Privacy Policy

2.1 Account Information

When you create an account, we collect:

• First name and last name
• Email address (verified via an emailed verification link)
• Username (unique identifier; publicly visible)
• Password (hashed; we never store it in plaintext)
• Self-reported skill level (used to set initial ranked Elo)
• Newsletter and notification preferences
• User type and onboarded roles (e.g. student, educator, or recruiter)
• OAuth identifiers if you sign in with Google or GitHub (including a GitHub access token if you link an account for the "Push to GitHub" feature)

Authentication, including password hashing and our optional anonymous/guest sign-in (used to join a classroom without an account), is handled by Firebase Authentication. We never see or store your password in plaintext.

2.2 Profile Information (Optional)

You may optionally provide:

• Profile picture (stored in Firebase Storage)
• Bio (maximum 250 characters)
• Location (city, state, country)
• Social links (GitHub, LinkedIn, personal website)

2.3 Coding Activity Data

We automatically collect data about your coding activity:

• All code submissions (full source code and programming language)
• Test results (passed/failed tests, runtime, memory, compile/runtime errors)
• Problem-solving history and timestamps
• Practice session data and completion times
• Accepted submission replay, timing, and final-code data used for async ghost races and post-attempt comparisons
• AI analysis requests and generated feedback
• Daily challenge streaks, quest/achievement progress, and solved-problem records

2.4 Battle, Tournament, and Puzzle Rush Data

During competitive activities we collect:

• Battle results (win/loss/forfeit/timeout) and full match history
• Ranked Elo changes and rating history
• Opponent information (username, ranked Elo, match outcome)
• Tournament participation, bracket position, and Arena Credit balances
• Puzzle Rush stats and submission records

2.5 Keystroke and Typing Pattern Data

During all coding activities (including battles, practice, puzzles, interviews, classroom quizzes, and online assessments) we automatically collect detailed keystroke timing and code-editing patterns for anti-cheat and research:

• Keystroke timing (milliseconds between key presses)
• Periodic code snapshots
• Typing patterns (speed, pauses, deletions, backspaces)
• Test-run frequency and results
• Syntax errors and debugging patterns
• Typing burst detection (rapid code insertion)
• Window focus / tab-switch signals in applicable sessions

This data is linked to your user ID and is used for platform improvement, anti-cheat detection, and research into coding behaviors.

Automated integrity and fair-play signals. We derive automated, deterministic integrity signals from the data above (for example, typing-pattern anomalies, paste detection, tab/focus signals, and solve-time checks). These can affect outcomes: in ranked play we may decline to award rating for a win that is solved implausibly fast or that exceeds a daily fair-play limit; in assessments we may surface an integrity flag for the hiring company to review. These signals are advisory inputs for fair-play and human review. They are not the sole basis for any hiring or disciplinary decision, and you may contact us to question a flag that affected you.

2.6 AI Chat, Mock Interview, and Voice Data

When you use AI features we collect and process:

• AI chat transcripts (your messages plus the model's responses)
• AI interviewer transcripts and submitted code
• Audio you record in mock interview or "Vibe" flows, which is uploaded to a transcription provider (OpenAI Whisper). We store the resulting transcript, not the raw audio, unless you explicitly retain it
• Synthesized speech text sent to our text-to-speech provider (Amazon Polly, on AWS) to produce the interviewer's voice
• Daily and weekly AI usage counters used to enforce plan limits

The Rena-guided copilot available during online assessments is not stored in our database; each chat request is processed and then discarded. To generate a reply, we send the inference provider (AWS Bedrock) a short evidence summary of the session (such as candidate name, score, and activity counts) together with the most recent few chat messages.

Agentic assessments operate differently. Candidate-visible agent conversations, tool calls, approvals, file changes, and related workspace evidence are saved with the assessment session so the administering hiring organization can review and replay the candidate's process. The assessment discloses that retention before the candidate starts.

2.7 Classroom Mode Data

When a classroom quiz is hosted or joined we store, in the session document:

• Host account identifier and display name
• Student display names or user IDs (guests may join anonymously with just a display name)
• Each student's answers, submitted code, drawing submissions, timing, and score
• Per-question and per-session aggregate stats

Guests can take part in classrooms, battles, and other activities without an account. If a guest later creates an account, the activity generated as a guest (such as match history, ranked Elo, and the keystroke data described in Section 2.5) is migrated onto the new account.

Classroom session data is only visible to the host of that session (and to the student for their own submissions). The host can view, export (CSV or PDF), or delete their session's report from the in-app debrief page.

