Loading page
Last updated: October 13, 2026
What changed on September 13 and 14, 2026: our AI features now run on Amazon Bedrock, which processes AI data in the United States and does not give it to the model developers. OpenAI is used only to transcribe audio. We also state plainly that we do not use your content to train AI models.
Welcome to AlgoArena ("we," "our," or "us"). We are committed to protecting your personal information and your right to privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our competitive coding, classroom, and assessment platform at https://algoarena.net. By using the platform, you agree to the practices described below.
When you create an account, we collect:
Authentication, including password hashing and our optional anonymous guest sign-in (used to join a classroom without an account), is handled by Firebase Authentication. We never see or store your password in plaintext.
You may optionally provide:
We automatically collect data about your coding activity:
During competitive activities we collect:
During all coding activities (including battles, practice, puzzles, interviews, classroom quizzes, and online assessments), we automatically collect detailed keystroke timing and code-editing patterns for anti-cheat and research:
This data is linked to your user ID and is used for platform improvement, anti-cheat detection, and research into coding behaviors.
Automated integrity and fair-play signals. We derive automated, deterministic integrity signals from the data above (for example, typing-pattern anomalies, paste detection, tab and focus signals, and solve-time checks). These can affect outcomes: in ranked play we may decline to award rating for a win that is solved implausibly fast or that exceeds a daily fair-play limit; in assessments we may surface an integrity flag for the hiring company to review. These signals are advisory inputs for fair-play and human review. They are not the sole basis for any hiring or disciplinary decision, and you may contact us to question a flag that affected you.
When you use AI features, we collect and process:
The Rena-guided copilot available during online assessments is not stored in our database; each chat request is processed and then discarded. To generate a reply, we send the inference provider (AWS Bedrock) a short evidence summary of the session (such as candidate name, score, and activity counts) together with the most recent few chat messages.
Agentic assessments operate differently. Candidate-visible agent conversations, tool calls, approvals, file changes, and related workspace evidence are saved with the assessment session so the administering hiring organization can review and replay the candidate's process. The assessment discloses that retention before the candidate starts.
When a classroom quiz is hosted or joined, we store, in the session document:
Three more kinds of record are created for a session and linked to it by its session ID: the keystroke log described in Section 2.5 for each coding question a student works on; for coding questions judged on our servers, the test results of each run; and, for a Build with AI round, the student's workspace and its activity log. Session reports (debriefs) are computed from the session record when the host opens them; we do not store a separate copy.
Guests can take part in classrooms, battles, and other activities without an account. If a guest later creates an account, the activity generated as a guest (such as match history, ranked Elo, and the keystroke data described in Section 2.5) is migrated onto the new account.
Classroom session data is only visible to the host of that session. During the session a student sees their own answers, the live leaderboard, and each question's result summary. Other students' submitted code and drawings are shown only to the host. The host can view or export (CSV or PDF) a session from its debrief page and can delete it from the Recent sessions list on the classroom dashboard. Section 6 says what a deletion removes.
AI grading. On the paid Classroom plans, a hand-drawn whiteboard answer is graded by an AI vision model, and a Build with AI answer by an AI model reading the submitted code. For a drawing we send the grader the drawing image, the question text, and the instructor's reference image if there is one; for a build, the submitted code, the question, and the instructor's rubric. We do not send the student's name, display name, email address, or account identifier. The grader runs on Amazon Bedrock inside our AWS environment (see Sections 4.2 and 6). Instructors can turn AI grading off in the quiz builder's settings; sessions and assignments created while it is off send nothing to an AI grader and are graded by the instructor.
For candidates taking an OA, and for companies administering one, we collect:
Webcam proctoring is configured by the company or institution administering the assessment and only runs after you grant camera access in your browser. Company administrators can see their own candidates' submissions, transcripts, and proctoring snapshots. We do not share your OA activity with other companies.
We store preferences such as:
We automatically collect:
Payment processing is handled by Stripe. We do not store your full credit card information on our servers. We store your Stripe customer ID, subscription tier, billing status, and the metadata Stripe returns via webhook. Stripe's privacy policy governs the handling of your payment information.
