Last updated: September 24, 2026
This policy explains what Cube Drills collects, why, who it's shared with, and what control you have over it. It applies to everyone who creates a Cube Drills account, including users under 16 — see section 8 for the extra protections that apply to them.
Only what running the app requires. Specifically:
| Category | What's in it | Why we have it |
|---|---|---|
| Account | Name, email, password (stored as a bcrypt hash, never in plain text), date of birth, email verification status | To create and secure your account, and to apply the right protections for your age |
| Parent/guardian contact | A parent or guardian's email address — only collected for accounts registered as under 13 | To get parental consent before the account can record anything, as U.S. COPPA requires |
| Google sign-in (optional) | Your Google account id, email, and name, if you choose "Sign in with Google" | To let you sign in without a separate password |
| WCA sign-in (optional) | Your World Cube Association account id, WCA ID (if you've competed), name, and email, if you choose "Sign in with WCA" | To let you sign in with your WCA account and show your WCA ID next to your name |
| Billing (paid plans only) | Your plan, its status and renewal date, your Stripe customer and subscription ids, any gift code you redeemed, and any club you bought or were given a seat in (the club's name and its members' accounts) | To give you the paid features you bought, and to keep the records the law requires for payments |
| Public profile (optional, 16 and over only) | Your name, WCA ID, and best times, shown on public leaderboards and shareable PB cards — only if you turn on a public profile in Settings | So you can appear on leaderboards and share your results. Turn it off at any time and you disappear from them |
| Practice data | Your solve times, scrambles, penalties, comments, sessions, routines, daily logs, and algorithm-trainer stats | This is the whole point of the app — it's how your timer, stats, and training history work |
| Progress & preferences | XP, streaks, achievements, and your app settings | To keep your gamification progress and preferences in sync across devices |
A few things stay on your device only and are never sent to our servers: your stats for the Cross, Inspection, Memo, TPS, Recognition, Fewest Moves, and Lookahead drills, and a couple of small display preferences. If you connect a Bluetooth smart cube, its move stream is processed in your browser for that drill and is not sent to our servers. Clearing your browser's site data deletes these permanently — we don't have a copy.
To run the timer, algorithm trainer, statistics, and routine-tracking features you use; to take payment for and provide paid plans; to compare your times against other users' in aggregate for the Coach's percentile (only anonymous totals are used, no one else's account is shown to you); to secure your account (password hashing, email verification, rate-limiting login attempts); to send the transactional emails described below; and, only once you've given consent, to understand product usage in aggregate. We do not sell your data, and we do not use it for advertising.
Account and practice data: processed to perform our contract with you (running the service you signed up for). Parent/guardian email: processed under our legal obligation to obtain verifiable parental consent for a child's account. Billing records: processed to perform our contract with you, and kept to meet tax and accounting obligations. Public profile: processed with your consent, which you give and withdraw with the Settings toggle. Analytics: processed only with your consent, which you can withdraw at any time.
We use a small number of processors to run Cube Drills. Each only receives what it needs to do its job:
| Processor | What it's for | What it receives |
|---|---|---|
| Fly.io | Hosts our API server and database | Everything in this policy — it's the infrastructure the app runs on |
| Cloudflare Pages | Hosts the Cube Drills web app itself | Standard web request data (IP address, browser) to serve the site — no account data |
| Resend | Sends account emails: verification, password reset, and — for under-13 accounts — the parental consent email | Your email address (or your parent/guardian's, for the consent email) and name |
| Sentry | Error monitoring, so we notice and fix bugs | Technical crash reports. Configured to not collect personal data by default (no IP address, no user identifiers attached automatically) |
| "Sign in with Google," if you choose to use it | Nothing from us to Google beyond the standard OAuth sign-in request — Google shares your email, name, and account id with us | |
| World Cube Association | "Sign in with WCA," if you choose to use it | Nothing from us beyond the standard OAuth sign-in request — the WCA shares your account id, WCA ID, name, and email with us |
| Stripe | Payment processing for paid plans, gift codes, and club seats | Your email address and the plan you're buying. You enter your card details on Stripe's own checkout page — they never reach our servers. The country you pick to see local pricing is only used to show the price and is not stored. |
| PostHog | Aggregate product analytics — only after you consent | A small, fixed set of events (account created, first solve, app opened, a drill completed, an algorithm trained, a streak extended) — never solve times, scrambles, or anything else you've typed. Nothing is sent before you consent. |
We don't use any advertising or ad-tracking service.
Cube Drills doesn't use cookies. Your login is kept in your browser's local storage as a security token; a few preferences are stored the same way. Solves recorded while you're offline are held in your browser's IndexedDB storage until they can sync — this is under your control and cleared along with your other site data.
We keep your account and practice data for as long as your account exists. Database backups are retained for 30 days and then automatically deleted. If you delete your account (available any time from Settings), your data is removed from our live database immediately and purged from backups within 30 days. Stripe keeps its own record of any payment you made, as payment and tax law require, under Stripe's privacy policy.
If you tell us you're under 13 when you register, we ask for a parent or guardian's email and send them a confirmation link. Until they confirm, the account can sign in and view its own data, but can't record solves or change anything. For every account under 16 — whether or not parental consent is required — we never enable analytics tracking, never show a public profile, never show advertising, and never let the account start a purchase, regardless of any other setting. (A child can still be given a paid club seat or a gift code by an adult.) These protections are enforced by our server, not just hidden in the app, so they can't be bypassed from the browser.
You can, at any time, from Settings:
A parent or guardian can request the same on behalf of a child's account by contacting us below. If you're in the EU/UK, you also have the right to correct inaccurate data and to object to or restrict certain processing — contact us and we'll act on it.
Passwords are hashed with bcrypt and never stored in plain text. All traffic to Cube Drills is encrypted (HTTPS). Access to production data is limited to what's needed to operate the service.
If we make a material change to what we collect or how we use it, we'll notify you by email or an in-app notice before it takes effect.
Questions, or want to exercise any of the rights above? Email privacy@cubedrills.example.