Privacy policy

What we collect and why

Code and files you work with

What you type in a terminal or run from the editor is sent to our servers so it can run in a sandboxed container. Files you create or upload are stored in your workspace (up to 50 MB).

If the service runs on more than one server, your workspace may be copied between them so your files are there wherever your terminal runs.

Please don't paste passwords, keys or other secrets into the terminal, editor or Genie. Because Genie reads your terminal output, don't print secrets there either.

Account information

If you sign in, we use Google Firebase Authentication with Google, GitHub or email sign-in. We receive your name, email address, profile photo and a user ID, and keep them with your session so you stay signed in.

Cookies and browser storage

We set a signed session cookie that keeps you signed in and links you to your workspace, and a small counter cookie (Session-Counter) that tracks how many terminals you have open. Google Tag Manager and Google Analytics may set their own cookies (such as _ga) to recognise returning visitors. The page also saves a few preferences in your browser's local storage, such as the editor theme, whether the Files panel is open, and practice progress. If you're signed in, your practice questions and which ones you've finished are also saved with your account, so they follow you to other browsers.

Shared sessions

Share links work through Google Firebase Realtime Database. For a session, it holds the editor content, the language, the file tree and the terminal output, so that people with the link can follow along.

Code links

When you choose Share, then Create code link, a copy of the code in your editor (up to 64 KB) is stored on our server and you get a short link. Anyone who has the link can read that code. Code links are kept until we remove them, so don't create one for code that contains secrets. To prevent abuse we count how many links each IP address creates in a short time.

Genie, the AI helper

When you use Genie, your messages, the code in your editor and the most recent output of your terminal are sent through our server to OpenAI to generate replies. You can choose which model answers: GPT-6 Luna or GPT-4o mini (both run by OpenAI), or Gemma 4 31B, which runs through OpenRouter on servers operated by ModelRun and, if that is unavailable, CoreWeave. If you choose Gemma, your messages go to OpenRouter and to whichever of those two answers, not to OpenAI. The site owner can also add other models that run through OpenRouter. If you choose one, your messages go to OpenRouter and to the provider that runs it, which the owner names or OpenRouter picks, not to OpenAI. A model marked free runs on a provider's free tier, and such a provider may keep what you send and use it under its own terms, so do not send anything private to a free model. Genie is optional; if you don't open it and don't ask for a practice question, nothing is sent to OpenAI or OpenRouter.

To answer questions about OpenREPL itself, Genie may add short passages from our own notes about the service, and from blog posts published on this site, to your message before it is sent to the model. This text is public. It is picked on our server by matching words in your question, with no extra service involved, and nothing about you is added to it. If nothing matches, nothing is added. Genie shows under its reply which notes were used. The Ask Genie button of the blog editor works the same way for the people who write posts. Practice questions do not use it.

Agent mode, when you are signed in and choose it in the Genie panel, lets Genie work on a task in several steps. Each step sends the same things as a Genie message (your task, the code in your editor and the recent output of your terminal) to the model you chose. Genie changes your editor, switches the language, runs your code, restarts your terminal, opens, switches or closes terminal tabs, types a line in your terminal, or works in your Files panel only after you allowed that kind of action (the names of your files are sent to the model when it lists them; renaming, moving and deleting are asked about every time), and you review every change to the editor before it is applied. You see the exact line before it is typed, and a line that could delete or change things is asked about every time. It stops when you press Stop or close the panel.

The right-click actions on selected code (Fix problems, Add comments, Write tests) send the selected code, the file it is in, the language and the recent terminal output to the model you chose; Explain is sent as a Genie message. On the practice page the coach (hints, a solution review and complexity) sends the editor, which holds the problem and your code, and the recent terminal output in the same way. Hints used are counted in your browser only.

The practice page's New question uses OpenAI in the same way: the topic, level and extra instructions you enter, the language, and the titles of your earlier questions on that topic are sent to the model you chose (OpenAI, or OpenRouter for Gemma) to write the question.

Language requests and feedback

If you send a request or feedback, we store the name, email and message you enter so we can read and reply to it. Google reCAPTCHA checks the form for spam.

Server logs and usage statistics

Our servers log each request with your IP address, the page requested and the time, and the servers' own commands. We use the logs to run and secure the service. The people who run OpenREPL can read them in an administration dashboard, where keys, tokens, cookies and full email addresses are masked. Logs rotate and are kept for up to 30 days.

To see how the service is used, we keep daily totals of how many terminals were started and in which language. To count each visitor once a day, we use a keyed hash of your account or IP address that changes every day; it is used only for that count. These totals are kept for 60 days.

Analytics and third-party content

We use Google Tag Manager to load analytics tags (such as Google Analytics), which record pages visited, device and browser type. Fonts come from Google Fonts and some scripts from public CDNs (cdnjs, jsDelivr and unpkg). These providers receive your IP address when your browser loads their files.

Services we rely on

We do not sell your personal information.

How long we keep data

Your choices

Security

Each session runs in its own container with limits on memory and disk. No online service is perfectly secure, so avoid storing sensitive data in OpenREPL.

Children

OpenREPL is not directed at children under 13, and we do not knowingly collect their personal information.

Changes to this policy

We may update this page. The date at the top shows the latest version.

Contact

Questions or deletion requests: contact the maintainer through the OpenREPL project on GitHub, or use the request form at the bottom of the home page.