Replit Privacy Policy

Last updated: 05/12/2023 to update corporate address and add US state updates

Replit, Inc. and its affiliates (“Replit,” “we,” “our,” and/or “us”) value the privacy of individuals who use our website and related services (collectively, our “Services”). This privacy policy (the “Privacy Policy”) explains how we collect, use, and share information from or about you or your device as you use the Services. By using our Services, you agree to the collection, use, disclosure, and procedures this Privacy Policy describes. If you are an entity customer located in the European Economic Area (“EEA”), Switzerland or the United Kingdom, you also agree to be bound by the Data Processing Agreement (“DPA”) at https://repl.it/site/dpa. If you are a Local Educational Agency in the United States, you also agree that our U.S. Student Data Protection Addendum applies and is incorporated herein by reference. Beyond the Privacy Policy, your use of our Services is also subject to our Terms of Service.

Information We Collect

We may collect a variety of information from or about you or your devices from various sources, as described below.

If you do not provide your information when requested, you may not be able to use some or all of our Services if that information is necessary to provide you with our Services or if we are legally required to collect it.

A. Information You Provide to Us.

Registration and Profile Information. When you register for an account, we ask you for your email address and may also request your phone number. If you sign up using a social media account, we will also receive information from those social media services such as your name, email address, and profile photo, in accordance with your privacy settings on those social media services.

Payment Information. When you add a credit card or payment method to your account a third-party service provider that handles payments on our behalf will receive and process your payment card information.

Communications. When you communicate with us, we may receive additional information about you. For example, when you communicate with our Customer Support Team, we will receive your name, email address, phone number, the contents of a message or attachments that you may send to us, and other information you choose to provide. If you subscribe to our newsletter, then we will collect certain information from you, such as your email address. When we send you emails, we may use technologies such as web beacons to track whether you open them to learn how to deliver a better customer experience and improve our Services.

Careers. If you apply for a job with us, you may submit your contact information and your resume online. We will collect the information you choose to provide on your resume, such as your education and employment experience. For job applicants who reside in California, these supplementary conditions apply.

B. Information We Collect Automatically When You Use Our Services.

When you use the Services, we use a variety of electronic tools, such as cookies, pixel tags, and similar technologies (collectively referred to in this Privacy Policy as “cookies”) to automatically generate information about how you use and interact with the Services as discussed in this section.

What are Cookies? Cookies are small files of letters and numbers that we store on your browser or the hard drive of your computer, or small graphic images placed on web pages or in emails. They can be stored either for a single browser session or more permanently. We use cookies to collect information about your browsing activities, distinguish you from other users, provide functionality, and analyze use of the Services. Our third-party partners, such as analytics and advertising partners, may use these technologies to collect information about your online activities over time and across different services. The types of cookies we and third parties may use to collect information are as follows:

• Strictly necessary cookies. Some cookies are strictly necessary to make the Services available to you. We cannot provide you with the Services without this type of cookies.
• Functional cookies. These are used to recognize you when you return to the Services. This enables us to adapt our content for you, and remember your preferences (for example, your choice of language or region).
• Analytical or Performance cookies. We also use cookies for analytics purposes in order to operate, maintain and improve our Services. We may use our own analytics cookies or use third party analytics providers such as Google Analytics to collect and process certain analytics data on our behalf. These providers may also collect information about your use of other websites, apps, and online resources. You can opt out of Google Analytics by installing Google’s browser plug-in located here.

You can find more information about your rights and choices, and how to block the use of certain cookies in the section Your Rights and Choices below.

What information do we automatically collect as you use the Services?

Device Information. We receive information about the device and software you use to access our Services, including internet protocol (IP) address, Internet Service Provider, web browser type, operating system version, phone carrier and manufacturer, application installations, device type and identifiers, and mobile advertising identifiers.

Location Information. We may infer your general location information from other information we collect from and about you (for example, your IP address may indicate your general geographic region). We do not collect precise geolocation data.

Usage Information. To help us understand and analyze how you use our Services and to help us improve them, we automatically receive information about your interactions with our Services, like the pages or other content you view or interact with, the searches you conduct, your comments, any content you enter or post, commands you type, and the dates and times of your visits.

C. Information We Receive from Third Parties.

Information from third party services. If you choose to link our Services to a third-party account, we may receive information about you, including your profile information and your photo, and your use of the third-party account, in accordance with your settings on such third-party account. If you wish to limit the information available to us, you should visit the privacy settings of your third-party accounts to learn about your options.

Other third parties. We may receive additional information about you, such as demographic data, from third parties such as data or marketing partners and combine it with other information we have about you.

