Privacy notice
Last updated: October 9, 2026
In short: we collect your email, your progress in the product and your AI requests, to run the product for you. We don't sell your data, we don't run ads, and we don't use tracking or analytics cookies. Payments are handled by Paddle. AI answers come from Anthropic.
1. Who is responsible
[LEGAL BUSINESS NAME], [BUSINESS / OSEK NUMBER], [BUSINESS ADDRESS], is the controller of your personal data. Contact: [SUPPORT EMAIL].
2. What we collect and why
| Data | Why | Legal basis |
|---|---|---|
| Email address | To sign you in with a one-time link and to contact you about your account | Contract |
| Your progress: answers, scores, confidence ratings, reflections, practice history, settings | To show your progress, recommend practice and sync it across your devices | Contract |
| Text you send to AI features, and screens you upload for a crit | To generate the answer or crit you asked for | Contract |
| Daily count of AI requests, and counts of practice rounds, mock interviews and screen crits | To apply the limits of your plan | Contract |
| A daily challenge submission you choose to share in the gallery: your note, link and screenshot | To show it to other users after review, without your name. You can withdraw it at any time | Consent |
| Plan and subscription status, and a Paddle customer id | To know which plan you're on and to open your billing page | Contract |
| Team seat emails, if a team owner adds you | To give you Pro through your team | Contract, and the team owner's legitimate interest |
| Technical logs (IP address, browser, time of request) | To keep the Service secure and fix problems | Legitimate interest |
We don't collect payment card details. Paddle collects them directly.
Team owners see only team averages of baseline and retest scores, and only once at least 3 designers on the team have a result. They don't see your individual scores, answers, misses or reflections.
3. Who processes your data for us
- Supabase: account sign-in and our database.
- Vercel: hosting of the website and its server functions.
- Anthropic: generates AI answers and crits. We send the text of your request, the relevant progress context (for example your skill scores and recent missed decisions) and any screen you upload. Under Anthropic's commercial terms, this data isn't used to train their models.
- Paddle: our reseller and Merchant of Record. Paddle processes your payment and billing details as an independent controller, under its own privacy notice.
- Google Fonts: serves the fonts, which means your browser requests them from Google.
Some of these providers process data outside your country, including in the United States. Where required, transfers rely on standard contractual clauses or an equivalent safeguard.
4. What stays in your browser
The app keeps your progress, your sign-in session and your theme choice in your browser's local storage, so it works fast and offline. Screens you upload for a crit stay in your browser and aren't synced to your account. We don't use advertising or analytics cookies.
5. How long we keep it
- Account data and progress: while your account exists. If you delete your account, we delete it within 30 days.
- AI request counts and plan-limit counts: up to 90 days.
- Gallery submissions: until you withdraw them or delete your account.
- Subscription records: as long as tax and accounting law requires.
- Technical logs: kept by our hosting provider for a limited period, usually under 30 days.
6. Your rights
You can ask to access, correct, export or delete your data, or object to processing based on legitimate interest. Email [SUPPORT EMAIL] and we'll answer within 30 days. You can also complain to your local data protection authority.
7. Children
The Service isn't meant for anyone under 16, and we don't knowingly collect their data.
8. Security
Data is encrypted in transit. Database tables can be read and written only by our server, not directly from the browser. Sign-in uses one-time links, so there are no passwords to leak.
9. Changes
If we change this notice in a way that matters, we'll update the date above and tell signed-in users before the change applies.