We collect and store:
If you participate in the referral program, we store your referral code, your referral count, reward status, and the signup IP address of each referred account. IP addresses are used solely to prevent self-referral and other abuse.
When analytics is on (Section 8), we record how you use AlgoArena: the pages you visit, clicks, scrolling, when you use a form (but not what you type), repeated or unanswered clicks, and session recordings of the page. A session recording shows what was on your screen and what you did, so it can include code, chat, and other text shown on the page. Anything typed into a form field, including passwords, is hidden in recordings, and payment details are entered on Stripe's page, which is never recorded. We also record browser console errors, which requests a page made and how long they took (not their contents), drawings on a canvas, how fast each page loads, what you type into the problem search, where on a page people click and scroll, your approximate location from your IP address, and the website or campaign that sent you, including the email a link came from. While you are signed in this is linked to your account. We use it to understand how AlgoArena is used and to improve and personalize it. Assessment candidates and classroom students are never recorded: those pages are left out, and on classroom pages only a signed-in teacher is recorded.
We also collect a set of product events such as feature use, signup attribution, checkout starts, matchmaking, builder publishing, recruiter activation, and AI-model performance (model and provider, input mode, prompt and response length, latency, and token counts, but not the prompt or response itself). This also includes classroom usage (for example, quiz creation, session hosting, and AI-grading toggles, but never student answers, code, or drawings) and steps in the assessment funnel (for example, assessment started, submitted, or reviewed). These funnel events are separate from the retained candidate evidence described in Sections 2.8 and 6, carry no candidate or student identity, and are never shared with the administering company. Events used to understand an account-level funnel or model performance may include your account ID; other events are stored without it. We also send product events to Mixpanel, our analytics provider (Section 4.2). Assessment-candidate and classroom-student events are not sent to it. The candidate practice walkthrough uses a fresh, memory-only run ID and includes no direct account, candidate, session, assessment, or company identifier. Its server receipt time means it should still be treated as minimized pseudonymous analytics rather than guaranteed anonymous data.
Product events use fixed, allowlisted fields. Apart from problem search terms, they do not contain prompts, source code, assessment answers, message content, email addresses, passwords, or take tokens. Session recordings are different, as described above. Section 8 explains when analytics starts and how to turn all optional analytics off.
We use your information to:
We do not sell your personal information. We may share information with service providers that help us operate the platform, and with other users where the feature is inherently public. Key providers:
Your username, profile picture, ranked Elo, battle history, and aggregate coding statistics are visible on leaderboards and your public profile. Your public profile also shows a badge if you are on a Pro or Ultimate plan. Classroom session data, OA submissions, and private chats are not made public.
You appear on the public leaderboards once you finish a ranked battle. To be left off, turn off Show me on leaderboards in Settings, under Privacy. Your rating still counts, and only you see your rank.
Accepted practice and battle submissions may also be used as async ghost races. Ghost opponents show race progress while active; stored replay and final-solution details may be shown after another user attempts or races that ghost.
Firebase / Google Cloud Platform
Authentication (including anonymous guest auth for classroom joins), Firestore, Cloud Functions, Cloud Storage (avatars, OA explain videos), and Cloud Messaging.
Data shared: all persisted user data, uploaded files, device tokens.
Stripe
Payment processing for subscriptions and webhook events.
Data shared: email, name, payment information (handled directly by Stripe).
SendGrid (Twilio)
Transactional email, verification links, contact-form delivery, newsletters, and classroom and OA invitation emails.
Data shared: email address, name, message bodies, preferences.
Hermes (tryhermes.dev)
Lifecycle and re-engagement email automation (onboarding, retention nudges, and product updates).
Data shared: email address, name, and engagement signals used to time and personalize messages.
OpenAI
Whisper speech-to-text for audio recorded in mock interview and "Vibe" flows, for OA explain videos, and for recorded answers to follow-up questions. This is the only direct use of OpenAI. OpenAI states that data sent to this service is not used to train its models. OpenAI models used for chat and code run on Amazon Bedrock (see below).