How We Use the Information We Collect

We use the information we collect:

• To provide, maintain, improve, and enhance our Services;
• To communicate with you, provide you with updates and other information relating to our Services, provide information that you request, respond to comments and questions, and otherwise provide customer support;
• To facilitate the connection of third-party services or applications, such as social networks;
• For marketing purposes, such as developing and providing promotional and advertising materials that may be useful, relevant, valuable or otherwise of interest to you;
• To personalize your experience on our Services such as presenting tailored content;
• To facilitate transactions and payments;
• To detect and prevent fraud, and respond to trust and safety issues that may arise;
• For compliance purposes, including enforcing our Terms of Service or other legal rights, or as may be required by applicable laws and regulations or requested by any judicial process or governmental agency; and
• For other purposes for which we provide specific notice at the time the information is collected.

De-Identified Information. Please note that we may de-identify the information we collect from and about you so that it can no longer be reasonably linked to you or your device. Once information has been de-identified in this way, we can use and share it for any purpose in our discretion, and this Privacy Policy no longer applies to such information.

Your Privacy Obligations

Replit provides you with the ability to publish content that could be used to collect personally identifiable information from its users. If you publish such content, it is your responsibility to understand your legal obligations and to comply with all applicable laws, including:

• Providing your users with appropriate notices of their privacy rights, which should incorporate this Privacy Policy by reference.
• Obtaining any necessary consent from your users for the processing, storage, use, and transfer of any of their personally identifiable information that you collect.
• If applicable, providing any required notices and obtaining any required verifiable parental consent under the Children’s Online Privacy Protection Act (COPPA) or similar laws.
• Complying with your legal obligations to allow your users to correct their personally identifiable information or to have it erased.

Legal Bases for Processing Information

Various global privacy laws (such as those in the European Economic Area, United Kingdom, and Brazil) require that we have a “legal basis” to process your information. The legal bases on which we rely to process your information include:

• Consent. You have consented to the use of your information, for example, where legally required, to send you marketing communications.
• Contractual necessity. We need your information to provide you with the Services, for example to facilitate your registration and respond to your inquiries.
• Compliance with a legal obligation. We have a legal obligation to use your information, for example to comply with tax and accounting obligations.
• Legitimate interests. We have a legitimate interest in using your information for a business purpose that does not override your individual rights and interests. For example, we have a legitimate interest in using your information for product development and internal analytics purposes, to improve the accuracy of our machine learning technologies such as code generation, and otherwise to improve the safety, security, and performance of our Services.

How We Share the Information We Collect

We share information with the following categories of third parties.

Affiliates. We may share any information we receive with our corporate affiliates under common ownership or control for any of the purposes described in this Privacy Policy.

Service Providers. We may share any information we receive with vendors retained in connection with the provision of our Services and that process your information on our behalf. These entities may include analytics, billing, legal support, marketing, security, machine learning, and fraud prevention companies.

Other Users and Individuals. Our Services are social services in which you can find, collaborate on, and share content. Your profile, including your name, user name, profile picture, code, and other profile information (but not your email address or phone number) will always be viewable and searchable by other users and search indexed by online search engines. The content you post to the Services, including your code and forum posts, will be displayed on the Services and viewable by other users by default. The “Your Preferences” section of this Privacy Policy describes the controls that you can use to limit the sharing of your code. We are not responsible for the other users’ use of available information, so you should carefully consider whether and what to post or how you identify yourself on the Services. Please note that student profiles created by teachers using Teams for Education and students’ code are never publicly viewable or searchable, and students may not post content on publicly viewable forums.

Third Party App Integrations. If you connect a third-party application to our Services, we may share information such as code with that third party.

As Required by Law and Similar Disclosures. We may access, preserve, and disclose your information if we believe in good faith that doing so is required or appropriate to: (a) comply with law enforcement requests and legal process, such as a court order or subpoenas; (b) respond to your requests; or (c) protect your, our, or others’ rights, property, or safety. For the avoidance of doubt, the disclosure of your information may occur if you post any objectionable content on or through the Services.

Merger, Sale, or Other Asset Transfers. We may disclose and transfer your information to service providers, advisors, potential transactional partners, or other third parties in connection with the consideration, negotiation, or completion of a corporate transaction in which we are acquired by or merged with another company or we sell, liquidate, or transfer all or a portion of our business or assets.

Consent. We may also disclose information from or about you with your permission.

Your Rights and Choices

Sharing Preferences. If you prefer to not have others see your code, you can upgrade to make that code private. If you import code from GitHub and your repository is public, it will remain public by default on Replit. If you wish to import code from GitHub and your repository is private, you can upgrade to ensure that your code will also remain private on Replit.

