What we store, and what we don't
Short version: you can read everything here without an account, without being tracked, and without any of it reaching a third party — because there are no third parties.
Last updated 13 September 2026
Reading the site
You can read every article, run every playground and take every quiz without an account. Doing so stores nothing about you beyond the preference cookies below and the web server's access log.
There is no analytics on this site. No Google Analytics, no Plausible, no Facebook pixel, no session recording, no heatmaps. Nothing counts you.
Fonts are served from this domain rather than from Google Fonts, and icons are bundled into the site rather than fetched from a CDN. That is deliberate: a font request to a third party is a record of your visit held by someone we have no agreement with.
Cookies
8, all of them functional. There is no consent banner because there is nothing to consent to — none of these track you, profile you, or leave this domain.
| Cookie | What it does | Lasts |
|---|---|---|
| bp_access | Keeps you signed in. Short-lived, HTTP-only, so JavaScript cannot read it. | 15 minutes |
| bp_refresh | Renews your session without asking you to sign in again. HTTP-only. | 30 days |
| bp_anon | Lets you take a quiz or play a game and keep your score without an account. It identifies an attempt, not a person — and if you do register, whatever it holds becomes yours and the cookie is dropped. | 1 year |
| bp_vertical | Remembers whether you are reading the development or the languages section. | 1 year |
| bp_accent | Remembers the accent colour you picked. | 1 year |
| bp_code_theme | Remembers the palette you chose for code blocks. | 1 year |
| bp_arcade_sfx | Remembers whether you turned game sound on. Off unless you ask for it. | 1 year |
| bp_install_dismissed | Remembers that you said "not now" to adding the arcade to your home screen, so it stops asking. | 60 days |
Clearing them signs you out and resets your appearance choices. Nothing else is affected.
Playing a game
You can play everything in the arcade without an account. A run is stored against the bp_anon cookie so your best score survives a refresh — and if you make a player account later, those runs become yours rather than being stranded.
A couple of things the games keep in your browser's local storage instead of on our server. These are never sent with a request, so we cannot read them, and clearing your site data removes them:
| Key | What it holds |
|---|---|
| bp:arcade:<game>:best | Your best score in a game, so it is still there when you come back without an account. |
| bp:arcade:daily-word:<day> | Today's word-game board, so switching tabs mid-puzzle does not lose it. |
If you appear on a leaderboard, what is public is the handle you chose and the score — not your email, your name, or anything else.
If you create an account
An account stores your email address, a display name, a username, and a password.
A player account — the one the arcade offers — stores less: a handle, an email address and a password, and nothing else. It is a normal account, marked in the database as having come from the games, so it is never counted as a student or sent anything about courses.
Your password is stored as an argon2id hash, never as text. Nobody — including us — can read it back, which is why a forgotten password has to be reset rather than looked up.
Alongside that, an account accumulates only what you produce by using the site:
- quiz attempts and their scores
- game runs, your best scores and your streak
- certificates you have earned
- packages you have submitted
- comments and votes
- the time you were last seen, so sessions can expire sensibly
If you write to us
The collaboration form stores your name, email address, message and any links you add. It is an inbox, not published content — nothing from it appears on the site.
Be aware that we reply by hand. The site does not send automated email of any kind at present, so nothing is dispatched to you by a machine.
Server logs
The web server keeps an access log containing IP addresses, requested URLs, timestamps and user agents. It exists to diagnose faults and spot abuse. It rotates automatically and old entries are discarded — roughly the last 100MB of traffic is kept, which is a matter of days, not years.
Who else sees any of this
Nobody. There is no analytics provider, no advertising network, no email marketing platform, no payment processor, no third-party search, and no CDN holding your requests. Everything described on this page lives on one server we run, in a PostgreSQL database and a log file on that same machine.
Two exceptions worth naming honestly: our hosting provider necessarily operates the machine, and articles published here are also posted to dev.to — but that is our writing being copied, not your data.
Your data, on request
Ask and you can have a copy of everything associated with your account, or have it deleted. Deletion removes the account and anonymises what has to survive for the site to make sense — a published comment loses its author rather than leaving a hole in a thread.
Write to bestpractice2026@gmail.com or use the contact form.
Children
This site is written for working developers and adult language learners. It is not directed at children, and we do not knowingly hold data about anyone under 16.
Changes
If what the site does changes, this page changes with it, and the date at the top moves. If a change materially affects anyone with an account, we will say so rather than quietly editing the text.