Privacy policy

PraxisAI (“we”) runs this practice site and the hiring site at enterprise.praxisai.site. We are the controller of the personal data described here, except where a company invites you to an assessment, in which case that company decides how it uses your report (see section 06). Contact: info@praxisai.site.

You sign in with Google. Google tells us your name, email address and profile picture, and that the email is verified. We never see your Google password. We store these in our user table along with your role, when the account was created and when you last signed in. The first sign-in creates the account and adds a small welcome credit. We also record when you confirmed that you are 16 or older.

Email. We send emails your own actions cause or that running your account needs (sign-in links, assessment invites and confirmations, report notices, receipts and subscription notices). Product emails, such as the welcome email, are sent only while “Product emails” is on in Settings; each one has a one-click unsubscribe link. Every email names PraxisAI and our postal address and links to your email preferences.

A round (a challenge or a take-home project) runs in a browser VS Code with an AI agent. While it runs, we record:

• prompts: every prompt you send to the agent;
• agent responses: the agent's replies and the tool calls it makes (files read, commands run, edits);
• tokens: tokens used per call, the model used, and the resulting cost to your credit;
• test runs: tests you run and their results, and the graded result against hidden tests;
• pastes into the editor: size only (characters and lines, with the file and time), never the pasted text itself; whatever you keep simply becomes part of your code;
• focus and visibility changes: when the session tab loses or regains focus, and for how long;
• the code you write or accept and the final patch or repository you submit, with the timing of all of the above.

When recording starts: only after you check the consent box (“I understand this round is recorded”) on the session page and press start. Nothing is recorded before that, and recording stops when the round ends. We do not record your screen, camera, microphone or anything outside the session environment. There is no unrecorded mode.

Why: to produce your process report and scores, to meter usage against your credit, to detect abuse, and to improve the scoring.

Your prompts and the code context the agent needs are sent to AI model providers to generate responses. We route these calls through OpenRouter, which forwards them to the model provider shown in the session. We also use these models to write coaching insights on your report. Do not paste secrets or other people's personal data into a session. We do not ask providers to train on your data, and we choose routes that do not retain prompts for training where that option exists.

Plans and top-ups are paid through Stripe. Stripe collects and holds your card details; we never see or store full card numbers. We keep a Stripe customer id, your subscription status and a ledger of credit added and spent (which round used how much).

• Practice rounds: you, and our staff when needed to support you or investigate abuse. Others only see them if you share a report link or turn on a public profile.
• Leaderboard: your display name, rank and summary scores appear on the public leaderboard by default; you can turn that off in settings.
• Public profile: off unless you turn it on; then it shows the fields you choose, your badges and verified rounds.
• Assessments a company invited you to: that company's reviewers see the full report and recording for that round. Practice rounds are never shared with a company because it invited you to something else.

We use a sign-in cookie that the site needs to work, and a device identifier cookie used to prevent abuse of free rounds (see section 08). With your consent, we also use Google Analytics to understand which pages help people. Until you click Accept on the banner, Google Analytics is not loaded at all: no script from Google, no request to Google and no analytics cookies. If you decline, it is never loaded. No ad features are ever enabled. We also use Vercel Web Analytics, which counts page views without cookies or cross-site identifiers. Fonts are served from our own site, not from Google Fonts. Details and a button to change your choice are on the cookies page.

With the same analytics consent, we also keep a first-party receipt when you open your own graded practice report. It contains the round id and opening time, linked to your account through the round, so we can measure whether people return to practice. It includes no report content or marketing query parameters. Shared-link, company-assessment and staff reads are excluded. Declining stops new receipts.

Forms are protected by Cloudflare Turnstile, which checks that a visitor is human using signals from your browser, and traffic may pass through Cloudflare's network for protection against attacks. Data is encrypted in transit. The database is only reachable by our servers; it is not exposed to browsers.

Preventing abuse of free rounds. Free rounds are shared per device and per person, so making extra accounts does not multiply them. To do this, and to prevent fraud, we keep a random device identifier in a first-party cookie (pdid) and in your browser's storage, and compute a browser fingerprint (a hash of browser and device characteristics, worked out in your browser by ThumbmarkJS; it is not sent to anyone else). When you sign in or start a practice round we link these to your account, with your IP address stored only as a salted hash (never the address itself) and your browser's user agent. We use them only to share the free allowance between linked accounts and to flag unusual sign-up activity for a person to review; nothing is blocked automatically. They are deleted after 12 months.

Referrals. If you sign up through a friend's invite link, we set a first-party cookie (pref, 30 days) holding their invite code and record who invited whom. Before a referral bonus is given, we use the same device checks described above to confirm the two accounts belong to different people. Your friend sees only your first name or initials and whether you signed up and finished a round.

Affiliate program. If you apply to become an affiliate, we keep what you send us (your name, email, social profiles and follower counts, audience description, country and how you plan to promote us), with a salted hash of your IP address and your browser's user agent, to review the application and prevent abuse; we also set up an account for your email so you can sign in later. As an affiliate, we keep your commission rate, your commissions and payouts, and your payout details: the id and status of the Stripe Express account you create, through which all affiliate payouts are made (Stripe collects your identity, bank and tax information under its own privacy policy; we never see your bank details). When someone clicks an affiliate link we record the click with the device identifier described above, a salted IP hash, the user agent and the page, and set a first-party cookie (paff, 60 days) holding the affiliate's code. If they create a new account, we record which affiliate referred them and use the same device checks to stop self-referrals. Affiliates see only the initials of the customers they referred and what they earned, never their email or activity.

If you use the contact form we keep your name, email, message and how you found us, and send you a receipt by email. We use this only to answer you.

• Vercel: hosting of this website;
• Supabase: our database;
• our own servers: the session environments rounds run in;
• Google Workspace: sending email (receipts, replies).

Some of these process data outside your country; we rely on their standard contractual safeguards.

• Account data: while your account exists.
• Practice round recordings and reports: while your account exists, unless you delete them sooner.
• Practice report-open receipts: kept with the related practice round.
• Rounds a company invited you to: up to 24 months, or sooner if the company deletes them.
• Billing records: as long as tax law requires (typically several years), even after account deletion.
• Contact messages: up to 24 months.
• Device identifiers, browser fingerprints and hashed IP addresses used to prevent abuse of free rounds: 12 months after they were last seen.
• Affiliate applications, clicks and referrals: up to 24 months; commission and payout records: as long as tax law requires.

You can ask for a copy of your data, a correction, or deletion of your account and its rounds by emailing info@praxisai.site from the address on your account. We complete requests within 30 days. Depending on where you live you may also have the right to object, to restrict processing and to complain to your data protection authority. We do not sell personal data.

PraxisAI is not for anyone under 16 and is not directed at children. We do not knowingly collect personal data from children under 13, or from anyone under 16. Every account is asked once to confirm it is 16 or older; if someone says they are under 16, we close the account at once and delete its data.

If you are a parent or guardian and believe your child has given us personal data, email info@praxisai.site with the email address they used. We will delete the account and its data and confirm to you when it is done.

We will post changes here and update the date at the top. If a change materially affects how round data is used, we will tell signed-in users before it takes effect.