Preparing this page…
Your current navigation and account state stay available while the next page loads.
Effective November 1, 2026. This notice explains what Frontier Rehearsal collects, why it is used, which providers process it, how long it is kept, and the controls available to you.
Practice notes, progress, Python code, filters, snapshots, anonymous question reviews, and interface settings can be stored in your browser. A functional cookie may remember the last stage opened. Local storage is not a backup: clearing site data, changing browser or device, private browsing, device loss, or corruption can erase local-only work. Export anything you need to retain.
When you sign in or use an account feature, we can process your email address, account ID, profile and matching preferences, practice records, settings, ratings, tags, community posts and replies, service requests, reports, moderation state, session proposals, peer matches, and access history. Optional profile fields are used only for the matching and community context described where you provide them. This is not live collaborative editing, so avoid changing the same review or attempt on two devices at once. If a conflict is detected, saving stops rather than silently overwriting another device.
When uploads are enabled, we can process the file, description, type, size, hash, scan state, and private storage reference. Files remain private unless the related content is approved for publication. Do not upload credentials, identity documents, health or financial data, employer secrets, real confidential interview questions, or material you lack permission to share.
Payment details are entered on Stripe's checkout page. We process order, offer, price, subtotal, discount, tax, charged total, currency, payment-reference, refund/dispute state, and entitlement records—not card numbers. Restricted transaction records may remain after account deletion where reasonably required for accounting, tax, fraud prevention, refunds, or disputes.
Hosting, authentication, email, security, and error systems can process IP address, request time, route, device/browser information, identifiers, delivery status, and bounded diagnostics needed to operate and protect the Service. We do not use advertising trackers or session replay, and we do not sell personal information or share it for cross-context behavioral advertising.
Feature-use measurement and signed-in account activity have separate controls on practice pages; both are off until you enable them. Account activity can include page and question views, foreground time, visible Browser Python or Browser notebook coding-pane time, selected practice actions, coarse outcomes, a random session ID, and event IDs linked to your account. The operator can review account-linked question and coding-time totals. Raw account activity is kept for up to 30 days. Code, notes, prompts, typed text, filenames, full URLs, IP-address fields, and user-agent fields are excluded from this activity record. Site search separately records the normalized search term, content filter, result count, selected result path, random session ID, and event ID so we can identify missing or hard-to-find content. It does not attach an account ID, IP-address field, or user-agent field; searches resembling an email address, phone number, or URL are dropped before storage, and eligible raw search events expire after 90 days. Feature-use reports use an allowlisted feature key and random device identifier. When feature-use measurement is enabled, browser LCP, INP, and CLS values are stored only as daily histogram counts by route family and mobile/desktop viewport class; no per-visit performance record or identifier is kept. A usefulness rating is sent only when you press a rating button.
Local storage is not a backup. Clearing site data, changing browser or device, private browsing, device loss, or corruption can erase local-only work. If a saved attempt is unreadable or from an unsupported version, the workspace stops writes and offers the untouched local record as a plain-text export until you explicitly discard it.
We use data to provide sign-in and saved features; operate practice, community, matching, support, and payment functions; preserve purchases and user controls; prevent fraud and abuse; secure and troubleshoot the Service; comply with legal duties; and improve released features using bounded records. We do not use private candidate work to train models unless you separately and specifically opt in.
Depending on enabled features, Railway can host the application; Supabase can provide authentication, database, and private storage; Stripe processes checkout and payment events; Resend can deliver transactional email; Cloudflare can provide DNS, security, and backup infrastructure; and Sentry can receive bounded error diagnostics. These providers process data for their contracted service and under their own privacy terms.
We keep personal data only as long as reasonably necessary for the purpose described, account operation, security, dispute handling, and applicable legal duties. You can withdraw eligible pending contributions and request deletion. Deletion can remain pending while an upload write, private-file removal, or payment outcome cannot be verified. A minimal deletion marker may remain to prevent an older backup from silently restoring a deleted account.
You can export supported account records, delete synchronized practice data, withdraw eligible pending content, sign out, and request account deletion from the account page. Signing out does not erase browser-local work. Depending on where you live, you may also request access, correction, deletion, restriction, objection, or portability. We will verify requests proportionately and explain when a lawful exception applies.
Providers and their subprocessors may process data in the United States and other locations where they operate. We use the provider configuration and contractual safeguards available for the selected service. Do not use Frontier Rehearsal if you do not want your data processed as described here.
We use access controls, private storage, bounded inputs, secret stores, security headers, backups, and tested deletion paths. No internet service can guarantee absolute security. Protect sign-in links and devices, avoid unnecessary sensitive information, and report suspected unauthorized access promptly.
The account and paid Service are intended for people age 18 or older. Do not create an account or submit personal information if you are under 18.
We may update this notice when data practices or providers change. Material changes will be dated and communicated where required. For privacy requests or questions, email [email protected]. For other support, email [email protected]. Never email passwords, sign-in links, card numbers, or employer-confidential material.