LibeCode
Privacy notice
Last updated
This page explains what LibeCode records when you take a technical exercise, why, where it is kept, for how long, who can see it, which companies help us run the service, and how to use your rights. It also covers company accounts and this website.
Who is responsible
- The company that invited you is running this exercise as part of its hiring process. It is the controller of your interview data: it decides how the results are used and is responsible for its hiring decisions.
- LibeCode (Irvin Sivya and Nikolay Zhibarev, Ontario, Canada) provides the software and processes your interview data on the company's behalf and instructions.
LibeCode is the controller of company accounts and of this website: for those, LibeCode decides how the data is used.
- Privacy questions and requests:
- privacy@libecode.com
- Help with an exercise or an account:
- support@libecode.com
What is recorded during an exercise
This is the same list the consent page shows before an exercise starts, row for row.
| What | Why | Where it is kept | How long |
|---|---|---|---|
| The session itself: when it started, the clock, when you submitted | To run and record the exercise | LibeCode's servers (encrypted) | 12 months |
| Your name, the email address the invitation was sent to, and the one-time code sent to it | To run the session and bind it to your address | LibeCode's servers | 12 months |
| Every change you make to a file: which file, when, the text, and whether it was typed, pasted from within the session, or applied from the AI | Grading and the record of how you worked | LibeCode's servers (encrypted) | 12 months |
| Every command you run in the terminal and every test run, with their output | Grading and the record | LibeCode's servers (encrypted) | 12 months |
| Every file written in your workspace and by what (your editing, the terminal, or an applied AI proposal) | Integrity of the record: two independent logs that must agree | LibeCode's servers | 12 months |
| Every prompt you send, your pinned notes, what you attached, which model you chose, every answer and proposal, what you did with each proposal, and the AI budget spent | Grading and the record | LibeCode's servers (encrypted); your prompts and attachments are sent to the model provider you select through OpenRouter, with training on your data disabled; after you submit, your prompts, the task and what happened after each prompt are also sent to Anthropic, whose model writes the prompt review | 12 months at LibeCode; the providers' own retention is stated on our privacy page |
| When the page loses or regains focus, and when it leaves or re-enters fullscreen, with durations | Integrity: context a reviewer can see; never a score | LibeCode's servers | 12 months |
| When a paste was blocked or allowed and how much text it was (never the text of a blocked paste) | Integrity | LibeCode's servers | 12 months |
| Whether the session was opened in a second tab | Integrity | LibeCode's servers | 12 months |
| Whether you were active at the keyboard or mouse, as counts per five seconds (never what you typed) | To notice long absences | LibeCode's servers | 12 months |
| Your declared location and the country of your internet address | To apply the legal rules that depend on where you are | LibeCode's servers | 12 months |
| Which LibeCode exercises you have taken before, at any company, keyed by a hash of your email | So you are not given the same problem twice | LibeCode's servers | 12 months |
| Notes and the decision your reviewer records about your session | The company's own record | LibeCode's servers | 12 months |
| The company's record of the outcome of your application (advanced, offer, hired, declined), entered by the company | Stored with your session; used by LibeCode only in aggregate analyses of whether the exercise predicts anything | LibeCode's servers | 12 months |
| One recording of up to 60 seconds, made after your final submit, in which you explain your decisions and how you approached the problem: camera and microphone, or microphone only if you have no camera | So the company can hear your reasoning in your own words; it is never scored | LibeCode's servers (encrypted) | 12 months |
| This consent, versioned and time-stamped | Proof of what you agreed to | LibeCode's servers | 12 months |
What we do not do
- We do not sell or share your data with anyone other than the company and the service providers below. Hashes of your session record (which contain no personal data) are kept indefinitely so the record can be verified later.
- We do not use facial recognition, identity checks or any biometric technology; if the company confirms your identity, it does so itself on its own video call.
- We do not read files outside the exercise or access anything on your computer beyond the page you are on.
- No AI grades you or decides anything about you, and no model assigns points. After you submit, an AI model reads the prompts you sent to the assistant, with the task and what happened after each prompt, and writes a few short observations for the company's reviewers, each backed by a quote from your prompts or a fact the session recorded; they give no score and do not change your score. Apart from that review, the only AI in the product is the assistant you direct, and it grades nothing.
- We do not use your camera or microphone during the exercise, and we do not record your screen. During the exercise nothing needs a permission from your browser other than fullscreen; the check before you start asks for your camera and microphone only for the closing statement.
- We do not read your keystrokes. Activity is counted, never recorded.
- Your camera and microphone are used only for the closing statement, after your work is submitted; nothing watches or listens during the exercise, no AI analyses the recording, and it is never scored.
