Privacy policy

Who is responsible

AICodingRound decides how your personal data is used and is responsible for it. Contact: privacy@aicodinground.com.

What we collect

• Account: email address, the name you give, a password hash (Argon2id, never the password), verification and reset tokens (stored hashed), two-factor settings and recovery codes (hashed), and your time zone, taken from your browser, so that daily reminders and streaks follow your local day.

• Sign-in with GitHub or Google, if you use it: your email address, name and account id from that provider.

• Discord, if you link it: your Discord user id and name, and a token (stored encrypted) that lets us keep your Founding member role on our Discord server in sync. We send Discord your handle and whether you hold a founding spot, never your email. You can unlink any time in Settings, which revokes the token and deletes these.

• Handle and share cards, if you choose them: a public handle and the cards you publish (see “Who we share it with”).

• Sessions and devices: sign-in time, browser/device label and a shortened IP address (the network part only, for example 203.0.113.0/24), so you can see and revoke your devices. Your full IP address is used briefly to apply rate limits; it is not stored in our database, and our server logs keep only the shortened network part. Server logs are overwritten as they fill and are not archived.

• Your work: files you create or change in a workspace, terminal and test activity, preview use, and the prompts and replies of the AI assistant. Every workspace event is recorded because the report is built from it.

• Reports: scores, test results, timelines, your follow-up answers, and a private copy of the full change you submitted.

• Progress: your attempts, streak days, the “next time” tips you tick, the next-problem suggestions we showed you, when you opened a solution page and your “Was this useful?” vote, and simple usage counts linked to your account (how often you open the progress page and how far you scroll a solution page).

• AI connections: API keys and subscription logins you add, stored encrypted and used only for your sessions.

• AI usage records: for each call to our AI, the time, feature, model and amount used. No prompts, answers or code. We use them to cap costs.

• Beta application: your email, name, level, main stack, interview timeline, a LinkedIn or GitHub link, and any optional answers (a second link, target companies, why you want to join, how you heard about us), the handle of the person whose card brought you here (if any), and when and to what wording you agreed. We do not fetch the links automatically; the person choosing testers may open them to look at your public profile. We may add a short private note or a “strong fit” mark.

• Beta seat: when your invite was sent and used, when your seat started, and which reminders were sent.

• Founding spot: whether you hold one, when it was claimed and how, the network address it was claimed from (an IPv4 address or the first part of an IPv6 address, used only to stop one person taking many spots) and a version of your email with dots and + tags removed, plus the id of your Google account if you signed in with Google (same purpose), your deadline, and a Founding member badge if you earn one. The badge shows publicly only if you make your profile or a card public. All of it is deleted with your account.

• Visit counts: a cookie-free count of visits to public pages by day, page and referring domain, with no IP address or identifier. Browsers that send Do Not Track or Global Privacy Control are not counted.

• Where you came from: when you sign up we note which link or campaign brought you (for example a short link in a post), and the website that linked to us, as a few short labels on your account. No cookies and no cross-site tracking; the labels are removed when you delete your account.

• Errors and bug reports: when something breaks, the app sends us a redacted error report (the page, the error and the addresses and status codes of recent requests, without their content). A screenshot is sent only if you choose to attach one to a bug report.

• Emails: which emails we sent you and when (not their content), and your email choices.

• Support and security: messages and feedback you send us, and an audit log of sensitive account actions (sign-in, password and email changes, deletion).

Almost all of this comes from you or from your use of the service. The only other sources are GitHub or Google when you sign in with them.

Why we use it

• To run the service you asked for: workspaces, grading, reports, progress and your account (contract).

• To send account and service emails: verification, password reset, invites, “your report is ready” and beta seat notices (contract).

• To send emails about your own practice: a daily reminder while you have a streak (or if you turn reminders on), a weekly summary, a short feedback request after some rounds, and beta seat reminders. Each one has a one-click unsubscribe, and you can switch each type off in settings (legitimate interests: helping you keep practicing; you can object at any time).

