Privacy policy

• Data is stored on the server run by the Rangkai operator and is not sent to third-party services for advertising or analytics.
• No ads and no third-party trackers. Visit statistics are counted by Rangkai itself without cookies; public IP addresses are kept for at most 30 days for security only. Data is not sold and is not shared for marketing.
• Personal accounts only need a name, email, and password. Students in a class do not need an email. Passwords are stored as hashes, not as plain text.
• Teachers can only see the work of students in the classes they teach.

The personal data controller is the operator of this Rangkai site, which runs this Rangkai site and decides how its data is processed.

Questions and requests about personal data can be directed to the Rangkai operator (Admin), or to your teacher if you joined a class.

• Teacher accounts: name, school or institution name (optional), email address, and password (stored as an scrypt hash).
• Student accounts: the name typed when joining, the classes joined, and a text password or picture password sequence (stored as a hash). Students are not asked for an email address.
• Personal accounts: name, email address, password (hash), and the chosen learning level.
• Personal account created from a student account (optional): a student can create their own personal account from the student home page. The name comes from the student account, the email and password (or Google) are entered by the student, and copies of the student's own projects are placed in the new account. Assignment work, submissions, and grades are not copied and stay in the class. The student account records which personal account was created, so later projects can be copied too.
• Sign in with Google (optional, teachers and personal accounts only): the Google account ID and the email address Google confirms, so you can sign in without a password. Rangkai only asks Google for your name, email address, and account ID, and does not keep any Google tokens. You can disconnect Google on the Account page at any time.
• Learning content: projects (circuit, block program or code, title), project version history (up to 50 versions per project), assignments, assignment submissions, grades, and teacher comments.
• Class activities: quiz answers, answer times and points, best scores and times in circuit races, and automatic grading breakdowns. Points and badges are calculated from this data and are not stored separately.
• Visit statistics: for each day, the number of views and unique visitors per page (with project, assignment, and class IDs masked), the referring site's name, phone or computer, and page speed measurements (Core Web Vitals). Unique visitors are counted with a one-way hash of the network address and browser combined with a random daily key that is never stored; the hash is deleted after one day. No cookies are used, and browsers that send Do Not Track or Global Privacy Control are not counted.
• Public IP address and country: for each visited day, the public IP address your connection uses, the country estimated from it by Cloudflare, phone or computer, the number of page views, and the first and last visit time. It is used to keep Rangkai secure (for example to spot abuse or attacks) and to see which countries visitors come from. Only Rangkai Admins can see it, it is never sold or shared for marketing, and it is deleted automatically after 30 days. The country is an estimate, not your exact location. Browsers that send Global Privacy Control are not recorded.
• Consent: the time and version of the terms of use and privacy policy you agreed to when signing up.
• Sign-in sessions: a random token stored on the server as a hash, along with its expiry time.
• Temporary data in server memory: counts of failed sign-in attempts (per email or per name in a class, cleared a few minutes after the last attempt) and counts of Try mode compilations per network address (kept for at most 1 hour). This data is not written to the database and is lost when the server restarts.

Rangkai does not collect location, contacts, photos, recordings, or other device data.

• Creating and securing accounts, and preventing repeated sign-in attempts.
• Saving and displaying projects, running simulations, and compiling programs.
• Class activities: assignments, submissions, grading, comments, grade export by teachers, live quizzes, circuit races, points, badges, and leaderboards.
• Keeping the server able to serve everyone, for example by limiting compilations by Try mode visitors.

Data is not used for advertising profiles and is not sold.

Automatic grading: when a teacher chooses it for an assignment, the grade is calculated from fixed criteria (puzzle answer key, successful compilation, circuit checks, and required components), and the breakdown is shown to the student. The teacher can change the grade, and students can ask their teacher to review it.

• You: all your projects and your account.
• Your class's teachers and co-teachers: the class student list, students' projects in that class, assignment submissions, and grades. Teachers can export grades to a CSV file.
• Classmates: your name and points on the class leaderboard, quiz standings, and race board. If the teacher turns on picking names at sign-in, the class name list is shown on the sign-in screen to anyone who knows the class code.
• Other signed-in users: only projects you share via a link. New projects are always private, and class safe mode prevents students from sharing projects.
• Everyone, including visitors without an account: projects you submit to the gallery yourself, after an Admin approves them. The gallery shows the title, short description, circuit, program, level, and the maker's name (students: first name only), plus the number of likes. Gallery submissions are checked by an Admin first, can be withdrawn by you at any time, and are not possible for students in a class with safe mode on. Likes and reports are tied to your account but are not shown to other users.
• Admins and server operators: technically have access to the database on the server.

Data is stored in a database on the operator's server and kept for as long as the account or project exists, or until the operator deletes it. Sign-in sessions end after 30 days or when you sign out. Projects in Try mode are not stored on the server.

Rangkai is accessed over the internet. Traffic may pass through the operator's hosting or tunneling provider; the operator is responsible for choosing a suitable provider and informing users.

• rangkai_session: the sign-in session cookie (httpOnly), valid for 30 days. Needed to keep you signed in.
• rangkai_uid: a legacy cookie from versions that still had guest mode. Only used to move guest projects to a new account when you sign up.
• rangkai_lang: the chosen site language (Indonesian or English), valid for 1 year.
• Browser local storage: the light or dark theme choice, up to 3 student accounts remembered on this device (name, class, and class code, without passwords) so they can sign in again quickly, copied components (copy and paste), Try mode work carried over to your account when you sign up, and one-time display flags. This data is not sent to the server except when you save Try mode work to your account.
• IndexedDB: compiled programs are stored in the browser so the same program does not need to be compiled again.

Rangkai does not use third-party cookies. Fonts, icons, and the editor are loaded from the Rangkai server itself, not from outside services.

Rangkai is also used by children. Under the Personal Data Protection Law (UU PDP), processing a child's personal data requires the consent of a parent or guardian. Children who create a personal account need that consent, including students who create one from their class account, and teachers who create classes are responsible for obtaining it before students join. A personal account is not supervised by the teacher, and class safe mode does not apply to it.

To keep the data collected to a minimum, students only need a nickname or first name, and no email address.

In the gallery, students are shown by first name only. Titles and descriptions that contain links, email addresses, or phone numbers are rejected automatically, and every submission is checked by an Admin before it becomes public.

You have the right to request access to, correction of, and deletion of your personal data, and to withdraw your consent. Here is how:

• You can change or clear your project titles and contents yourself. Personal accounts can change their level at any time.
• Students can ask their teacher to reset their password or remove their account from a class.
• For a copy of your data or to delete your account along with its projects, contact the operator. Admins can permanently delete an account and all its projects from the Admin dashboard. The operator responds to requests within a reasonable time.

Passwords are stored as scrypt hashes, session tokens are stored as hashes, sign-in attempts are rate-limited, and the compile service only accepts requests from the Rangkai server itself. No system is completely secure; if a data breach occurs, the operator must notify affected users as required by law.

This policy may be updated when Rangkai's features change. The effective date at the top of this page shows the latest version. See also the terms of use and the open-source licenses used by Rangkai.