How the score is produced
Your score is a checklist computed from hidden tests, fixed lint rules, and the record of what you did, using settings the company chose for this exercise (which models you may use, the budget, the time, how the four groups are weighted, which items are on); the same settings apply to every candidate on this exercise. No AI model assigns points, and no AI model reads your work to grade it. After you submit, an AI model reads the prompts you sent to the assistant, with the task and what happened after each prompt, and writes a few short observations for the company's reviewers, each backed by a quote from your prompts or a fact the session recorded. They give no score and do not change your score. The report shows the company the evidence behind every item. LibeCode does not make or recommend hiring decisions; the company does, and a person at the company is responsible for them. You may ask the company for an explanation of your result and for a human review, or ask LibeCode directly at privacy@libecode.com; LibeCode produces the explanation (each item, its result, and the moment behind it) and notifies the company.
Who can see it
- The company's reviewers, through their LibeCode account.
- LibeCode staff, only to provide support or resolve a dispute.
Where it is kept
"LibeCode's servers" means our database, hosted by Supabase in the United States (East US, North Virginia), where your data is stored, and the server that runs the application, hosted by DigitalOcean in Toronto, Canada, which handles each request in transit and keeps only its request log (no name, no email address and nothing you typed). Data is encrypted on its way between your browser and our server. Wherever you take an exercise from, your data passes through Canada and is stored in the United States, and the server's request log stays on the server, in Canada. So if you are outside the United States, your data is transferred to the United States, and if you are outside Canada, the request log is kept in Canada.
Service providers
These companies run parts of the service for us. Each is bound by contract to use your data only to provide the service.
- CloudflareCarries every page and request between your browser and our server, encrypted.
- DigitalOceanHosts the server that runs the LibeCode application. Your data passes through it in transit, on its way to and from the database. The server keeps only its request log: the address each request asked for and how it was answered, with no name, no email address and nothing you typed. That log stays on the server, in Canada.Toronto, Canada
- SupabaseHosts our database, where everything in the table above is kept, and the sign-in of company accounts.United States (East US, North Virginia)
- E2BRuns the isolated coding environment your workspace lives in during the session: your files and the commands you run.
- ResendSends the email LibeCode sends: the invitation, the one-time code and account email.
- OpenRouterRoutes your prompts and attachments to the AI model you choose. Every request asks it to use only model providers that do not collect user data.OpenRouter's data policy
- The model provider you selectAnswers your prompts, reached through OpenRouter; which company that is depends on the model you pick from the list the company allowed.OpenRouter's list of each provider's policy
- AnthropicAfter you submit, reads your prompts, the task and what happened after each prompt, and writes the prompt review the company's reviewers read beside your report.Anthropic's retention of API data
The AI providers' copies of your prompts
OpenRouter does not store your prompts or the answers unless its customer turns its logging on; it keeps a record of each request's size and timing.
The model provider you select receives your prompts through OpenRouter, and every request asks OpenRouter to use only providers that do not collect user data. How long that provider keeps a prompt to answer it is set by its own policy, which OpenRouter lists for each provider.
Anthropic's commercial terms do not allow it to train models on the prompt review's inputs. It deletes API inputs and outputs within 30 days, except where its usage policy or the law requires it to keep them longer.
Company accounts
For a company that uses LibeCode we keep the name and email address of each person on its account, the company's name and email domain, the exercises it creates, the invitations it sends and a record of account actions. Sign-in runs through Supabase.
We keep this while the company uses LibeCode. To close an account, write to the privacy address above.
This website
LibeCode sets only the cookies this site needs: cookies that keep you signed in, and one that protects forms from being sent by another site. There are no analytics or advertising cookies and no tracking scripts. Cloudflare, which carries the traffic, may set a cookie of its own to protect the site from automated abuse.
Our server logs each request with the address it asked for and how it was answered, to run and protect the service. The log carries no name, no email address and nothing you typed.
Your rights
- Access, correction, deletion. Write to privacy@libecode.com from the address you were invited at, or ask the company. The founders of LibeCode verify the request and answer within 30 days, and within the shorter period any applicable law requires. If you ask for deletion, they delete your interview's recorded data from LibeCode's systems within those 30 days, and the hiring company is told. The model providers' copies of your prompts are governed by their retention, stated above, under "The AI providers' copies of your prompts".
- Withdrawal. You can stop the session at any time by submitting or by closing it and not returning. Data captured up to that point is handled as described above, and the company sees how far the session got.
- Where you are. If you are in Illinois, California, the European Union, the United Kingdom or Canada, additional rights may apply under your local law; the company's notice to you covers the ones that depend on where it operates. Nothing on this page reduces those rights.
Complaints
If you are not satisfied with our answer, you may complain to the data protection authority where you live.
Changes to this notice
When this notice changes, the date at the top changes with it. A change to what is recorded during an exercise also changes the consent page, which you accept before an exercise starts.