{A}

Security & Trust

We take your code, your data, and the integrity of every battle, classroom, and assessment seriously. Here is a plain, honest account of how we protect it, and where we still have work to do.

Last updated: August 24, 2026

How we protect your data

The safeguards below are standard for our stack. We describe only what is actually true today.

Encryption in transit

Every connection to AlgoArena is served over HTTPS/TLS. Our app and APIs run on Vercel, and traffic between your browser and our infrastructure is encrypted in transit by default.

Authentication

Sign-in is handled by Firebase Authentication. Passwords are hashed and managed by Firebase, so we never see or store your raw password. You can also sign in with Google or GitHub via OAuth. Enterprise SSO (SAML/OIDC) is configured individually for guided assessment partners; it is not a general self-serve feature today.

Access control

Data access is governed by Firebase Security Rules and server-side checks, so your account data and submissions are scoped to you (or, for classroom and assessment data, to the host or hiring organization that created the session).

Managed infrastructure

We build on established cloud providers (Google Cloud / Firebase for our database and storage, Vercel for hosting) rather than running our own servers. We rely on the security practices and physical safeguards those providers maintain.

Abuse & bot protection

We apply rate limiting, automated image moderation on uploads, and optional CAPTCHA (Cloudflare Turnstile) on sensitive flows to reduce abuse and protect the integrity of competitive and assessment data.

Honest about our limits

We are an early-stage company. We follow sensible, industry-standard defaults for our stack, but we do not yet hold formal third-party security certifications. We would rather tell you exactly where we stand than overclaim.

What we collect & why

We collect what we need to run the product, keep competition fair, and improve learning. For the full legal detail, see our Privacy Policy.

Account & profile

Email, username and display name, your skill level at signup, user type (student, educator, or recruiter), and optional profile details such as a picture, bio, location, and social links.

Activity & submissions

Your code submissions, test results, battle and tournament history, ranked Elo, practice activity, and classroom answers: the data that powers competition, progress, and learning.

Keystroke & typing patterns

During coding sessions (battles, practice, interviews, classroom, and assessments) we capture timing and typing-pattern data and periodic code snapshots. This supports replay, anti-cheat, and analytics. We disclose this here because it is not always obvious mid-session.

Assessment & proctoring (OA only)

For online assessments, hiring organizations may enable proctoring: an optional identity photo, periodic webcam snapshots (still images, capped per session, not continuous video), and an optional spoken-explanation recording that we transcribe to text.

AI features

When you use Rena and other AI features, your prompts and relevant code or session context are sent to AI providers for inference. Rena-guided assessment chat is ephemeral and is not stored in our database. In an Agentic assessment, candidate-visible conversations, tool activity, approvals, and resulting workspace changes are retained with the assessment session so the hiring organization can review the recorded process.

Payments

Subscription billing is handled by Stripe. Card details go directly to Stripe. We store only a customer ID, your tier, and billing metadata.

Analytics & technical info

Optional analytics combines cookie-free Vercel measurement of redacted routes and device categories with limited first-party feature and funnel events. Some account-level funnel events include your account ID; prompts, code, answers, and message content are excluded. It stays off pending consent in the EEA, UK, and Switzerland (and when location is unknown); elsewhere it is enabled by default with first-visit disclosure and an accessible opt-out. Technical signals such as IP address are used separately for rate limiting and abuse prevention.

Subprocessors

To run AlgoArena we share specific data with the trusted service providers below. Each is used for a defined purpose and receives only the data needed for that purpose.