• To consider your beta application and email you about the beta (your consent, which you can withdraw at any time, and steps you asked us to take before giving you access).

• To keep the service secure and fair: rate limits, abuse and fraud prevention, cost caps, bug fixing, and the invisible mark on solution pages that lets us trace leaks (legitimate interests).

• To improve problems and grading from aggregated results (legitimate interests).

• To meet legal obligations.

You need to give an email address to have an account, and a round has to be recorded to be graded. Without them we cannot provide the service.

We do not sell your personal data, do not share it for cross-site advertising, and do not use it for advertising. We do not use your code, recordings or answers to train AI models, and we use our AI providers only with their model training on what we send them switched off.

AI in grading and in the workspace

The AI parts of grading run on AI models from third-party AI model providers. In the private beta we do not offer our own AI in the workspace: you bring your own AI or use none.

• If a round offers our own AI panel, our AI model provider receives your messages and the files and command output that panel reads. Your own AI tool sends your prompts and the files it reads to your provider instead.

• When you submit, our AI model provider receives the ticket, your change, which hidden-test groups passed and the names of failing tests, a summary of your AI conversation with your name, email and account details removed, and your answers to the follow-up questions. It also writes one follow-up question about your change.

How your report is made: hidden tests decide whether your fix works, what else broke and whether it is fast enough. For understanding and AI use, the AI reads your change, your AI conversation and your answers and quotes the evidence it finds; our code checks those quotes and turns them into points with a fixed rubric. Each AI scoring step runs more than once; when the runs disagree, another run decides or the result is marked for a person to check.

Your report is practice feedback. It is not shown to employers, it does not decide whether you keep beta access, and it has no legal or similar effect on you. If you think a grade is wrong, write to hello@aicodinground.com and a person will look at it.

If you use your own AI subscription or API key instead, that provider receives what you send it, under its own terms.

Who we share it with

We use these providers to run the service. They process data only on our instructions.

• A cloud hosting provider: hosts our servers and database, and stores our encrypted backups.

• A sandbox and workspace provider: runs the workspaces and the separate grading copies of your files.

• A network and security provider: network, encryption in transit, security and the bot check on forms. It sees your IP address and technical details of your requests.

• An email provider: sends our emails and hosts our mailbox, so it handles your email address and the emails we exchange.

• Third-party AI model providers: the AI parts of grading, and our own AI panel in any round that offers it, as described above.

• GitHub or Google, if you choose to sign in with them.

• Discord, if you link it: your handle and whether you hold a founding spot, so your Founding member role stays correct. Never your email.

• The AI provider you choose, if you use your own subscription or API key.

• Authorities, only where the law requires it.

We will update this list before we add or replace a provider. We do not share your code or reports with employers or companies. Sharing is opt-in: a share card shows only your handle (or “A beta tester”), the problem, the result and the points per skill, and you can revoke it at any time.

What we record during a round and how long we keep it

A practice round is recorded so we can grade it and show you a report. Here is exactly what that means.

• Recorded: every file you save or change (the code itself), what you type and see in the terminal, your test runs and previews, searches, and your conversation with the AI assistant (your prompts, its replies and the actions it took). Large files and binary files are recorded by size and fingerprint only.

• For text pasted into the editor we note whether it came from inside the workspace (the ticket, the terminal or the AI) or from somewhere else. We do not read your clipboard.

• If you use your own AI subscription in the terminal (an AI coding assistant's command-line tool), we read that tool's session log inside your workspace when you submit, to see what you asked it and what it changed. Secrets that look like keys are removed first. The raw log is not stored; the prompts it contained are kept in your report (see below).

• Not recorded: your screen, camera or microphone; anything outside the workspace; the password or login you type into an AI tool's own sign-in screen.

Retention, by type of data:

• Round recording (terminal log, AI conversation, code snapshots): deleted 90 days after your last activity in that round. You can delete one earlier from your round history, and it is removed straight away when you delete your account.

