Loading page
We take your code, your data, and the integrity of every battle, classroom, and assessment seriously. Here is a plain, honest account of how we protect it, and where we still have work to do.
Last updated: October 21, 2026
The safeguards below are standard for our stack. We describe only what is actually true today.
Every connection to AlgoArena is served over HTTPS/TLS. Our app and APIs run on Vercel, and traffic between your browser and our infrastructure is encrypted in transit by default.
Sign-in is handled by Firebase Authentication. Passwords are hashed and managed by Firebase, so we never see or store your raw password. You can also sign in with Google or GitHub. We do not offer single sign-on through a company's own identity provider (SAML or OIDC) today.
Data access is governed by Firebase Security Rules and server-side checks, so your account data and submissions are scoped to you (or, for classroom and assessment data, to the host or hiring organization that created the session).
We build on established cloud providers (Google Cloud and Firebase for our database and storage, Vercel for hosting, Fly.io for the cloud computers that run assessment and lab workspaces) rather than running our own servers. We rely on the security practices and physical safeguards those providers maintain.
We apply rate limiting, automated image moderation on uploads, and optional CAPTCHA (Cloudflare Turnstile) on sensitive flows to reduce abuse and protect the integrity of competitive and assessment data.
We are an early-stage company. We follow sensible, industry-standard defaults for our stack, but we do not yet hold formal third-party security certifications. We would rather tell you exactly where we stand than overclaim.
We collect what we need to run the product, keep competition fair, and improve learning. For the full legal detail, see our Privacy Policy.
Email, username and display name, your skill level at signup, user type (student, educator, or recruiter), and optional profile details such as a picture, bio, location, and social links.
Your code submissions, test results, battle and tournament history, ranked Elo, practice activity, and classroom answers: the data that powers competition, progress, and learning.
During coding sessions (battles, practice, interviews, classroom, and assessments), we capture timing and typing-pattern data and periodic code snapshots. This supports replay, anti-cheat, and analytics. We disclose this here because it is not always obvious mid-session.
For online assessments, hiring organizations may enable proctoring: an optional identity photo, periodic webcam snapshots (still images, capped per session, not continuous video), an optional spoken-explanation recording, and optional spoken answers to follow-up questions. We transcribe both to text, and an AI rates each follow-up answer for a person to review.
When you use Rena and other AI features, your prompts and relevant code or session context are sent to Amazon Bedrock (AWS), which runs the AI models. AWS does not share them with the model developers. Audio you record is sent to OpenAI only to be transcribed. In an assessment, every AI chat is saved with the assessment session: Rena's hints, and in an Agentic assessment the agent's conversations, tool activity, approvals, and the changes it made. The organization that invited the participant can review it. It is kept until that organization deletes it, or the participant asks us to, as the Privacy Policy describes.
Subscription billing is handled by Stripe. Card details go directly to Stripe. We store only a customer ID, your tier, and billing metadata.
Optional analytics uses cookie-free Vercel measurement of redacted routes and device categories, plus product events, page views, clicks, scrolling, and session recordings sent to Mixpanel. A session recording shows what was on the page, so it can include code and chat text. Anything typed into a form field is hidden. While you are signed in, this is linked to your account. Assessment candidates and classroom students are never recorded. It stays off pending consent in the EEA, UK, and Switzerland (and when location is unknown); elsewhere it is enabled by default with first-visit disclosure and an accessible opt-out. Technical signals such as IP address are used separately for rate limiting and abuse prevention. Error reports go to Sentry whether or not analytics is on.
To run AlgoArena, we share specific data with the trusted service providers below. Each is used for a defined purpose and receives only the data needed for that purpose.