Marketing Communications. You can unsubscribe from our promotional emails via the link provided in the emails. Even if you opt-out of receiving promotional messages from us, you will continue to receive administrative messages from us.

How to Block Cookies. You can change your browser settings to block, disable, or notify you when you receive a Cookie, delete Cookies, or browse our Services using your browser’s anonymous usage setting. However, if you use your browser settings to block all Cookies (including essential Cookies) you may not be able to access all or parts of our Services, or some portions of the Services may not function properly.

Your European Privacy Rights. If you are located in the European Economic Area or the United Kingdom, you have the additional rights described below.

• You may request access to the information we maintain about you, update and correct inaccuracies in your information, restrict or object to the processing of your information, have the information anonymized or deleted, as appropriate, or exercise your right to data portability to easily transfer your information to another company (where technically feasible). In addition, you also have the right to lodge a complaint with a supervisory authority, including in your country of residence, place of work or where an incident took place.
• You may withdraw any consent you previously provided to us regarding the processing of your information, at any time and free of charge. We will apply your preferences going forward and this will not affect the lawfulness of the processing before you withdrew your consent.

You may exercise these rights by contacting us using the contact details at the end of this Privacy Policy. Before responding to your request, we may ask you to provide reasonable information to verify your identity. Please note that there are exceptions and limitations to each of these rights, and that while any changes you make will be reflected in active user databases instantly or within a reasonable period of time, we may retain information for backups, archiving, prevention of fraud and abuse, analytics, satisfaction of legal obligations, or where we otherwise reasonably believe that we have a legitimate reason to do so.

Third Parties

Our Services may contain links to other websites, products, or services that we do not own or operate. We are not responsible for the privacy practices of these third parties. Please be aware that this Privacy Policy does not apply to your activities on these third-party services or any information you disclose to these third parties. We encourage you to read their privacy policies before providing any information to them.

Retention

We take measures to delete your information or maintain it in a de-identified form when it is no longer necessary to be kept in identifiable form for the purposes for which we process it, unless we are required by law to keep this information for a longer period. When determining the specific retention period, we take into account various criteria, such as the type of service provided to you, the nature and length of our relationship with you, and mandatory retention periods provided by applicable law and any statute of limitations. When you request to delete your account, we delete your data within 30 days.

Security

We use a variety of technical, organizational, and physical safeguards designed to safeguard the information we maintain. However, as our Services are hosted electronically, we can make no guarantees as to the security or privacy of your information.

Children’s and Students’ Privacy

Our Services are directed to a general audience and are not directed to children under the age of 13. By agreeing to our Privacy Policy and Terms of Service, you represent that you are allowed to use our Services according to your country’s applicable age limits. If we learn that a child is under the age of 13 in the United States, or is under the applicable age requirement in another jurisdiction, we will take reasonable steps to obtain parental consent or delete the user’s personal information from our files as soon as is practicable. Please contact us at [email protected] if you believe that a user has provided us with representations in violation of this Privacy Policy.

COPPA compliance

Under our free Teams for Education product, we offer verified educators the opportunity to create limited Replit accounts for students who are under the age of 13, by creating a private invite link for these students. When an account is created using this private invite link, we do not collect personal information from the account holder such as their name or email address, but only a username that does not include their real name, and persistent identifiers such as IP address and cookie data to support the internal operations of our Services. For more information, see this blog post.

FERPA compliance

FERPA protects “personally identifiable information” contained in students’ education records from unauthorized disclosure. Consistent with FERPA, we will use education records, as defined under FERPA, for the purpose of providing agreed services to a school, school district or teacher. We use or share FERPA-protected information only as directed or permitted by the school, school district, teacher, or under FERPA. If a parent or eligible student requests access to education records that are hosted on our servers, we will help facilitate such access. For more information, see our U.S. Student Data Protection Addendum and our Student Privacy Notice.

Notice at collection

The following table summarizes the categories of “personal information” (as defined under relevant state laws cited below) that we collect from and about you, the purposes for which we use each category, and the third parties to which we share each category for a business purpose. Please find this information in the following chart and see the various sections above in this Privacy Policy for more information on each category.

Additional information for California residents

If you are a California resident, the California Consumer Privacy Act (“CCPA”) requires us to provide you with a summary of the categories of “personal information” (as defined under the CCPA) that we collect from and about you, the purposes for which we use each category, and the third parties to which we share each category for a business purpose. You may find this summary in the section “Notice at collection” above.

