Security

Your Kaggle key stays yours

Your key is checked with Kaggle, then encrypted before it is stored, with a secret kept apart from the database. It is used only to act for you on Kaggle.

Checked with Kaggle once, then encrypted with AES-256-GCM before it is stored. A copy of the database alone holds no usable key.
Each account sees only its own projects, files and runs.
Revoke the key on Kaggle and it stops working here straight away.
Your code runs on Kaggle, in your account, on your own quota.

You sign in with Google or GitHub
Firebase confirms who you are. We never see that password.
You paste your kaggle.json
Your Kaggle username and API key, typed or pasted.
Kaggle confirms it, once
A wrong or revoked key is refused before anything is saved.
Encrypted before it is stored
AES-256-GCM, with a secret kept apart from the database.

What it does with your key

The whole list. A key that can do anything is worth saying little about, so here is every call Caudex Studio makes with yours.

Check the key: Once, when you connect it, and again if Kaggle starts refusing it.
Read your weekly quota: The GPU and TPU hours Kaggle says you have left, for the dashboard.
Push a notebook version: Pressing Run sends your code to Kaggle as a new version of a notebook in your account.
Read a run's status and log: While it runs, and after, so the page can show what Kaggle is doing.
List and download a run's outputs: The file names and sizes for the Outputs tab; a download goes straight from Kaggle to you.
Search datasets and read their file lists: So you can attach one to a project and the template knows what is in it.
Create or delete a dataset: Only one you upload through Caudex Studio, and only when you ask for it.

And what it never does

Reads or writes anything in your Kaggle account that these calls do not cover.
Enters a competition, votes, comments or follows anyone as you.
Shares your key with any other service, or shows it back to you once it is stored.
Trains anything on your data, or looks at it beyond listing what a dataset contains.

When it acts without you watching

Once, and it is worth being plain about it, because it is the only time Caudex Studio uses your key while you are away.

Caudex Studio pushes the next session of a training you started, once a day, on a schedule.

Kaggle ends a session at 12 hours and keeps nothing when it does. A training longer than that would lose everything, so the templates stop at 11 hours with the checkpoint saved, and the next session starts without you opening the page.

It only ever continues a run you started, only until the epochs you asked for are done, and never past a limit on the number of sessions. When your week’s GPU hours are too low to fit another session it waits for Kaggle’s reset rather than starting one that would be cut off. The project page shows which session it is on, and Stop continuing ends it for good.

Where your things are

What is held, and where it sits.

Your Kaggle key: Encrypted in the app's database, with the encryption secret held outside it.
Your code and settings: In the app's database, and on Kaggle as a notebook version each time you run.
Your run history: In the app's database: status, timings, quota used. The log and outputs stay on Kaggle and are read when you open them.
Your datasets: On Kaggle, in your account. Caudex Studio holds no copy.
Your sign-in: With Google Firebase. Caudex Studio stores the account it returns, not a password.

Who else is involved

Kaggle (Google LLC): Runs your code, holds your notebooks, datasets and outputs.
Google Firebase: Sign-in with Google or GitHub.
Neon: The Postgres database behind the app.
Vercel: Hosting.
Paddle: Card payments, as reseller of record.
SSLCommerz: bKash, Nagad, Rocket and card payments in taka.

The privacy policy has what each one receives and why. A security question, or something that looks wrong? Write to mdsohanurislamshuvo@gmail.com.

Your next training run is one click away.

Start your free trial Read the FAQ