| Provider | Purpose | Data shared |
|---|---|---|
| Firebase / Google Cloud | Sign-in, database, file storage, server functions, and push notifications | Account data, the application database, uploaded files (avatars, explain videos, webcam snapshots), device tokens |
| Vercel | Application hosting and cookie-free aggregate usage analytics | Requests over HTTPS; redacted routes, referrers, approximate region, browser, operating system, and device type when optional analytics is enabled |
| Fly.io | Runs the cloud computers (Machines) for assessment questions, classroom build assignments, and Learn labs that need a full computer, including the terminal and the Claude Code and Codex agents. Each Machine runs in the Fly.io region nearest you, which can be outside the United States. | Workspace files and code, commands you or the AI run and their output, and the prompts and replies of the AI agents that run there |
| Stripe | Subscription payment processing and billing | Email, name, payment details (held by Stripe), customer and subscription metadata |
| SendGrid (Twilio) | Transactional email, verification links, invitations, and newsletters | Email addresses, names, message content, subscription preferences |
| Hermes (tryhermes.dev) | Lifecycle and re-engagement email | Email address, name, and engagement signals used to time messages |
| OpenAI | Speech-to-text (Whisper) for recorded audio, explain videos, and recorded follow-up answers | Recorded audio, explain-video files, and follow-up answer recordings sent for transcription |
| AWS (Bedrock & Rekognition) | Runs the AI models behind all AI features except transcription, and image moderation. Models come from developers such as Anthropic, DeepSeek, Moonshot AI, MiniMax, Z.AI, OpenAI, xAI, Alibaba, Mistral AI, Meta, Google, and Amazon. The developers do not receive your data. | Prompts, code, and images for AI features; images submitted for moderation |
| Amazon Polly (AWS) | Text-to-speech for the AI interviewer voice | Interviewer line text |
| Serper (Google Search) | Web search for AI features | The search query the AI writes for you |
| OneCompiler (via RapidAPI) | Sandboxed execution of user-submitted code | Submitted code, input, expected output, language |
| Redis (managed cloud) | Low-latency matchmaking queues and ephemeral state | User IDs, matchmaking state, queue positions |
| GitHub | Optional sign-in and 'Push to GitHub' code export. We also keep a private repository in our own GitHub organization for each assessment question that runs on a Machine and for each hackathon team. A hackathon organizer can make team repositories public after the event. | OAuth authorization and access token, code you push, and the files and commit history of those repositories |
| Mixpanel | Product analytics and session recordings, only when Analytics is on. Never on assessment candidates' or classroom students' pages. | Product events, page views, clicks, scrolling, form use (not what you type), session recordings with typed input hidden, browser and device, IP-based location, and your account ID when signed in |
| Sentry | Error and performance monitoring. Error reports are sent whether or not Analytics is on. Recordings of visits follow your Analytics choice and are never made on assessment candidates', hackathon participants', or classroom students' pages. | Error reports (the error, where in our code it happened, the page address, browser, operating system, and device type, and for errors on our servers the values the code was working with, which can include account IDs, email addresses, or code), performance timings, and recordings of some visits with all text and typing hidden and images and video blocked |
| Splunk Cloud | Stores copies of our server logs for debugging | Server log lines and request paths, which can include account IDs and other details our code logs |
| Discord | Optional: link your Discord account to get roles in the AlgoArena Discord server | Your Discord user ID, and your rank tier, shown as a role in our server |
| Cloudflare Turnstile | Bot checks on sign-up, password reset, forms such as contact and newsletter sign-up, and assessment invitations | Verification tokens and IP addresses |
| Cal.com | Optional booking for demos and meetings | Contact details you enter to book |
Purpose: Sign-in, database, file storage, server functions, and push notifications
Data shared: Account data, the application database, uploaded files (avatars, explain videos, webcam snapshots), device tokens
Purpose: Application hosting and cookie-free aggregate usage analytics
Data shared: Requests over HTTPS; redacted routes, referrers, approximate region, browser, operating system, and device type when optional analytics is enabled
Purpose: Runs the cloud computers (Machines) for assessment questions, classroom build assignments, and Learn labs that need a full computer, including the terminal and the Claude Code and Codex agents. Each Machine runs in the Fly.io region nearest you, which can be outside the United States.
Data shared: Workspace files and code, commands you or the AI run and their output, and the prompts and replies of the AI agents that run there
Purpose: Subscription payment processing and billing
Data shared: Email, name, payment details (held by Stripe), customer and subscription metadata
Purpose: Transactional email, verification links, invitations, and newsletters
Data shared: Email addresses, names, message content, subscription preferences
Purpose: Lifecycle and re-engagement email
Data shared: Email address, name, and engagement signals used to time messages
Purpose: Speech-to-text (Whisper) for recorded audio, explain videos, and recorded follow-up answers
Data shared: Recorded audio, explain-video files, and follow-up answer recordings sent for transcription
Purpose: Runs the AI models behind all AI features except transcription, and image moderation. Models come from developers such as Anthropic, DeepSeek, Moonshot AI, MiniMax, Z.AI, OpenAI, xAI, Alibaba, Mistral AI, Meta, Google, and Amazon. The developers do not receive your data.
