Privacy
Your code never leaves your machine. The Game runs locally and the Quiz your slop server only receives progress, no content.
What goes up to the server
- ✔ Your account: your GitHub id, login, name, avatar and email.
- ✔ Your XP, your Title and stats: Expeditions, hits and Disputes won.
- ✔ For each Adventure: a meaningless code (in the Tutorial, simply "tutorial"), the revealed percentage (Adventure Progress) and the Class.
A whole progress upload looks like this (the account is not in it: the server knows who you are from the session):
{
"xp": 140,
"titulo": "Leitor de Diff",
"estatisticas": {
"expedicoes": 12,
"acertos": 47,
"contestacoes_vencidas": 2
},
"aventuras": [
{
"id": "tutorial",
"progresso": 25,
"classe": "fullstack"
},
{
"id": "9b04d6aa-3c1e-4f2b-8a7d-5e6f0c1b2a39",
"progresso": 43,
"classe": "backend"
}
]
}What never leaves your machine
✘ The map (names of Regions, Territories and Links), file paths, Challenges, answer keys, Evidence, code snippets and the name or path of your folders. The full state of each Adventure is a local file (in the Tutorial, it is kept in this browser). Your Profile has the "What is sent" screen, with the exact JSON of the last upload — and the Game is open source.
Your AI
The Master is your AI CLI (Claude Code or Codex), with your account. It reads the Project's code in read-only mode and sends it to its provider (Anthropic or OpenAI), just like in your normal use. What that provider does with the data follows its terms, not ours.
Quiz your slop does not provide an AI, does not broker those calls and does not see what they carry.
Account and GitHub sign-in
To play, the Tutorial included, you need an account. Sign-in is GitHub only, with the minimum scope (read:user user:email): name, avatar and email. No access to your repositories.
The session lives in an encrypted cookie, used only to know who is playing. The language you pick lives in a separate cookie (NEXT_LOCALE), only so the site opens in it.
In the desktop Game, sign-in happens on this site, in the browser, and the Game receives an access token that lives in your system's keychain (Secret Service on Linux, Credential Manager on Windows) and is used only for progress. The server keeps only a hash of it; the token expires in 90 days, and Sign out in the Game revokes it.
If you join the AI waitlist, we also keep the AI you picked (and the name you typed, if it is "other"), tied to your account.
Site stats (Umami)
The site counts visits with Umami, hosted by us: no cookies, no identifying you and no URL parameters. It only tells us which pages are read.
The desktop Game has no telemetry at all. Error reports are opt-in, with paths and Project names replaced by <projeto>/... and editable before sending: the Game only opens a new GitHub issue with the text, and you are the one who sends it.
Questions
Saw anything other than numbers and ids being sent? That's a bug — open an issue in the project's repository.