~/dojo $ :help privacy
Privacy
vimdojo is a personal open-source project, run by @navasvarela. The game needs no account and works offline. This page covers what is stored if you visit the site, or choose to create an account.
Playing without an account
The plugin keeps your progress and your best key logs on your own machine, and only sends a run if you sign in and submit it. The demo keeps its progress in your browser. Neither sets a cookie. When you solve a level in the demo, it asks the server whether you're signed in, so it can offer to submit the run. It sends the run only if you choose to.
The site counts visits with Cloudflare Web Analytics, which is cookieless and doesn't track you across sites.
If you create an account
Accounts are optional, and you sign in with GitHub. vimdojo asks GitHub for no scopes.
| What | Why | How long |
|---|---|---|
| Your GitHub numeric id | To recognise you when you log in again | Until you delete your account |
| The handle you pick | Your public name on the leaderboards | Until you delete your account. A released handle stays reserved for 90 days, unlinked from you, so nobody can impersonate you. A handle you drop in its first day isn't reserved. |
| Your logins: the kind, and when each was created and last used. Only a hash of each token. | To keep you signed in, and to let you revoke a login | 30 days after last use, or until you sign out |
| Runs you choose to submit: each level's keys and their timing, your Neovim version (or that the run came from the browser), the score your game counted, and whether you used a hint | To replay each run, verify its score and rank it. Your keys are that level's solution, so they stay private: boards only show the key count. | 90 days, or for as long as the run is your best on that level. They go when you delete your account. |
| Your place on each day's daily board: the date, the level, your verified key count, and whether you used a hint | To show that day's board, by your handle | Until you delete your account. It doesn't include your keys. |
| A hash of your IP address, with a salt that changes daily | To limit abuse of the login routes | About a day. The address itself isn't stored. |
vimdojo doesn't collect your email, name or avatar, and discards the rest of what GitHub returns at login. There are no ads and no selling of data.
What's public: your handle, the month you joined, and your verified key count, place and date on each level you've submitted. Your keys and your timing aren't.
One cookie is used, and only if you sign in on this site: a session cookie that is strictly necessary to keep you signed in. A short-lived second cookie protects the login itself.
Your data, your call
On your account page you can see your logins and revoke them, download everything stored about you as JSON, and delete your account. Deleting removes your data at once. Questions, or anything else you'd like to ask: open an issue.
Who handles the data
- Cloudflare runs the API and its database, which is kept in the EU, and provides the visit counts.
- GitHub provides sign-in, and hosts this site.
- Vercel runs the sandbox that replays submitted runs, in Frankfurt. It receives only the level and the keys, with nothing that says who played.