If you are a California resident, you may exercise the following rights with regard to data where we determine the purposes and means of processing:

• The right to request a copy of the personal information that we have collected about you in the prior 12 months.
• The right to request details about the categories of personal information we collect, the categories of sources, the business or commercial purposes for collecting information, and the categories of third parties with which we share information.
• The right to request deletion of the personal information that we have collected about you, subject to certain exemptions.
• The right to opt out of the sale of your personal information. We do not “sell” personal information as such term is defined in the CCPA.
• The right to opt out from profiling, defined as the automated processing of personal information to assess or forecast aspects of your behavior.
• The right to request us to correct errors in the personal information that we hold about you.

California residents can submit access and deletion requests by emailing us at [email protected]. California residents can also request that we delete your information through your account settings. You have the right not to receive discriminatory treatment for the exercise of your CCPA privacy rights, subject to certain limitations.

An authorized agent may submit an access or deletion request on your behalf by sending a written authorization signed by you to [email protected]. We may still require you to directly verify your identity and confirm that you provided the authorized agent permission to submit the request.

Additional information for Colorado residents

If you are a Colorado resident, the Colorado Privacy Act (“CPA”) requires us to provide you with a summary of the categories of “personal information” (as defined under the CPA) that we collect from and about you, the purposes for which we use each category, and the third parties to which we share each category for a business purpose. You may find this summary in the section “Notice at collection” above.

If you are a Colorado resident, you may exercise the following rights with regard to data where we determine the purposes and means of processing:

• The right to request a copy of the personal information that we have collected about you in the prior 12 months. We will not charge a fee for up to two requests per year.
• The right to request details about the categories of personal information we collect, the categories of sources, the business or commercial purposes for collecting information, and the categories of third parties with which we share information.
• The right to request deletion of the personal information that we have collected about you, subject to certain exemptions.
• The right to opt out of the sale of your personal information. We do not “sell” personal information as such term is defined in the CPA.
• The right to opt out from profiling, defined as the automated processing of personal information to assess or forecast aspects of your behavior.
• The right to request us to correct errors in the personal information that we hold about you.
• The right to appeal if we decline a request that you have made.

Colorado residents can submit access and deletion requests by emailing us at [email protected]. California residents can also request that we delete your information through your account settings. You have the right not to receive discriminatory treatment for the exercise of your CPA privacy rights, subject to certain limitations.

An authorized agent may submit an access or deletion request on your behalf by sending a written authorization signed by you to [email protected]. We may still require you to directly verify your identity and confirm that you provided the authorized agent permission to submit the request.

Additional information for Connecticut residents

If you are a Connecticut resident, the Connecticut Data Privacy Act (“CDPA”) requires us to provide you with a summary of the categories of “personal information” (as defined under the CDPA) that we collect from and about you, the purposes for which we use each category, and the third parties to which we share each category for a business purpose. You may find this summary in the section “Notice at collection” above.

If you are a Connecticut resident, you may exercise the following rights with regard to data where we determine the purposes and means of processing:

• The right to request a copy of the personal information that we have collected about you in the prior 12 months. We will not charge a fee for up to one request per year.
• The right to request details about the categories of personal information we collect, the categories of sources, the business or commercial purposes for collecting information, and the categories of third parties with which we share information.
• The right to request deletion of the personal information that we have collected about you, subject to certain exemptions.
• The right to opt out of the sale of your personal information. We do not “sell” personal information as such term is defined in the CDPA.
• The right to opt out from profiling, defined as the automated processing of personal information to assess or forecast aspects of your behavior.
• The right to request us to correct errors in the personal information that we hold about you.
• The right to appeal if we decline a request that you have made.

Connecticut residents can submit access and deletion requests by emailing us at [email protected]. Connecticut residents can also request that we delete your information through your account settings. You have the right not to receive discriminatory treatment for the exercise of your CDPA privacy rights, subject to certain limitations.

An authorized agent may submit an access or deletion request on your behalf by sending a written authorization signed by you to [email protected]. We may still require you to directly verify your identity and confirm that you provided the authorized agent permission to submit the request.

Additional information for Iowa residents

If you are an Iowa resident, the Iowa Consumer Data Protection Act (“ICDPA”) requires us to provide you with a summary of the categories of “personal information” (as defined under the ICDPA) that we collect from and about you, the purposes for which we use each category, and the third parties to which we share each category for a business purpose. You may find this summary in the section “Notice at collection” above.