Data shared: Prompts, code, and images for AI features; images submitted for moderation
Purpose: Text-to-speech for the AI interviewer voice
Data shared: Interviewer line text
Purpose: Web search for AI features
Data shared: The search query the AI writes for you
Purpose: Sandboxed execution of user-submitted code
Data shared: Submitted code, input, expected output, language
Purpose: Low-latency matchmaking queues and ephemeral state
Data shared: User IDs, matchmaking state, queue positions
Purpose: Optional sign-in and 'Push to GitHub' code export. We also keep a private repository in our own GitHub organization for each assessment question that runs on a Machine and for each hackathon team. A hackathon organizer can make team repositories public after the event.
Data shared: OAuth authorization and access token, code you push, and the files and commit history of those repositories
Purpose: Product analytics and session recordings, only when Analytics is on. Never on assessment candidates' or classroom students' pages.
Data shared: Product events, page views, clicks, scrolling, form use (not what you type), session recordings with typed input hidden, browser and device, IP-based location, and your account ID when signed in
Purpose: Error and performance monitoring. Error reports are sent whether or not Analytics is on. Recordings of visits follow your Analytics choice and are never made on assessment candidates', hackathon participants', or classroom students' pages.
Data shared: Error reports (the error, where in our code it happened, the page address, browser, operating system, and device type, and for errors on our servers the values the code was working with, which can include account IDs, email addresses, or code), performance timings, and recordings of some visits with all text and typing hidden and images and video blocked
Purpose: Stores copies of our server logs for debugging
Data shared: Server log lines and request paths, which can include account IDs and other details our code logs
Purpose: Optional: link your Discord account to get roles in the AlgoArena Discord server
Data shared: Your Discord user ID, and your rank tier, shown as a role in our server
Purpose: Bot checks on sign-up, password reset, forms such as contact and newsletter sign-up, and assessment invitations
Data shared: Verification tokens and IP addresses
Purpose: Optional booking for demos and meetings
Data shared: Contact details you enter to book
This list reflects the providers in active use and may change as our product evolves. If a school or company requires a data-processing addendum, contact us at contact@algoarena.net.
We keep your account and activity data for as long as your account is active.
You can delete your account from your settings, which immediately and permanently removes your profile and authentication record with no restoration period. If you would like help or want us to action a deletion on your behalf, email contact@algoarena.net, and we will honor it.
Some data is short-lived by design: challenge and invitation links expire automatically, typically within 24 hours. AI chats in an assessment are not short-lived. Rena chats and agent conversations are saved with the assessment session for review and replay, and kept like the rest of the session (see below).
Classroom sessions are retained on the host's account until the host deletes them. Assessment sessions, transcripts and the typing data recorded during them are kept until the hiring organization deletes them, or the candidate asks us to. They are also deleted 7 days after the organization deletes its workspace, and 90 days after its paid plan ends. Webcam snapshots are deleted automatically once a decision is recorded and the organization's retention window (at least 30 days after submission) has passed, and in any case within 3 years. Identity photos are deleted after 3 years. Other typing data, anti-cheat data, and audit logs are kept with no end date for security and research.
Want a copy of your data, a correction, or a deletion? Email contact@algoarena.net, and we will respond. We honor GDPR- and CCPA-style access and deletion requests by email.
We welcome reports from security researchers. If you believe you have found a vulnerability, please email us with the details and steps to reproduce, and give us a reasonable window to investigate and remediate before any public disclosure. We will not pursue good-faith research that respects user privacy and avoids service disruption or data destruction.
We are honest about where we are on the compliance journey.
We are not SOC 2 certified yet. Building toward a formal security program and certifications such as SOC 2 is on our roadmap. We will publish updates here as we reach those milestones. We will not claim a certification we do not hold.
We honor GDPR- and CCPA-style access and deletion requests by email. Your data may be processed in countries other than your own via our cloud and AI providers, and we rely on the standard cross-border safeguards those providers offer.
Educators using Classroom Mode are responsible for obtaining appropriate consent for students in their jurisdiction (for example, COPPA in the United States) and for complying with applicable student-record laws such as FERPA. We are happy to support a data-processing addendum on request.
Security, privacy, or compliance questions are always welcome. Reach us at contact@algoarena.net or read the full Privacy Policy and Terms of Service.