Privacy policy
ChillCode runs technical interviews in the browser. This page says what personal data it handles, why, where, and for how long. ChillCode is operated by FILIN VITALII, sole trader (egyéni vállalkozó), Hungary, Bem József utca 9, ground floor 10, 1027 Budapest, Hungary (“we”).
We have two roles:
- For interviewers’ accounts we are the controller: we decide what is collected and why.
- For what happens in a session — the candidate’s work and the interviewer’s notes — the hiring company is the controller and we are its processor. We handle it only to run the session, under our Data Processing Agreement.
If you are a candidate
You join with a link and no account. The company interviewing you decides how the session is used; ask them about their own hiring privacy notice.
During the session we handle:
- the name you type on the join screen;
- what you write, draw, paste or comment, the test cases and bug reports you file, and files you push with git;
- integrity signals for the interviewer: when you paste and the first lines of it, when this tab loses focus and for how long, and large edits that appear at once. You are told about them before you join;
- your IP address, which reaches our server with every connection. We count connections per address for a minute, in memory, to stop abuse, and do not store it.
No camera, no microphone, no screen recording, no cookies. The session is kept 7 or 30 days after its last use, depending on the company’s plan, and then erased. The interviewer may save a PDF of it before that; the company keeps that copy under its own policy.
To see, correct or delete your data, write to the company that interviewed you. If you cannot reach them, write to privacy@chillcode.net with the session link, and we will help.
If you are an interviewer
| Data | Why | Legal basis |
|---|---|---|
| Name, email and avatar from Google or GitHub when you sign in | Your account; showing who created a session | Contract |
| Your team, its members, invite links, templates | Sharing sessions and templates in the team | Contract |
| Plan, subscription status and Paddle ids | Knowing what the team has paid for | Contract |
| Error logs without session content | Keeping the service running and secure | Legitimate interest |
Paid plans are sold by Paddle, our reseller. Paddle collects the billing details and the card, under its own privacy notice; we never see the card number.
What we do not do
- We do not sell personal data or share it for advertising.
- We use no analytics or tracking scripts and set no cookies. Sign-in is kept in your browser’s local storage.
- We do not train AI models on sessions, and we do not read them unless you ask us to help with one.
Two third-party pieces run in the browser when you use them: Google’s sign-in button on the sign-in page, and Paddle’s checkout when an owner pays. Each sets its own cookies under its own policy.
Where the data is
The application runs in Frankfurt, Germany (Fly.io, region fra). The database is in Ireland (Supabase, AWS eu-west-1). The companies that host it for us are listed on the subprocessors page.
How long we keep it
| What | How long |
|---|---|
| A session: the candidate’s name, code, board, comments, test cases, pushed files, integrity signals, the interviewer’s notes, the call link | 7 days after its last use on Free, 30 days on Team, then erased. What stays is a record of the session’s id, team, creator and creation date, which the plan’s monthly count needs. If a team moves to Free, its sessions older than 7 days are erased. |
| A demo session (from /demo, no account) | Never written to the database. Deleted from memory two hours after it starts. |
| Git objects of a pushed repository | Never stored. Only the files’ snapshot is part of the session. |
| An open session in the server’s memory | Until 24 hours after the last person leaves. |
| Database backups | Erased data leaves the backups within 7 days. |
| An interviewer’s account: name, email, avatar, team memberships | Until you ask us to delete it. A team owner can remove a member at any time. |
| Team templates | Until a team member deletes them, or the team is deleted. |
| Invite links | 7 days, then deleted. |
| A team’s plan and subscription status | While the team exists. Paddle keeps invoices as tax law requires. |
| In the candidate’s browser: the name they typed and changes not yet sent | Until the tab is closed (session storage). |
| Server error logs | No session content. Kept by the host for a short time. |
Your rights
You can ask us for a copy of your data, to correct it, to delete it, or to stop a use based on legitimate interest. Write to privacy@chillcode.net from the email of your account; we answer within 30 days. Deleting an account removes you from your teams; a team’s sessions belong to the team and follow the retention above.
You can also complain to the data protection authority where you live or work.
Changes
When this page changes, the date at the top changes. For a change that reduces your rights we tell team owners in the app first.