Privacy Policy

ForceChallenges (“we”, “us”) is a practice platform for Salesforce developers: SOQL and Apex trigger challenges, study notes and a leaderboard. This policy explains what information we collect, why, who we share it with, how long we keep it and the choices you have. By using ForceChallenges you agree to this policy.

1. Information we collect

Account information. When you sign up we collect your email address and a username, and, if you sign up with email, a password (stored only as a salted hash by our authentication provider; we never see or store your plain-text password).

Google sign-in. If you choose “Continue with Google”, Google shares with us your email address, name and profile picture (the basic openid, email and profile scopes). We use them only to create and recognise your account. We do not request access to your Gmail, Drive, Calendar, contacts or any other Google service.

Practice activity. The code you submit, the verdict and test results, your points and rank, problems you have solved, feedback you send about a problem, and whether you opened a problem's solution.

Usage and device information. Pages you view, clicks and other interactions, browser and device type, approximate location derived from your IP address, and the last time you were active and the page you were on. Depending on how the site is configured by its administrators, usage data can also include what you type into form fields (never passwords) and snapshots and pasted text from the code editor, so that we can improve the challenges.

Optional Salesforce org connection. If you connect your own Salesforce org, we receive OAuth tokens, your org ID, username and instance URL. Tokens are stored encrypted. We use them only to run your queries, and to deploy and run the test class that grades your Apex trigger, in your org. You can disconnect at any time from your account page, which revokes our access.

AI connections (administrators and maintainers). If you create an MCP access token or authorise an AI client, we store a hash of the token, its name and when it was last used.

2. How we use information

• To provide the service: sign you in, run and grade your solutions, award points and show the leaderboard.
• To keep the service secure and prevent abuse (rate limiting, fraud and spam detection).
• To understand how the platform is used and improve problems, hints and study notes.
• To respond to your feedback and support requests.

We do not sell your personal information and we do not use it for advertising.

Google user data. ForceChallenges's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We use Google user data only to authenticate you and operate your account, we do not transfer it to others except as needed to provide the service or comply with law, and we do not use it for advertising or sell it.

3. Who we share information with

We use a small number of service providers who process data on our behalf, under their own terms and privacy policies:

• Supabase — database, authentication and file storage.
• Vercel — hosting, and cookieless web analytics.
• Google — only if you sign in with Google.
• Salesforce — only if you connect your own org; your code and queries run in that org.

Your username and points are visible to other users on the leaderboard. Your email address is never shown publicly. We may disclose information if required by law or to protect our rights, users or the service.

4. Cookies and similar technologies

We use cookies and local storage that are needed to keep you signed in and to remember preferences (such as light or dark theme, your drafts and which notes you have read), plus first-party analytics identifiers (an anonymous visitor ID and a session ID) used to understand usage. Vercel Web Analytics is cookieless. You can clear cookies and site data in your browser at any time; some features, such as staying signed in, will then stop working.

5. Data retention

We keep account and activity data for as long as your account exists. Usage analytics are kept only as long as needed for the purposes above. When you ask us to delete your account we delete or anonymise your profile, submissions, feedback and connection tokens, except where we must keep information for legal or security reasons.

6. Security

Data is transmitted over HTTPS. Passwords are hashed, Salesforce tokens are encrypted at rest, access tokens for AI connections are stored only as hashes, and access to administrative tools is restricted by role. No system is perfectly secure, so we cannot guarantee absolute security.

7. Your choices and rights

• Access, correct or delete your information, or ask for a copy, by contacting us at the contact address listed on our home page.
• Disconnect your Salesforce org on your account page, and revoke ForceChallenges's access to your Google account at myaccount.google.com/permissions.
• Depending on where you live (for example the EU/UK or California) you may have additional rights such as objecting to or restricting processing. Contact us and we will respond within a reasonable time.

8. Children

ForceChallenges is not directed to children under 16 and we do not knowingly collect their personal information. If you believe a child has given us information, contact us and we will delete it.

9. International transfers

Our providers may process data in countries other than your own. Where required, we rely on appropriate safeguards for such transfers.

10. Changes to this policy

We may update this policy from time to time. We will change the “Last updated” date above, and for material changes we will give additional notice in the app.

11. Contact

Questions or requests about privacy: the contact address listed on our home page. See also our Terms of Service.