Privacy Policy.

• Your programs, saved scripts and settings are stored on your device. The app does not upload them.
• If you agree, the app sends usage data and crash reports: which features get used and what goes wrong. Nothing is sent until you say yes, you can switch it off in Settings at any time, and it pauses while exam mode is on.
• Usage data and crash reports never include your code, your files, what your programs print or what you type into them.

What the app stores on your device

All of this is written to the app’s private storage on your device:

• the scripts you save, and the draft you are currently editing
• the history of the interactive REPL
• your settings, such as theme, font size, exam mode and your answer about usage data
• packages you install, cached so they work offline afterwards
• files your own programs create, in a folder belonging to the script that made them

Uninstalling the app deletes all of it. You can also delete it from inside the app, under Settings › Your data, which offers “Clear REPL history” and “Delete everything”. The same screen can export everything as a single JSON file to a location you choose, and import it back. That export happens only when you ask for it, and only to the place you pick.

Usage data and crash reports

Once Python has started for the first time, the app asks whether to share usage data and crash reports. Nothing is sent before you answer. You can change your answer at any time under Settings › Your data › “Share usage data and crash reports”.

While sharing is on, the app sends two kinds of information.

Usage events, to Amplitude. An event records that something happened in the app: a program ran, an example was opened, a script was saved or downloaded, output or a link was shared, code was opened from somewhere else, the theme or mode changed, exam mode was used, a package was installed, or the rating prompt appeared. The app also records when a session starts and ends, and when the app is installed, updated, opened or put in the background. An event can carry a few fixed details, and only these:

• for a run: whether it was a script or the REPL; whether it finished, was stopped or ended in an error; how long it took, in broad bands (under 1 second, 1–10 seconds, 10–60 seconds, over a minute); and for an error, the name of Python’s own exception, such as ZeroDivisionError. An exception with any other name is recorded as “other”, and the error message is never sent.
• for an example: its name in the app, such as turtle.
• for a package: its name if the app suggests or includes it, such as numpy. Any other package is recorded as “other”.
• where code was opened from (the file picker, the share sheet, a link or another app), and which shortcut opened the app (the REPL tile or shortcut, a script shortcut or the widget).
• the theme or mode you chose.

Crash reports, to Firebase Crashlytics. If the app crashes, the report describes the crash: the stack trace, when it happened, and the state of the device at the time, such as free memory and storage and whether the app was on screen. A crash that happens before you have answered stays on your device. It is sent if you say yes, and deleted if you say no.

Both come with a random identifier made for this installation of the app, and general details of the device: its manufacturer and model, Android version, app version and language. Usage events also carry the country the device reports: the country of the mobile network it is connected to or, without one, the country in its region setting. The identifier is not your advertising ID and is not linked to a name, email address or account. Reinstalling the app creates a new one. The app asks Amplitude not to record your network address, city, region or mobile carrier.

Never sent: your code, the names or contents of your scripts and files, anything your programs print, anything you type in answer to input(), error messages, the names of packages the app does not suggest itself, the links you share, your advertising ID, your precise location, or anything from outside the app.

Exam mode

While exam mode is on, usage data and crash reports pause. Nothing is sent, and anything already waiting on the device stays there until exam mode is turned off. The question about sharing is not asked while exam mode is on.

Who receives the data

• Amplitude, Inc. provides the usage analytics. Its privacy policy: amplitude.com/privacy
• Google LLC provides Firebase Crashlytics. Its privacy information: firebase.google.com/support/privacy

They process the data on our behalf, to show us how the app is used and why it crashes. We do not sell it.

How long it is kept, and your choices

Crashlytics keeps crash reports for 90 days. Usage events are kept for as long as they help us understand how the app is used and improve it.

Usage data and crash reports are sent only with your consent, and you can withdraw it at any time with the switch in Settings. Turning it off stops anything more from being sent. Because the information is tied only to a random installation identifier, we cannot tell which of it came from you, so we cannot look up or delete one person’s data. If you have a question or a request about your data, write to the address below.

When the app uses the network

Python Shell has no backend of its own. It uses the network in these situations:

1. Your own program makes a request. If your code calls requests.get(...) or opens a socket, it goes directly to whatever address your code names. The app does not inspect, log or relay it.
2. You install a package. The Packages panel asks the Python Package Index at pypi.org for the package you named and downloads it. PyPI will see the request, as any website sees a download. Nothing about you is attached to it.
3. You tap “Rate on Google Play”, “Send feedback” or “Privacy policy”. That hands off to Google Play or opens a page in your browser. Those services have their own privacy policies.
4. Usage data and crash reports, if you agreed to share them, as described above.

Turning on exam mode blocks the first two for the whole session, pauses the fourth, and shows a banner while it is on.

Android’s own backup

The app currently allows Android’s system backup. If you have backup switched on in your Android settings, Android may copy this app’s data, including your saved scripts, into your own Google account backup so a new device can restore it. That transfer is performed by Android, not by this app, and it is covered by Google’s privacy policy. You can stop it by turning off backup for this app in your device settings. Nothing in this app sends your code anywhere else.

Permissions, and why each one exists

• Internet. For the situations listed above.
• Network state. The crash reporter checks for a connection before it sends a report.
• Foreground service, special use. Keeps your own program running when the screen turns off, so a long calculation is not killed, and runs a saved script for the home-screen widget.
• Notifications. Shows the notice that appears while one of those long runs is going.

Children

Python Shell is a programming tool for students and general audiences aged 13 and over. It is not directed at children under 13, and the information described above does not include anyone’s name, contact details or anything they write.

Changes to this policy

If this changes, the updated policy will be published at this address with a new date at the top, and a material change will be described in the app’s release notes. Version 1.0.6 added the optional usage data and crash reports described above.

Contact

Questions about privacy in this app: [email protected]