Data shared: recorded audio, explain-video files, and follow-up answer recordings sent for transcription.
Amazon Polly (AWS)
Text-to-speech for the AI interviewer voice (runs inside AWS).
Data shared: interviewer line text.
Serper (Google Search)
Web search tool used by AI features to ground answers.
Data shared: the search query issued by the AI on your behalf.
Google Cloud Vision (Safe Search)
Automated moderation of uploaded images.
Data shared: the image being moderated.
OneCompiler (via RapidAPI)
Code execution engine used across battles, practice, classroom, and OA (replaces earlier Judge0 integration).
Data shared: submitted code, stdin, expected output, and language.
GitHub OAuth
Optional sign-in and linking to a GitHub account.
Data shared: OAuth authorization code for token exchange. The resulting access token is stored server-side.
Redis (managed)
Low-latency queues for realtime matchmaking and Puzzle Rush pairing.
Data shared: user ID and ephemeral matchmaking state.
Vercel Analytics
Cookie-free website usage analytics used to understand aggregate traffic and improve the service. It is not used for advertising, cross-site tracking, individual profiles, or hiring decisions.
Data shared: redacted page or route, referral source, event time, approximate location, browser, operating system, and device type. Dynamic assessment codes, session IDs, usernames, share tokens, URL query strings, submitted content, searches, and prompts are not sent as analytics dimensions.
Mixpanel
Product analytics for feature use and funnels. It runs only when Analytics is on. It is not used for advertising, cross-site tracking, or hiring decisions.
Data shared: the allowlisted product events in Section 2.14 and when they happened. Events linked to an account carry your account ID. Other events carry a random ID stored in your browser. If you create an account or sign in on that browser, we link that ID to your account, so we can see which pages led to signing up. An ID created before October 10, 2026 is never linked. Assessment-candidate and classroom-student events carry no ID and are never linked. When you sign in, Mixpanel's browser code also sends your account ID, its own random browser ID, and your browser, operating system, device type, and screen size. Since October 13, 2026 it also receives the page views, clicks, scrolling, form use, session recordings, console errors, and IP-based location described in Section 2.14, and the page address with identifiers and query strings removed except campaign tags. Assessment candidates and classroom students are never recorded.
Amazon Bedrock (AWS)
Runs the AI models behind Rena, AI chat, hints, code analysis and grading, quiz generation, the AI interviewer, the builder's AI agents, and AI features in online assessments. The models come from developers such as Anthropic (Claude), DeepSeek, Moonshot AI (Kimi), MiniMax, Z.AI (GLM), OpenAI (GPT and gpt-oss), xAI (Grok), Alibaba (Qwen), Mistral AI, Meta (Llama), Google (Gemma), and Amazon (Nova). AWS runs these models itself, in its United States regions. The model developers, including those based outside the United States such as in China, do not receive your data.
Data shared: prompts, code, chat messages, problem and session context, and images sent for AI grading or chat.
AWS Rekognition and Sightengine
Additional automated image-moderation providers used alongside Google Cloud Vision.
Data shared: the image being moderated.
WorkOS
Enterprise single sign-on (SAML/OIDC) for individually configured assessment partners.
Data shared: SSO credentials and company identity and connection metadata.
Cloudflare Turnstile
Bot and CAPTCHA verification on certain invitation and billing flows.
Data shared: a verification token and IP address.
Cal.com
Optional scheduling embed for booking a demo or meeting (only where enabled).
Data shared: contact information you provide for a calendar invitation.
Each of these providers has its own privacy policy. We encourage you to review them.
AI training: our AI models run on Amazon Bedrock. AWS states that it does not share your prompts or the model's outputs with the model developers, and that neither AWS nor the developers use them to train models. For some models, AWS may keep requests that its automated checks flag for up to 30 days to detect abuse, and it does not share those with the developer either. We send OpenAI only audio to transcribe, and OpenAI states that it does not use data sent to its API to train its models. We do not use your content to train AI models either.