2.8 Online Assessment (OA) Data

For candidates taking an OA, and for companies administering one, we collect:

• Candidate session state: code, answers, timings, navigation, and anti-cheat events
• An audit log of meaningful session events
• For Agentic questions, candidate-visible AI conversations, tool activity, approvals, file changes, and linked replay evidence
• Uploaded "explain video" recordings (stored in Firebase Storage) and the machine-generated transcript
• Company profile, membership, invitations, and entitlement records
• Institution bundle entitlements and invitations, where applicable
• Webcam proctoring (off by default; only when the hiring organization enables it and you grant camera access): periodic still images from your webcam — by default about one every 60 seconds, capped at 120 per session, stored as JPEG snapshots rather than continuous video — with a timestamp. These snapshots are for the hiring organization to review manually; we do not run facial recognition or automated face analysis on them.
• An optional identity photo you upload at the start of the assessment to confirm your identity.

Webcam proctoring is configured by the company or institution administering the assessment and only runs after you grant camera access in your browser. Company administrators can see their own candidates' submissions, transcripts, and proctoring snapshots. We do not share your OA activity with other companies.

2.9 User Preferences

We store preferences such as:

• Battle invitation settings, match and rank notifications
• Forfeit confirmation and opponent-progress display
• Practice timer and default programming language
• AI interviewer preferences (gender, voice, mode)
• Theme, accessibility, and editor settings

2.10 Device, Technical, and Network Information

We automatically collect:

• IP address (used for rate limiting, referral deduplication, and abuse prevention)
• Browser type and version, user agent
• Screen resolution and device type (desktop, mobile, tablet)
• Operating system and referring website
• Firebase Cloud Messaging (FCM) push-notification tokens, where you enable push notifications

2.11 Payment Information

Payment processing is handled by Stripe. We do not store your full credit card information on our servers. We store your Stripe customer ID, subscription tier, billing status, and the metadata Stripe returns via webhook. Stripe's privacy policy governs the handling of your payment information.

2.12 Newsletter, Email, and Notifications

We collect and store:

• Email subscription preferences (general newsletter, performance digest)
• Subscription source (account creation, landing page, dashboard)
• Subscription timestamps and status
• Unsubscribe tokens used to manage preferences without signing in
• In-app notification and delivery records

2.13 Referral Program Data

If you participate in the referral program, we store your referral code, your referral count, reward status, and the signup IP address of each referred account. IP addresses are used solely to prevent self-referral and other abuse.

2.14 Optional Product Analytics

When optional analytics is enabled, we collect redacted page views and a limited set of product events such as feature use, signup attribution, checkout starts, matchmaking, builder publishing, recruiter activation, and AI-model performance (model/provider, input mode, prompt/response length, latency, and token counts—but not the prompt or response itself). Events used to understand an account-level funnel or model performance may include your account ID; other events are stored without it. The candidate practice walkthrough uses a fresh, memory-only run ID and includes no direct account, candidate, session, assessment, or company identifier. Its server receipt time means it should still be treated as minimized pseudonymous analytics rather than guaranteed anonymous data.

Analytics events use fixed, allowlisted fields. They do not contain prompts, source code, assessment answers, message content, search text, email addresses, passwords, or take tokens. Section 8 explains when analytics starts and how to turn all optional analytics off.

4.1 Public Information

Your username, profile picture, ranked Elo, battle history, and aggregate coding statistics are visible on leaderboards and your public profile. Classroom session data, OA submissions, and private chats are not made public.

Accepted practice and battle submissions may also be used as async ghost races. Ghost opponents show race progress while active; stored replay and final-solution details may be shown after another user attempts or races that ghost.

4.2 Third-Party Service Providers

Each of these providers has its own privacy policy. We encourage you to review them.

AI training: the AI providers we use process your prompts, code, and related context only to generate a response for you, and do not use that data to train their models. Where we route inference through AWS Bedrock, your data is processed within our cloud environment and is not shared with the underlying model providers for training.

4.3 Analytics and Tracking

We use Vercel Web Analytics for cookie-free, redacted page measurement and our own first-party product-event system for the limited events described in Section 2.14. Both are controlled by the single Analytics choice described in Section 8. We do not sell analytics data or use it for advertising, cross-site tracking, automated hiring decisions, or to capture submitted content.

4.4 Legal Requirements

We may disclose information if required by law or in response to valid requests by public authorities, court orders, or legal process.