• The workspace itself: deleted when the round ends or is graded. A copy of your changed files, kept only to restore a workspace that was lost, is removed when the round ends.

• Reports and scores (including your prompts to the AI, your submitted change and your answers to follow-up questions): kept while your account exists, so you can track progress. You can turn off or revoke a share link at any time.

• AI subscription logins you save: deleted when you log out inside the tool or disconnect it in settings, and automatically if unused for 30 days. Your own API keys are kept encrypted until you delete them or your account.

• Beta application: deleted after 14 days if you never confirm your email, 6 months after you applied if you are not invited, and 90 days after your invite or sign-up if you are. The email address on a used or expired invite is erased after 90 days.

• Security audit log (sign-ins, password and email changes, deletion): kept for 1 year, then deleted.

• Messages you send us (feedback, the companies contact form): kept for up to 1 year. Feedback tied to your account is deleted with it.

• Error and bug reports (including any screenshot you attached): 90 days.

• Records of emails we sent you: 90 days.

• Visit counts, in-app usage counts and AI usage records: 400 days. When you delete your account, your in-app usage counts are deleted and your AI usage records are unlinked from you.

• Discord link: kept until you unlink it or delete your account. Then the stored token is revoked and deleted; if Discord cannot be reached at that moment, only the sealed token is kept, for the sole purpose of retrying the revoke, for at most 30 days.

• Handle: after you change it or delete your account, the old handle is reserved for 90 days with no link to you, then released.

• Deleted account: your reports, recordings, history and saved logins are deleted immediately; the remaining account record and sign-in security data are permanently removed within 30 days. Backups roll off within 7 days.

Who can see it: you. Our staff can see your account details, your beta application and a summary of your attempts (problem, time, result). They do not browse recordings or reports; they open them only to investigate a security problem, a bug or grading question you sent us, or a grade our system marked for a person to check. Recordings and reports are never shown to employers or companies, and sharing a report is your choice. The AI provider you choose sees what you send it, under its own terms.

How long we keep it

See the section above for rounds, reports, applications and AI logins. Account data (email, settings) is kept until you delete your account; after that we remove it within 30 days, apart from what we must keep by law and the security log described above.

Your rights

In settings you can download your data, delete recordings, choose which emails you get, and delete your account. The download holds your account, your code, your terminal and test activity, your prompts and the assistant's replies, and your reports. It leaves out internal grading and coaching notes (for example the coach's private reasoning), because they would reveal the answers to problems; ask us at the privacy address if you want them for a specific round.

Depending on where you live you may also have the right to access, correct, delete or move your data, to restrict or object to our use of it (including emails about your practice), and to withdraw consent at any time. Write to privacy@aicodinground.com; we reply within one month. We will not treat you differently for using these rights.

• EU and UK: you can complain to your data protection authority (in the UK, the Information Commissioner’s Office).

• California: you can ask what personal information we hold, and ask us to correct or delete it. We do not sell or share personal information for cross-context behavioral advertising, and we do not use sensitive personal information to infer things about you.

• India: you can also nominate someone to use your rights if you die or cannot act. Raise a grievance with us first at the address above; if we do not resolve it, you can complain to the Data Protection Board of India.

Security

We protect data with encryption in transit, hashed passwords, encrypted stored secrets, isolated workspaces and access checks on every request. See how we protect data. No system is perfectly secure; if a breach affects you, we will tell you and the authorities as the law requires.

Transfers

Your data is processed outside your country. Our AI model providers and our network and security provider process data in the United States and other countries. Our hosting, email and workspace providers may also process data in the United States and other countries.

Where the law requires it, we rely on adequacy decisions or on the standard contractual clauses (with the UK addendum) in our providers’ data processing terms. Ask us for a copy at the address above.

Children

AICodingRound is not for anyone under 13. If you think a child under 13 has an account, tell us and we will delete it.

Changes

We will update this page and, for material changes, tell you by email or in the app before they take effect.