Privacy Policy

Last updated: 23 October 2026

This is an English translation of our German Datenschutzerklärung. The German version is authoritative.

1. Controller

Ardalan Ebrahimi
Pragpath Studio
c/o Impressumservice Dein-Impressum
Stettiner Str. 41
35410 Hungen
Germany
Email: info@pragpath.com

The c/o address is a correspondence address for this website. Email is the fastest way to reach us with any privacy request.

For parents and guardians

MiniCoder is a platform where children build small apps and games by talking or typing. We collect as little as possible: an account needs only a username and a password, an email address is optional. There is no advertising and there are no advertising trackers. Children under 16 may only use MiniCoder with their parents' consent or under their supervision (section 7).

2. Hosting and server logs

MiniCoder runs on Microsoft Azure (provider: Microsoft Ireland Operations Ltd., One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland). The website, the application server (Azure App Service) and the database (Azure Database for PostgreSQL) run in the "West Europe" region (Netherlands, EU), under Microsoft's data processing agreement (Art. 28 GDPR).

When you visit the website, technically necessary data is processed: IP address, date and time, the page or endpoint requested, browser and operating system details (user agent) and, where applicable, the referring page. This is necessary to deliver the site and keep it secure (Art. 6(1)(f) GDPR). Server and error logs are deleted after 30 days at the latest. The hosting service may set a technically necessary load-balancing cookie (e.g. ARRAffinity).

3. Using MiniCoder without an account (guest mode)

MiniCoder can be tried without an account. So that guests can find their apps again and keep them when they register later, and so that guest usage limits work, we store a random guest id and a counter in the browser (see section 10) and the apps created with it on our server. Legal basis: Art. 6(1)(b) GDPR (providing the requested service) and Art. 6(1)(f) GDPR (preventing abuse).

4. User account

When you register we process your username, password (stored only as a hash), optionally your email address and name, the account type (child/user, parent, teacher), your language setting and your balance of "tokens" for app creations. The purpose is to provide the account and store your apps; the legal basis is Art. 6(1)(b) GDPR. We keep this data until the account is deleted.

Account deletion: there is currently no delete button in the app. Write to info@pragpath.com and we will delete the account together with its apps and content. Parents can request deletion of their child's account.

4.1 Sign in with Google

You can optionally sign in with your Google account (provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). Google's script (accounts.google.com/gsi/client) is loaded only on the login and registration pages and in the sign-in dialog, not on the other pages. When it loads, Google receives your IP address and browser details. If you use Google sign-in, Google sends us your Google id, email address, name and the address of your profile picture. Legal basis: Art. 6(1)(b) GDPR. Google may transfer data to the USA; Google is certified under the EU-US Data Privacy Framework. Google's privacy policy: policies.google.com/privacy.

5. Building apps with AI (OpenAI)

To turn a description into an app or to change an app, we send the text you entered (the prompt), where applicable the app's current code, and technical instructions to the API of OpenAI (OpenAI, L.L.C., 3180 18th Street, San Francisco, CA 94110, USA). For voice input, the recording is sent to OpenAI's "Whisper" service to be converted into text; we process the audio in memory only and do not store it. Prompts, generated code and the change history are stored by us so that you can keep working on your apps. Legal basis: Art. 6(1)(b) GDPR. The transfer to the USA is based on the EU-US Data Privacy Framework or Standard Contractual Clauses (Art. 46 GDPR). Under OpenAI's API terms, data sent through the API is not used to train models.

Please do not enter personal data in prompts (such as real names, addresses or phone numbers).

6. Publishing and sharing

If you publish an app in the MiniCoder App Store or create a share link, the app is visible to others together with your username; other users can give apps stars. Publishing is voluntary and can be undone (Art. 6(1)(b) GDPR). We may review and remove public content.

7. Children, parents and teachers

Parental consent (Art. 8 GDPR): children under 16 may only use MiniCoder with the consent of their parents or guardians; for children under 16, consents (e.g. to statistics, section 9) should be given by the parents. We do not verify age technically.
Parent invitation: the age can be entered at registration. If a child states they are younger than 13, they are asked for a parent's email address. We then send an invitation to that address that lets the parent connect to the child's account (link valid for 14 days). The age itself is not stored; the parent's email address and the invitation status are.
Parent account: parents can create or connect child accounts and see their children's apps and history.
Classes: teachers can create classes. Students join with a class code and a nickname of their choice (without their own account) or with their account. The teacher sees the apps created in the class and the progress. Legal basis: Art. 6(1)(b) GDPR; the school or teacher is responsible for using MiniCoder in their lessons.
Children see no advertising; we do not build advertising profiles.

