Privacy Notice

BrokenCode has two kinds of user, and our role differs between them:

• If you signed up yourself — to practise on public questions, or as a company buying assessments — we decide how your data is handled and we are the Data Fiduciary for it.
• If an employer invited you to an assessment — that employer decides to assess you, what to ask, and what to do with the result. We process your assessment data on their instructions as a Data Processor. Requests to delete that data may need to go to them; we will tell you who they are and pass the request on.

We collect only what the product needs to function. There is no advertising, no data broking, and no sale of personal data.

We do not use webcam or screen monitoring, do not record your screen or keystrokes, do not track which browser tab you are on, and do not use emotion or attention inference of any kind. We do not ask for or store your phone number, date of birth, government identifiers, résumé, or demographic information.

When a company creates an assessment invitation it may enter your name and email address so we can address the invitation to you. At that point you may have no account with us and no prior relationship. We hold that information solely to deliver the invitation and to check that the person who opens the link is the person it was issued to.

If the invitation expires without being taken up, we delete the name and email address automatically.

Your written explanation is graded by an AI system. Concretely: the accuracy of the lines you flagged is scored arithmetically, and your written explanation is sent to Anthropic to be compared against a stored reference answer. The two are combined into a single score out of 100.

What we send Anthropic is the question, the reference answer, and your explanation. We do not send your name, email address, or account identifier, so your answer is not linked to your identity at that provider.

The score is generated without human review. It is one input into an employer’s decision, and the hiring decision itself is theirs, not ours. If you believe a score is wrong, contact the employer who invited you, or raise it with us using the grievance contact below and we will look into how the score was produced.

Whether you get to see your own score is a setting the employer controls. If they have turned it off, you can still ask us for the score we hold about you under section 7.

We share personal data only with the service providers listed on our subprocessor page, which names each one, what it receives, and where it processes data. Several are outside India, which means your data may be transferred abroad.

If you were invited by an employer, your assessment answers and score are shared with that employer. That is the point of the assessment.

We do not sell personal data, and we do not share it for advertising.

We ask for your consent before any analytics storage is written to your device, and we do not treat closing a banner as consent. Declining costs you nothing: the product works identically either way.

We have configured Mixpanel not to collect your IP address, so we do not derive your location from it, and not to capture events automatically — only the specific interactions we have chosen are recorded. Page addresses are stripped of identifiers before they are sent, so we cannot see which particular assessment or candidate page you were on. We do not use Google Analytics, advertising pixels, session recording, or heatmaps. Web fonts are served from our own servers, so loading a page does not disclose your visit to a font provider.

For transparency: analytics requests are sent to a path on our own domain (/mp) which forwards them to Mixpanel, rather than to Mixpanel directly. This was set up so that browser extensions blocking Mixpanel’s domain do not silently drop events. It means analytics traffic will not appear as a third-party request in your browser’s network tools even though Mixpanel does receive the data. Nothing is sent at all unless you have accepted above.

You can change your analytics choice at any time from your account settings, and withdrawal is as easy as granting.

Under the DPDP Act you may:

• Access — get a copy of everything we hold about you. Available immediately and self-service from your account settings.
• Correct or complete — fix data that is wrong or out of date. Your name and company name are editable in settings; for anything else, contact us.
• Erase — have your data deleted. Also self-service from your account settings. See section 8 for what survives and why.
• Withdraw consent — turn analytics off at any time, with no effect on your use of the product.
• Nominate — name someone to exercise these rights on your behalf if you are unable to. Contact us to arrange this.
• Complain — raise a grievance with us (below) and, if we do not resolve it, escalate to the Data Protection Board of India.

We respond to requests within 7 working days.

When you erase your account we delete the free text you wrote and irreversibly strip your name and email from everything that remains. We do not keep a shadow copy. What survives is financial records with no personal identifiers, because the law requires us to retain the transaction itself.

Practice is open to all ages. We ask for your age bracket when you sign up — not your date of birth, because we do not need it.

If you tell us you are under 18, two things follow automatically:

• We never track you. No analytics, no behavioural monitoring, no profiling — regardless of what any consent banner says, and regardless of whether a parent agrees. This is an absolute prohibition under the DPDP Act and we treat it as one.
• You cannot take company assessments. Employer assessments are for candidates aged 18 or over. Practice is unaffected.

The same protections apply to anyone who has not told us their age — we assume the more protective answer rather than the convenient one.

Parental consent.The DPDP Act requires verifiable consent from a parent or guardian before we process a child’s personal data. We are building that verification step. Until it is live, accounts declared as under 18 are not activated — if you are under 18 and want to use practice, write to us at brokencode.team@gmail.com and we will tell you when it is available.

If you believe a child has created an account without their parent’s involvement, tell us and we will delete it.

Passwords are hashed with bcrypt and never stored in readable form. Traffic is encrypted in transit. Sign-in sessions use cookies that JavaScript cannot read. Access to assessment results is scoped to the employer that commissioned them. Our security page has more detail, including what we have not built yet.

If a breach affects your personal data we will notify you and the Data Protection Board of India as required.

Our Grievance Officer is responsible for answering questions about how we handle your personal data and for resolving complaints:

If you are not satisfied with our response you may complain to the Data Protection Board of India.

If we change how we handle personal data in a way that affects you, we will update this page and tell you before the change takes effect. The date at the top always reflects the most recent substantive change.