Privacy Policy

Last updated: February 28, 2026

This Privacy Policy explains what data DeepRep collects, how we use it, and your rights regarding your information.

1. Data We Collect

When you use DeepRep, we collect and store the following data:

Account information: email address, display name, and avatar URL. Passwords are managed by our third-party authentication provider and are never stored by DeepRep directly.
Code submissions: the source code you submit for problems, along with execution results and metadata (language, timestamp, pass/fail status).
Progress data: problem completion status, module progress, and practice mode results.
Gamification data: XP earned, current level, bits currency balance, streak history, and achievement records.
Spaced-repetition data: review scheduling information used to optimize your learning.

2. How We Use Your Data

We use the data we collect to:

Provide and operate the DeepRep platform.
Track your learning progress, streaks, and achievements.
Power the gamification system (XP, levels, bits, achievements).
Schedule spaced-repetition reviews to optimize retention.
Execute and evaluate your code submissions.

3. Data Storage

Your data is stored in the following systems:

Primary database: all persistent data including your account, submissions, progress, and achievements.
In-memory cache: used for rate limiting and usage tracking (e.g. daily AI call budgets).

4. Cookies

DeepRep uses the following cookies:

has_auth — a flag cookie used by the route guard to determine whether you are authenticated. It does not contain sensitive information.
Authentication: our authentication provider may store tokens in browser storage to maintain your login session.
Analytics: our analytics provider may set cookies to distinguish unique users and track sessions. See Section 8 for opt-out information.

5. Local Storage

DeepRep uses your browser's localStorage for the following purposes:

Code drafts: your in-progress code is saved locally so you do not lose work if you navigate away.
Language preferences: your selected programming language for the code editor.
Cookie consent: whether you have acknowledged the cookie consent banner.

6. Data Retention

Submissions and progress: stored indefinitely while your account is active.
Account deletion: when you delete your account, your email address, password, and identity are permanently anonymised. Code submissions are retained in anonymised form for aggregate statistics; their content is wiped. Conversation logs (coach history) and API keys are deleted. Your account with our authentication provider is also deleted.

7. Your Rights (GDPR)

Depending on your location, you may have the following rights under applicable data protection laws:

Right to access: request a copy of your personal data. You can export your data via your account settings.
Right to erasure: request deletion of your account and personal data via your account settings or by contacting us.
Right to object: object to processing of your personal data for certain purposes.
Right to restrict processing: request that we limit how we use your data while a concern is being resolved.
Right to lodge a complaint: you may lodge a complaint with your national data protection authority (e.g., the ICO in the UK, CNIL in France).

To exercise these rights, use the options in your profile settings or email us at [email protected].

8. Analytics

We use Google Analytics 4 (GA4) to collect anonymised usage data — such as page views, session duration, referrer, browser type, and country — to understand how the platform is used and improve it over time. GA4 may set cookies on your device. No personally identifiable information is collected or retained by DeepRep through analytics.

You can opt out of analytics tracking by using the cookie banner on the site or by installing Google's Analytics Opt-out Browser Add-on.

9. AI & Third-Party Services

DeepRep relies on the following categories of third-party services:

Authentication provider: handles user authentication, password management, and social sign-in. Your email and authentication credentials are processed by this provider.
Analytics provider: collects anonymised usage data as described in Section 8.
AI / LLM providers: AI-powered features — including the coach, mock interview, code review, and behavioural/system design evaluation — send your code and conversation data to third-party large language model (LLM) providers for processing. The providers we use include:
This applies when using platform-provided AI features. Users who bring their own API key (BYOK) choose their own provider; see below.

BYOK (Bring Your Own Key)

If you supply your own API key to use AI features, your key is stored AES-256 encrypted in our database and used solely to make API calls on your behalf. Your key is never shared with anyone else and you can delete it at any time from your account settings.

Beyond these services, DeepRep does not share, sell, or transfer your personal data to any other third parties. We do not use advertising networks or tracking pixels.

10. Artificial Intelligence & Third-Party Model Providers

When you use AI-powered features — including code hints, code review, mock interviews, behavioural coaching, and system design feedback — your code snippets and conversation messages are sent to third-party AI model providers for processing.

Which Providers

The provider used depends on your API key configuration in Settings. Supported providers include OpenAI, Anthropic, Google Gemini, DeepSeek, and Groq. If you use a platform-provided key, the specific provider in use is displayed within the app.

What Is Sent

Code you write in the editor, problem descriptions, and your conversation messages with the AI coach. We do not send your name, email, or account information to AI providers.

Your Control

You can configure your preferred AI provider in Settings > API Keys (BYOK — Bring Your Own Key). You can also avoid AI features entirely; they are optional.

Data Retention

AI conversation history (coach chats, mock interview transcripts) is stored encrypted in our database and retained for 90 days, after which it is automatically deleted.

Model Training

We do not use your data to train AI models. Your data is subject to each provider's terms of service when it is transmitted to them.

11. Children

DeepRep is intended for users aged 13 and older. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has created an account, please contact us at [email protected] so the account can be removed.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be reflected on this page with an updated “Last updated” date. Continued use of the platform after changes constitutes acceptance of the revised policy.

13. Data Controller & Contact

DeepRep is the data controller for your personal data. For any privacy-related questions or requests, please email us at [email protected].