Legal

Privacy Policy

Last updated October 18, 2026

CodePrepCoach.com (“we”, “us”) is an AI coding-interview coach operated by Israel Derdik. This policy explains what we collect when you use the service, why, who processes it on our behalf, and the choices you have. Questions and requests go to [email protected].

The short version

We collect your email address, your name and what you do in practice sessions, because that is the product.
Your code, notes and conversation are sent to an AI model provider to generate exercises, replies and feedback. Your code is analysed, never executed.
Authorized administrators can view accounts and interviews for support and quality. Every such view is logged.
We use Google Analytics to see how the site is used. No advertising, and we do not sell your information.
Email us to see, correct or delete your data.

What we collect

Account information. Your email address and a display name. If you sign in with Google, we receive your name, email address, profile picture URL and Google account identifier; otherwise we derive a name from your email address. We record whether your email is verified and your account role.

Sign-in information. One-time sign-in codes (stored hashed and valid for 10 minutes), the tokens Google issues when you sign in with Google, and, for accounts created before passwordless sign-in, a password hash. When you sign in we set a session cookie and store the session with your IP address and browser user agent.

Practice content. The exercises generated for you, your conversation with the AI interviewer (including a copy of your editor contents with each message), hints you request, your working drafts, your submitted code, approach notes and complexity claims, what you disclose about outside help, timing (start, pauses, submission), and the evaluations, explanations and next-exercise plans the service produces.

AI usage records. For each AI request: which feature made it, the model, token counts, response time, success or failure, and an estimated cost, linked to your account and practice session.

Usage analytics. We use Google Analytics to understand how the site is used: which pages are visited and in what order, how long visits last, where visitors come from, the type of device and browser, an approximate location derived from the IP address (Google does not store the address itself), and interactions such as scrolling and clicks on outbound links. Analytics identifies your browser with a random identifier, not your name or email address, and we do not send it your account details or practice content.

Data stored in your browser. Besides the session cookie, the workspace keeps unsaved drafts, your panel layout and your editor-assist preference in your browser's local storage so nothing is lost if the connection drops. Google Analytics sets cookies that hold its random browser identifier for up to two years. We do not use advertising cookies.

Administrative records. When an administrator opens your account or one of your interviews, we record who did so, when, and from which IP address and browser.

How we use it

To create and secure your account, sign you in and email you sign-in codes.
To run practice sessions: generate exercises, conduct the interview, evaluate your submission, explain the reference solution and choose your next exercise from your history.
To keep your work across devices and recover interrupted sessions.
To support you, investigate problems, review the quality and fairness of AI feedback, and monitor AI costs.
To understand how the site is used in aggregate, so we can improve it.
To prevent abuse, enforce our Terms of Service and meet legal obligations.

We do not sell your personal information, use it for advertising, or build profiles of you for anyone else. Where the law of your country requires a legal basis, we rely on performing our agreement with you (running the service you signed up for), our legitimate interests in operating and securing it, and your consent where we ask for it.

AI processing

Exercises, interviewer replies, hints, evaluations, explanations and learning plans are produced by large language models. To produce them, we send the relevant content (the exercise, your code, notes, conversation, hints and disclosures, and short summaries of your previous attempts) to a third-party AI model provider, which processes it to return a response under its API terms. Your code is parsed and analysed, never run.

AI feedback can be wrong. It is a coaching judgment, not a certification or an assessment of your employability. Please do not put personal, confidential or third-party proprietary information into your code or messages.

Who can see your interviews

Your practice history is private to your account: other users cannot see it. A small number of authorized administrators can view accounts and complete interview sessions, including your code, conversation, evaluation and the AI usage behind it, for product support, quality assurance and operating the service. Every time an administrator opens an account page or an interview, the access is recorded in an audit log that cannot be edited. Administrators can also change account roles and disable accounts; those actions are logged too.

Service providers

We use service providers to run the service: cloud hosting and database providers (in the United States), AI model providers that process practice content to generate exercises and feedback, an email delivery provider for sign-in codes, Google for usage analytics and, if you choose it, sign-in, and a content delivery network that serves the code editor to your browser. Each receives only what it needs for its task. A current list is available on request at [email protected].

We may also disclose information if required by law or to protect the rights, safety or security of our users or the service, and to a successor if the service is transferred, under a policy at least as protective as this one.

Information from Google

If you sign in with Google, we request only the basic openid, email and profile scopes. We use the name, email address, profile picture URL and account identifier we receive only to create your account, sign you in and show your name in the app. We do not access any other Google data, use it for advertising, sell it, or share it except with the service providers above as needed to run the service. CodePrepCoach.com's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. You can remove our access at any time in your Google Account's third-party connections settings.

How long we keep it

We keep your account and practice content while your account exists, so each exercise can build on the last. Sign-in codes expire after 10 minutes. When you ask us to delete your account, we delete it together with your sessions, exercises, interviews, drafts, submissions, evaluations and plans. Two kinds of records stay: AI usage records, with the link to you removed, for cost accounting; and the administrative audit log, which keeps your account identifier as a security record. Deleted data may remain in database backups for a limited time until they are overwritten.

Your choices and rights

You can ask us to give you a copy of your data, correct it, or delete your account by emailing [email protected] from the address on your account. There is no self-service deletion yet, so we handle these requests by hand and answer within 30 days. Depending on where you live (for example the European Economic Area, the United Kingdom or California), you may also have the right to object to or restrict certain processing and to complain to your data protection authority. You can keep Google Analytics from measuring your visits by blocking its cookies in your browser or installing Google's Analytics opt-out browser add-on; the service works the same either way. You can stop using the service at any time.

Security

Traffic is encrypted in transit. Sign-in codes and passwords are stored only as hashes. Access to other users' data is checked on the server for every request, and administrative access is restricted and audited. No system is perfectly secure; if we learn of a breach affecting your information, we will tell you as the law requires.