If you are an Iowa resident, you may exercise the following rights with regard to data where we determine the purposes and means of processing:

• The right to request a copy of the personal information that we have collected about you in the prior 12 months. We will not charge a fee for up to two requests per year.
• The right to request details about the categories of personal information we collect, the categories of sources, the business or commercial purposes for collecting information, and the categories of third parties with which we share information.
• The right to request deletion of the personal information that we have collected about you, subject to certain exemptions.
• The right to opt out of the sale of your personal information. We do not “sell” personal information as such term is defined in the ICDPA.
• The right to opt out from profiling, defined as the automated processing of personal information to assess or forecast aspects of your behavior.
• The right to appeal if we decline a request that you have made.

Iowa residents can submit access and deletion requests by emailing us at [email protected]. Iowa residents can also request that we delete your information through your account settings. You have the right not to receive discriminatory treatment for the exercise of your ICDPA privacy rights, subject to certain limitations.

An authorized agent may submit an access or deletion request on your behalf by sending a written authorization signed by you to [email protected]. We may still require you to directly verify your identity and confirm that you provided the authorized agent permission to submit the request.

Additional information for Utah residents

If you are a Utah resident, the Utah Consumer Privacy Act (“UCPA”) requires us to provide you with a summary of the categories of “personal information” (as defined under the UCPA) that we collect from and about you, the purposes for which we use each category, and the third parties to which we share each category for a business purpose. You may find this summary in the section “Notice at collection” above.

If you are a Utah resident, you may exercise the following rights with regard to data where we determine the purposes and means of processing:

• The right to request a copy of the personal information that we have collected about you in the prior 12 months. We will not charge a fee for up to one request per year.
• The right to request details about the categories of personal information we collect, the categories of sources, the business or commercial purposes for collecting information, and the categories of third parties with which we share information.
• The right to request deletion of the personal information that we have collected about you, subject to certain exemptions.
• The right to opt out of the sale of your personal information. We do not “sell” personal information as such term is defined in the UCPA.

Utah residents can submit access and deletion requests by emailing us at [email protected]. Utah residents can also request that we delete your information through your account settings. You have the right not to receive discriminatory treatment for the exercise of your UCPA privacy rights, subject to certain limitations.

An authorized agent may submit an access or deletion request on your behalf by sending a written authorization signed by you to [email protected]. We may still require you to directly verify your identity and confirm that you provided the authorized agent permission to submit the request.

Additional information for Virginia residents

If you are a Virginia resident, the Virginia Consumer Data Protection Act ("VCDPA") requires us to provide you with a summary of the categories of “personal information” (as defined under the VCDPA) that we collect from and about you, the purposes for which we use each category, and the third parties to which we share each category for a business purpose. You may find this summary in the section “Notice at collection” above.

If you are a Virginia resident, you may exercise the following rights with regard to data where we determine the purposes and means of processing:

• The right to request a copy of the personal information that we have collected about you in the prior 12 months. We will not charge a fee for up to two requests per year.
• The right to request details about the categories of personal information we collect, the categories of sources, the business or commercial purposes for collecting information, and the categories of third parties with which we share information.
• The right to request deletion of the personal information that we have collected about you, subject to certain exemptions.
• The right to opt out of the sale of your personal information. We do not “sell” personal information as such term is defined in the VCDPA.
• The right to opt out from profiling, defined as the automated processing of personal information to assess or forecast aspects of your behavior.
• The right to request us to correct errors in the personal information that we hold about you.
• The right to appeal if we decline a request that you have made.
• Virginia residents can submit access and deletion requests by emailing us at [email protected]. Virginia residents can also request that we delete your information through your account settings. You have the right not to receive discriminatory treatment for the exercise of your VCDPA privacy rights, subject to certain limitations.
• An authorized agent may submit an access or deletion request on your behalf by sending a written authorization signed by you to [email protected]. We may still require you to directly verify your identity and confirm that you provided the authorized agent permission to submit the request.

International Visitors

Our Services are primarily hosted in the United States and may also be hosted in locations abroad (for example, India). If you use the Services from regions of the world with laws governing data processing, you accept that you are transferring your information to the United States and other hosting locations for storage and processing. By providing information to Replit, you agree to such transfer, storage, and processing.

Update Your Information or Pose a Question

You can update your account and profile information or close your account through your profile settings. If you have questions about your privacy on the Services or this privacy policy, please contact us at [email protected].

Changes to this Privacy Policy

We will post any adjustments to the Privacy Policy on this page, and the revised version will be effective when it is posted. If we materially change the ways in which we process information, we will provide you with notice in the application and via email in accordance with applicable legal requirements.

Contact Information

If you have any questions, comments, or concerns about our processing activities, please email us at [email protected] or write to us at 677 Harrison Street, San Francisco, CA 94107.