the EEA, the UK and Switzerland: analytics is off until you choose “Accept” in the banner. “Reject” is just as easy, and the site works the same either way.
- Everywhere else, including the US: analytics is on unless you turn it off with “Your privacy choices” at the bottom of every page. TODO(owner): SPEC.md §13.1, confirm that renewing a refusal after 12 months, rather than letting it lapse, is the right reading of the US state laws.
- If we can’t tell where you are, we treat you as being in the EU: analytics is off until you accept.
- Global Privacy Control and Do Not Track are honoured everywhere: if your browser sends either, analytics stays off and you aren’t asked.
Your country is worked out from the request by our host, and your IP address is not kept. You’re asked again after 12 months, or sooner if this policy’s analytics change (a new policy version, shared by both sites, which each site asks about separately).
Cookies and storage
Heyrian sets only its own cookies, on heyrian.dev. There is no advertising, and no other company’s tracking.
| Cookie | Kind | What it’s for | How long it lasts |
|---|---|---|---|
| rian_session | Necessary | Keeps you signed in. Set when you sign in, removed when you sign out. | TODO(owner): the session’s lifetime |
| rian_consent | Necessary | Remembers your analytics choice, the policy version you made it under and when you made it. | 13 months from your choice, not extended |
| rian_notices | Necessary | Remembers which site notices you closed, so they stay closed. Holds only the notices’ ids, nothing about you. | 13 months from the last notice you closed |
| rian_vid | Analytics | A random id for this browser, so visits can be counted as one visitor. Only set with analytics on. | 13 months from when it was set, not extended. Deleted at once if you turn analytics off |
| rian_sid | Analytics | A random id for one visit, so pages read together count as one session. | 30 minutes after your last activity. Deleted at once if you turn analytics off |
With analytics on, the list of feature versions already reported is kept in this tab’s session storage, so each is reported once. Your reading language, your lab code drafts and, on Primerian, your theme are kept in this browser’s local storage for you, and are not sent to us unless you run the code.
How long things are kept
| What | Kept for |
|---|---|
| Analytics events (pages read, time on page, speed measurements, lesson and lab events), with their random ids | 13 months |
| Daily totals, with no ids in them | No limit: they identify no one |
| Error reports | 90 days |
| Grouped error records (a count and dates per problem, no ids) | Until deleted. TODO(owner): SPEC.md §13.4, should these be deletable, or kept for good? |
| Records of analytics choices made with the banner or the choices panel | 25 months (as long as the choice applies, plus 13 months) |
| Audit log of account and administrative actions | 2 years |
| Your account (email address, name, picture from GitHub or Google) and your progress | Until you delete your account. TODO(owner): confirm, and how deletion is requested |
If you delete your account, your account is removed from the analytics events and error reports it was on. What remains is no longer tied to you.
Who helps run the site
- Vercel hosts the site and tells it which country a request comes from.
- Amazon Web Services hosts the API, the database these records are kept in, and the engine that runs code from the labs (in the United States, us-east-1).
- GitHub and Google, if you sign in with them.
TODO(owner): the legal basis for each kind of processing (consent for analytics; legitimate interests for anonymous counts and errors?), the transfer safeguards for visitors outside the US (Data Privacy Framework or standard contractual clauses), Vercel’s region, whether code run in the labs is logged and for how long, and the minimum age for an account.
Your rights
You can change your analytics choice at any time with “Your privacy choices”, at the bottom of every page. Turning analytics off deletes the analytics cookies straight away.
Depending on where you live, you can also ask for a copy of your data, have it corrected or deleted, object to how it’s used, or opt out of its use for analytics. Write to TODO(owner): the contact address. In the EU, the EEA, the UK and Switzerland you can also complain to your data protection authority. TODO(owner): how requests are verified, and how long answers take.
Changes to this policy
A change to what analytics records gets a new policy version, and visitors who allowed analytics are asked again. Each version and the date it took effect are listed on this page. TODO(owner): SPEC.md §13.1, the lawyer’s review of this text.