Privacy Policy

1. Who we are

RunCode is operated by Maciej Pankiewicz, PhD, Assistant Professor at the Institute of Information Technology, Warsaw University of Life Sciences (SGGW), as Principal Investigator of the research project described below.

For questions about privacy, personal data, or participation in the research, contact maciej_pankiewicz (at) sggw.edu.pl.

2. Research project and purpose

RunCode is currently used as part of the research project “Modeling Task Difficulty and Student Ability in an Intelligent System Supporting Programming Education”, conducted from 2026 to 2029 at the Institute of Information Technology, Warsaw University of Life Sciences (SGGW).

The project studies methods for assessing programming-task difficulty, modeling student ability, analyzing how students solve programming tasks, and evaluating adaptive forms of educational support. Research interventions may include automatically generated feedback, personalized hints, skill modeling, or adaptive selection of educational support.

Student participation is based on informed consent. Students complete the consent process before a RunCode account is created. RunCode is not currently offered to students who do not participate in the research project.

Adaptive and AI-supported features are used only for research and learning support. They do not determine course grades, academic standing, or other consequential decisions about students.

3. Information we collect

Account information

RunCode collects a university email address and university affiliation for account creation, authentication, course administration, and essential account communications. Instructor accounts use the same types of account information but instructor activity is not included in the student research dataset.

Research questionnaire and assessment data

Student research data may include structured survey responses, such as gender, previous programming experience, and self-assessment of programming skills, as well as pre-test and post-test responses and scores. The enrollment survey does not intentionally request free-text personal information.

Programming and learning activity

For student research participants, RunCode may collect:

• programming-task attempts and submitted source code;
• scores, compiler errors, and unit-test results;
• use of feedback and other support features;
• timestamps and activity events;
• browser and device information used as part of the research dataset; and
• continuous typing and editing events within the RunCode code editor, including keystroke-level editing activity. RunCode does not capture typing outside the code editor.

Security and technical information

RunCode may process IP addresses and technical error information for security, troubleshooting, fraud prevention, and protection of the platform. IP addresses are not intended to be used as research variables.

4. How we use the information

Information is used to:

• create and operate RunCode accounts;
• authenticate users and provide access to assigned courses and programming tasks;
• send essential account messages such as registration, password-reset, and course-access notifications;
• evaluate programming submissions and provide educational feedback;
• operate, secure, troubleshoot, and improve the technical reliability of RunCode; and
• conduct the scientific research described in this policy and the participant consent materials.

Where the GDPR applies, research-related processing is based on the participant's informed consent. Account, technical, and security processing is carried out as necessary to provide, administer, and protect RunCode and the research environment. Where applicable, necessary security and platform-operation processing may also rely on legitimate interests in maintaining a secure and reliable service.

RunCode does not sell personal information and does not use participant information for advertising or unsolicited marketing.

5. AI-generated programming feedback

Some research interventions use the OpenAI API to generate educational feedback. When this functionality is active, RunCode may send the student's submitted code, compiler errors, and/or unit-test results to OpenAI for the purpose of generating feedback.

RunCode does not send the student's university email address or RunCode account identifier to OpenAI as part of these requests.

OpenAI processes API data under its applicable API data-handling terms. Under the standard OpenAI API data controls in effect on the effective date of this policy, API data is not used to train OpenAI models by default unless the customer explicitly opts in, and certain API content may be retained temporarily for abuse monitoring.

AI-generated feedback is provided for learning and research purposes only and has no role in grading or other consequential academic decisions.

6. Who can access the data

Before anonymization, access to the full identifiable or linkable student research dataset for research purposes is limited to the Principal Investigator.

Instructor access

Instructors may access limited information about students who belong to their own cohort. This may include the student's university email address, submitted code, score, compiler errors, and unit-test results. Instructors do not have access to research survey responses, pre-test or post-test data, keystroke data, or detailed research activity logs.

Research sharing

Once research data have been irreversibly anonymized so that individual participants can no longer be identified, the anonymized dataset may be analyzed or shared with other researchers and research collaborators. Research findings are intended to be published in academic papers, presentations, or reports only in aggregated or anonymized form.

7. Service providers

RunCode uses a limited number of external service providers to operate the platform and the research workflow. These may include:

• a cloud hosting provider for the RunCode application and database, currently using infrastructure located in Frankfurt, Germany;
• an external form service for the initial consent and research questionnaire;
• a transactional email provider for essential account-related messages;
• an error-monitoring provider that may receive technical error information and an internal RunCode user identifier; and
• OpenAI for AI-generated programming feedback, as described above.

Survey and consent responses collected through the external form service are linked to the RunCode research dataset using the participant's university email address and are removed from the form service after the linking process.

Service providers may process information only to the extent necessary to provide their respective services and are subject to their own data-processing and security obligations.

8. Data retention and anonymization

During the data-collection period, a student's university email address allows research questionnaire and assessment data to be linked with activity recorded in RunCode.

After the data-collection period for the relevant semester is completed, the student research dataset is irreversibly anonymized. The link between the research data and the student's university email address is removed. The RunCode account is disabled and cannot be restored because the identifying link has been removed.

Instructor accounts follow the same end-of-semester process for removal of the university email address and account disablement, although instructor activity is not part of the student research dataset.

Anonymized research data may remain in the active research database through the end of the project in 2029. After the project ends, the anonymized dataset may be archived within Warsaw University of Life Sciences infrastructure and retained indefinitely for scientific research.

Operational backups are retained for up to 7 days. Information removed from the active system may therefore remain temporarily in protected backups until those backups expire.

9. Cookies and tracking

RunCode uses only cookies that are necessary for authentication, session management, security, and core operation of the service. RunCode does not currently use advertising or analytics cookies.

10. Data security

Reasonable technical and organizational safeguards are used to protect research and account information against unauthorized access, alteration, disclosure, or loss. These safeguards include access controls, protected hosting infrastructure, encrypted storage on research devices where applicable, and restricted access to identifiable research data.

No method of electronic storage or transmission is completely secure, and absolute security cannot be guaranteed.

11. Your choices and privacy rights

While research data can still be linked to a participant, the participant may contact RunCode to request access to or correction of their personal data, withdraw from the study, or request deletion of the data linked to them. Withdrawal of consent does not affect processing that was lawful before the withdrawal.

If a participant withdraws before anonymization, identifiable or linkable research data associated with that participant can be removed. Once the data have been irreversibly anonymized, RunCode can no longer determine which records belonged to a particular participant, so individual access, correction, or deletion is no longer possible.

Depending on the law that applies to you, you may have additional privacy rights, including rights to restrict or object to certain processing, data portability, or the right to lodge a complaint with a competent data-protection authority. RunCode will respond to applicable privacy requests in accordance with relevant law.

12. International participants and data processing

RunCode may be used by eligible university students and instructors outside the European Union. The same core privacy practices described in this policy apply to all participants. Additional rights may apply depending on the participant's country or region.

The primary RunCode hosting environment is located in Frankfurt, Germany. Some external service providers, including OpenAI and providers used for forms, email delivery, or technical monitoring, may process data in other countries. Where required by applicable law, such transfers are handled using appropriate legal safeguards.

13. Changes to this Privacy Policy

This Privacy Policy may be updated when RunCode's research procedures, technical services, or legal obligations change. Material changes that affect research participants will be communicated when required, and the effective date at the top of this page will be updated.

14. Contact

Questions about this policy, privacy requests, or requests to withdraw from the study may be sent to: