Privacy

What we store

Your email address, your name if you give one, and a password hash (never the password itself). If you sign in with GitHub or Google we store the account link, not your credentials.

Everything you produce while practising: your answers, your submitted code, the grades, the rubric results and the spaced-repetition schedule derived from them.

Operational records: model-call metadata (a hash of the prompt, latency, token counts and cost), rate-limit counters and error logs.

Signing in with Google or GitHub

If you choose Google or GitHub, we receive your email address, your name and your profile picture from them, and whether they have verified that email address. We use these only to create and sign in to your BuildStep account and to show your name and picture in the app.

We do not request access to your contacts, files, calendar or anything else in your Google or GitHub account, we do not post on your behalf, and we never sell, share or use this data for advertising. You can remove BuildStep's access at any time from your Google or GitHub account settings; deleting your BuildStep account deletes the data we received.

What we do not store

Card numbers. Payments go through Flitt, which holds the card details. We keep the plan status, the masked card number Flitt returns and, for a plan that renews, the card token Flitt issues for charging the renewal, stored encrypted.

The content of your prompts in our cost records: we store a hash, not the text.

Voice recordings. A spoken answer is passed on to be turned into text and then discarded; only the text you send counts as your answer.

Who sees it

Your answers are visible to you. Support and admin staff can see an attempt when you dispute its grade, because a person reviews every dispute.

Answers are sent to our AI provider's API for grading, currently OpenAI. They are processed to produce a grade and are not used by us for anything else.

With natural voice in the mock interview (Pro and Sprint), the interviewer's questions and your spoken answers are sent to OpenAI to be read aloud and turned into text. With the browser's own voice, speech is handled by your browser.

Account emails (verification and password reset) are delivered through Resend. Application errors are reported to Sentry with the page and error details, never your answers, code or password.

A share badge shows only your score and track percentages. It never contains question text or your answers.

Your control

You can export everything we hold about you as JSON from the account page, at any time.

You can delete your account from the same page. Deletion is immediate and permanent: sessions, answers, grades and schedules go with it.

Cookies

One session cookie keeps you signed in, and one preference stores your light or dark theme choice. There is no advertising or cross-site tracking.

Contact

Questions about your data: support@buildstep.org.