Privacy Policy

1. Account Information

• Name and email address
• Password (encrypted and hashed; we never store it in plain text)
• Subscription tier
• Payment information (processed and stored by Stripe; we do not store card details)
• Terms of Service and Privacy Policy acceptance timestamps and version
• Current daily practice streak and personal best score

2. Game Session Data

Each time you complete a game, we store:

• The full game state, including every trial, your responses, and timestamps, stored as structured data
• Raw score, normalised score, and percentile ranking
• Session start and end times, and total duration
• Game-specific performance metrics (e.g., reaction time, accuracy, error patterns)
• Performance category (e.g., average, above-average)

3. Feedback Reports

Feedback reports are generated on-demand from your session data and include:

• Overall score and performance category
• Identified strengths and areas for improvement
• Personalised recommendations
• Detailed insights based on your game metrics

Note: Feedback reports are not stored separately - they are generated dynamically from your session and score data.

4. Technical and Security Information

• IP address (used for security and audit logging)
• Browser user-agent string (used to identify your device type for display purposes)
• Device fingerprint (a hash of your user-agent, used only for display in the device list in your account settings)
• Device session tokens stored as secure cookies (used to enforce the 2-device limit)

Note: The 2-device limit is enforced using persistent device tokens (cookies), not fingerprinting. The first two devices you sign in on are permanently registered to your account when it is created. This limit is final and cannot be changed or reset, and devices cannot be removed.

5. Preferences and Consent

• Cookie consent choices (analytics and marketing), with timestamps

6. Interview Practice Data

When you use the Interview Practice feature, we collect and process:

• Video recordings: your camera and microphone output for each of the five interview questions, uploaded to Cloudflare R2 secure cloud storage
• Audio transcript: a text transcription of your spoken answers, generated by OpenAI Whisper
• Content analysis scores: AI-generated scores (0–10) for relevance, clarity, and structure of your answers
• Non-verbal presentation scores: AI-generated scores (0–10) for eye contact, posture, and confidence, derived from video frames
• Filler word detection: a list of filler words identified in your speech (e.g. "um", "like")
• Overall score and summary: a composite score and AI-generated written summary of your performance
• Interview credit transactions: a ledger of credit grants, purchases, usage, and refunds

Raw video files are deleted from cloud storage automatically once AI processing is complete. Transcripts, scores, and feedback are retained in your account until you delete the session or close your account.

7. Application Goals (Onboarding)

After you sign up we ask two questions - which company you are applying to, and which role - so we can decide which practice tests to show you first. We store:

• Employer: the company you are applying to, chosen from our employer list. If they are not listed you can choose “Other” and type the name, capped at 80 characters.
• Role: the role you are applying for, chosen from a fixed list (for example “Investment Banking”). If it is not listed you can choose “Other” and type the job title, also capped at 80 characters.
• Sector:the broad area the role belongs to (for example “Banking & Finance”). We are not asking you this - we work it out from the role you picked, and store nothing for a role you typed in yourself.

There are exactly two boxes in the whole flow you can type into: the “Other” employer name and the “Other” role title. Both are trimmed and length-capped when saved, and neither can be attached to an employer or role we already know, so the only free text we can end up holding is a company name and a job title. Please put nothing else in them - no personal details. Everything else is a selection from a list we defined, and both questions offer “Other”, so you never have to state something inaccurate. We no longer ask for your study level; if you answered that question before we removed it, the answer is cleared the next time you save. You can view, change or delete your answers at any time under Settings → Application Goals. We keep them for a maximum of 2 years from the last time you updated them.

8. Satisfaction Feedback

Once you have completed a few practice activities, we ask you one time how satisfied you are with the site. We store:

• Your rating: a number from 1 to 5
• Your comment: if you choose to write one (optional free text - please do not include sensitive personal information)
• How many activities you had completed when we asked, so the rating stays meaningful in context

We ask this once per account and never again. This feedback is used to improve the service and is deleted immediately if you delete your data or your account.

Service Delivery

• Provide access to practice games and features
• Manage your account and tier
• Process payments through Stripe
• Authenticate and secure your account
• Enforce the 2-device limit using persistent device tokens (stored as secure cookies)

Personalisation & Analytics

• Display your game statistics, scores, and progress charts
• Order the games dashboard around the employer and role you told us about at signup, and decide which assessment providers to build next based on the aggregate of those answers
• Show you, on your dashboard, which assessment providers the employer you named actually uses, which of those you have already practised, and which practice packs you own - so we can point you at the gap. This is worked out when the page loads, from your own answers and your own activity; it is a prompt on screen, not a decision about you (see “Automated Decision-Making” below)
• Generate personalised feedback reports with strengths and recommendations (generated on-demand from your session data)
• Calculate your percentile ranking against anonymised population benchmarks
• Track your daily practice streak and personal best
• Compute improvement trends across your session history

Anonymised Population Benchmarks

Your raw scores are included in aggregated, anonymised calculations to build population statistics (mean, median, standard deviation, percentile distributions) for each game. These statistics are used to calculate your percentile ranking. No individual scores are identifiable in this process.

Communication

• Send transactional emails required to operate your account (e.g., account confirmations, security alerts, billing notifications)
• Send service-related announcements about CogniPrep features and updates
• Changes to our Terms, Privacy Policy or Cookie Policy are announced in the app only - we do not email you about policy updates
• We do not send third-party marketing emails or any emails unrelated to CogniPrep. Every email includes an unsubscribe link for non-essential communications.

Legal & Security

• Maintain a GDPR audit trail of privacy-related actions on your account
• Comply with legal obligations
• Prevent fraud and abuse
• Enforce our terms of service

Interview Practice

• Process your video and audio recordings through AI systems to generate interview feedback (transcript, content scores, non-verbal scores, filler word detection)
• Display your interview history, scores, and AI-generated feedback in your account dashboard
• Manage your interview credit balance, recording purchases, grants, usage, and automatic refunds on processing failure
• Send you an email notification when your interview feedback is ready

Service Providers

• Stripe: Payment processing (PCI-DSS compliant). Stripe stores your billing details; we only receive a customer reference ID.
• Supabase: Authentication and database hosting. Your account and game data is stored on Supabase-managed infrastructure.
• Vercel: Application hosting and CDN. Vercel processes requests to serve the application.
• Cloudflare R2: Cloud object storage used to temporarily hold your interview video recordings during AI processing. Raw video files are automatically deleted once processing is complete.
• OpenAI: AI models (Whisper for transcription, GPT-4o for content analysis, vision models for non-verbal analysis) used to generate interview feedback. Your video frames and audio are transmitted to OpenAI's API for processing and are subject to OpenAI's Privacy Policy. OpenAI does not use API inputs to train its models by default.
• Trigger.dev: Background job processing used to run interview analysis asynchronously. Job payloads include your interview ID and are processed on Trigger.dev-managed infrastructure.