Firebase / Google Cloud

Purpose: Authentication, database, storage, and messaging

Data shared: Account data, the application database, files (avatars, OA videos), device tokens

Vercel

Purpose: Application hosting and cookie-free aggregate usage analytics

Data shared: Requests over HTTPS; redacted routes, referrers, approximate region, browser, operating system, and device type when optional analytics is enabled

Stripe

Purpose: Subscription payment processing and billing

Data shared: Email, name, payment details (held by Stripe), customer & subscription metadata

SendGrid (Twilio)

Purpose: Transactional email, verification links, and newsletters

Data shared: Email addresses, names, message content, subscription preferences

OpenAI

Purpose: AI chat, transcription (Whisper), and speech synthesis

Data shared: Prompts, code, recorded audio or explain-video files for transcription, chat text

Anthropic (Claude)

Purpose: AI chat and rubric-based grading on selected models

Data shared: Prompts, code, rubric and assessment context

DeepSeek

Purpose: Code analysis, tutoring, quiz generation, and auto-grading

Data shared: Prompts, code submissions, problem and test context

Google Gemini

Purpose: AI chat on selected models

Data shared: Prompts and code

AWS (Bedrock & Rekognition)

Purpose: AI inference routing and image moderation

Data shared: Prompts and code for inference; images submitted for moderation

Amazon Polly (AWS)

Purpose: Text-to-speech for the AI interviewer voice

Data shared: Interviewer line text

OneCompiler (via RapidAPI)

Purpose: Sandboxed execution of user-submitted code

Data shared: Submitted code, input, expected output, language

Google Vision & Sightengine

Purpose: Automated image moderation for uploaded content

Data shared: Images submitted for safety analysis

Redis (managed cloud)

Purpose: Low-latency matchmaking queues and ephemeral state

Data shared: User IDs, matchmaking state, queue positions

GitHub OAuth

Purpose: Optional sign-in and 'Push to GitHub' code export

Data shared: OAuth authorization, access token, repository access for pushing code

WorkOS

Purpose: Enterprise SSO (SAML/OIDC) for configured assessment partners

Data shared: SSO credentials, company identity and connection metadata

Cloudflare Turnstile

Purpose: Bot / CAPTCHA verification on invitation flows

Data shared: Verification tokens and IP addresses

This list reflects the providers in active use and may change as our product evolves. If a school or company requires a data-processing addendum, contact us at contact@algoarena.net.

Data retention & your rights

We keep your account and activity data for as long as your account is active.

Deleting your account

You can delete your account from your settings, which immediately and permanently removes your profile and authentication record with no restoration period. If you would like help, or want us to action a deletion on your behalf, email contact@algoarena.net and we will honor it.

Short-lived data

Some data is transient by design: challenge and invitation links expire automatically (typically within 24 hours), and Rena-guided assessment chat is ephemeral and not stored. Agentic-assessment conversations and tool activity are different: they are retained with the assessment session for evidence review and replay.

Classroom & assessment data

Classroom sessions are retained on the host's account until the host deletes them. Assessment sessions, transcripts, and proctoring snapshots are retained according to the hiring organization or institution's policy. To be candid: we do not yet enforce automated time-based deletion across every category, and some operational and anti-cheat data may be retained longer for security. We are actively working to formalize retention windows.

Access & export requests

Want a copy of your data, a correction, or a deletion? Email contact@algoarena.net and we will respond. We honor GDPR- and CCPA-style access and deletion requests by email.

Reporting a vulnerability

We welcome reports from security researchers. If you believe you have found a vulnerability, please email us with the details and steps to reproduce, and give us a reasonable window to investigate and remediate before any public disclosure. We will not pursue good-faith research that respects user privacy and avoids service disruption or data destruction.

contact@algoarena.net

Compliance

We are honest about where we are on the compliance journey.

Certifications

We are not SOC 2 certified yet. Building toward a formal security program and certifications such as SOC 2 is on our roadmap. We will publish updates here as we reach those milestones. We will not claim a certification we do not hold.

Privacy regulations

We honor GDPR- and CCPA-style access and deletion requests by email. Your data may be processed in countries other than your own via our cloud and AI providers, and we rely on the standard cross-border safeguards those providers offer.

Schools & students

Educators using Classroom Mode are responsible for obtaining appropriate consent for students in their jurisdiction (for example, COPPA in the United States) and for complying with applicable student-record laws such as FERPA. We are happy to support a data-processing addendum on request.

Questions?

Security, privacy, or compliance questions are always welcome. Reach us at contact@algoarena.net, or read the full Privacy Policy and Terms of Service.