We use Vercel Web Analytics for cookie-free, redacted page measurement. We record the product events described in Section 2.14 ourselves and send a copy to Mixpanel, which also records the page views, clicks, and session recordings described there. All of it is controlled by the single Analytics choice described in Section 8. We do not sell analytics data or use it for advertising, cross-site tracking, or automated hiring decisions.
We may disclose information if required by law or in response to valid requests by public authorities, court orders, or legal process.
We use industry-standard technical and organizational measures to protect personal information, including TLS in transit, Firebase security rules, server-side admin enforcement for sensitive reads, and redaction of submitted code from non-host callers of classroom endpoints. No method of internet transmission or electronic storage is 100% secure; while we work hard to protect your information, we cannot guarantee absolute security.
We retain information for as long as your account is active or as needed to provide the service. Some categories, including behavioral, keystroke, anti-cheat, audit, and match data, are retained indefinitely, including after you delete your account, for integrity, security, research, and product-improvement purposes. Specific retention rules include:
You can request deletion of your account and associated data at any time as described below (subject to the legal and anti-cheat exceptions noted in Section 7). To have us action a deletion on your behalf, email contact@algoarena.net.
You have the following rights regarding your personal information:
To exercise these rights, email us at contact@algoarena.net. We will respond within 30 days.
AlgoArena uses the following browser storage and measurement technologies:
In the European Economic Area, United Kingdom, and Switzerland, Analytics remains off unless you select "Allow Analytics." If we cannot determine your country, we use the same prior-consent approach. In other known regions where applicable law permits limited statistical measurement without prior opt-in, optional analytics starts by default, and a first-visit notice provides a one-click opt-out. An explicit choice is stored in browser storage and a necessary first-party preference cookie so both browser and server-written analytics obey it on later visits. Selecting "Continue Without Analytics," using "Turn Off Analytics," or withdrawing permission stops all future Vercel and product analytics, including what we send to Mixpanel. Essential storage remains active. Analytics IDs already in your browser stay there until you clear this site's data. Where prior consent is required, we ask visitors who opted in to renew that permission after six months; an opt-out remains stored unless the visitor changes it. If a browser blocks every preference-storage method, the current page stops browser analytics immediately, but the choice cannot be reliably remembered or communicated to later requests until preference storage is permitted.
Analytics is not used for advertising, cross-site tracking, or automated recruitment decisions. We strip query strings, except campaign tags, and replace dynamic account, candidate, assessment, session, invite, and share identifiers with generic route placeholders before a page address is sent. If you accepted Analytics before October 13, 2026, we collect only what that choice covered, with no session recordings, clicks, or location, until you choose again.
Turning off optional analytics does not disable service records required for security and abuse prevention, billing and quota enforcement, gameplay, account operation, or candidate assessment delivery and review. Those records serve separate operational purposes described elsewhere in this policy.
You can also configure your browser to refuse essential cookies or browser storage, but some features, particularly sign-in and personalized settings, may not work.
The platform is not intended for children under 13. We do not knowingly collect personal information from children under 13; if you believe we have, please contact us immediately, and we will delete it. Educators who use Classroom Mode with students under 13 are responsible for obtaining appropriate parental consent in their jurisdiction (e.g., COPPA in the United States) and for complying with applicable school record laws (such as FERPA). We use student information only to provide the service to the school or educator. We do not sell it, and neither we nor our AI providers use it to train AI models. If a school wishes to require a data-processing addendum, please contact us.
Your information may be transferred to and processed in countries other than your country of residence (including the United States), which may have different data-protection laws. When we transfer the personal data of users in the European Economic Area, the United Kingdom, or Switzerland to a country without an adequacy decision, we rely on recognized legal transfer mechanisms, in particular the European Commission's Standard Contractual Clauses (together with the UK International Data Transfer Addendum and the Swiss equivalents, where applicable), as incorporated into the data-processing agreements we have with our cloud and AI providers (including Google, AWS, OpenAI, Vercel, and Mixpanel).
We may update this Privacy Policy from time to time. We will update the "Last updated" date and, for material changes, provide additional notice. You are encouraged to review this page periodically.
If you have any questions about this Privacy Policy, please contact us:
Email: contact@algoarena.net
Website: https://algoarena.net