8. Emails and enquiries

Where an email address is available, we send: parent invitations, notifications (e.g. when an app receives a star, reminders about unfinished apps, summaries), replies to feedback and requests, and occasional news about new features. Notifications can be turned off in the settings or through the unsubscribe link in every email. For links in notifications we measure whether they were clicked. Legal basis: Art. 6(1)(b) and (f) GDPR. Emails are sent through the SMTP server of our email provider (Private Email by Namecheap, Inc., Phoenix, USA); the transfer is based on Standard Contractual Clauses (Art. 46 GDPR).

Feedback sent through the feedback window and requests sent through the groups/teachers form (email address, message) are processed to answer them and to improve MiniCoder (Art. 6(1)(b) or (f) GDPR). With feedback we store the technical context (e.g. the page and the app concerned). We delete this data when it is no longer needed.

9. First-party usage statistics

We measure ourselves, without any third party, how MiniCoder is used, e.g. pages visited, features used, successful or failed app creations. For this, the following is sent to our server: event name, page, time, browser and interface language, user agent, origin of the visit (referring page, UTM parameters), a random visitor id and session id and, for signed-in users, the account id. The IP address is not stored.

With your consent, the visitor id (mc_visitor), the first-touch origin (mc_first_touch) and the session data (mc_session, mc_session_start, mc_last_activity) are stored in your browser so that repeat visits can be grouped. Legal basis: § 25(1) TDDDG, Art. 6(1)(a) GDPR.
Without your consent, none of this is stored on your device. The ids then exist only in memory for the current page load and are gone after a reload. Legal basis for this limited measurement: Art. 6(1)(f) GDPR (legitimate interest in error analysis and improvement).

We keep statistics data for at most 2 years.

10. Browser storage and consent

MiniCoder mostly uses the browser's local storage (localStorage/sessionStorage) rather than cookies.

Purpose	Keys	Consent
Sign-in (session token, account data)	`token`, `user`	not required
Chosen language	`mc_ui_lang`	not required
Your cookie choice	`cookieConsent`, `analyticsConsent`	not required
Guest mode (guest apps, usage limits)	`guest_persistent_id`, `guest_session_id`, `guest_session_state`, `guest_daily_generations`	not required
Taking part in a class session	`mc_class_session_v1`	not required
Registration and save flow, dismissed hints, order of AI requests (for the current tab or display only)	`mc_conv_ctx`, `mc_conv_after_signup`, `mc_conv_limit_version`, `mc_own_shown`, `mc_own_dismissed_until`, `mc_group_cta_shown`, `mc_group_cta_dismissed_at`, `mc_ai_op_seq`	not required
Marking operator and test traffic (admin only)	`mc_internal`, `mc_test`	not required
Statistics (section 9)	`mc_visitor`, `mc_first_touch`, `mc_session`, `mc_session_start`, `mc_last_activity`	only with consent

The necessary entries are strictly required for the service you asked for (§ 25(2) no. 2 TDDDG). You can change or withdraw your choice at any time through the "Cookie settings" link at the bottom of the page; when you withdraw, we delete the statistics entries from your browser.

11. Demo video (YouTube)

On the home page we show a video from YouTube (Google Ireland Limited). The video is loaded only when you click "play"; before that no connection to YouTube is made. After the click the video is loaded in privacy-enhanced mode (youtube-nocookie.com); Google then receives your IP address and browser details and may transfer data to the USA (EU-US Data Privacy Framework). The legal basis is the consent you give by clicking (§ 25(1) TDDDG, Art. 6(1)(a) GDPR).

12. No sharing for advertising

We do not sell data and do not share it for advertising. Recipients are only the service providers named above and, where we are legally required to, public authorities.

13. Your rights

You have the right to:

access your data (Art. 15 GDPR),
rectification (Art. 16 GDPR),
erasure (Art. 17 GDPR),
restriction of processing (Art. 18 GDPR),
data portability (Art. 20 GDPR),
object to processing based on Art. 6(1)(f) GDPR (Art. 21 GDPR),
withdraw consent with effect for the future (Art. 7(3) GDPR), e.g. through "Cookie settings".

An email to info@pragpath.com is enough. Parents can exercise these rights on behalf of their children.

You also have the right to lodge a complaint with a data protection supervisory authority, for example the authority responsible for where you live.

14. Security

Data is transmitted encrypted (HTTPS). Passwords are stored only as hashes. Access to the servers and the database is restricted.

15. Changes

We update this privacy policy when MiniCoder changes. The version published here applies.

Last updated: 23 October 2026

Legal notice