Privacy Policy

When you sign in with Google or GitHub, we receive your email address, full name, and avatar URL from that provider. We do not receive or store your password for either provider.

Trying a curated Story Mode scenario, or the free preview chat on a curated canvas scenario, does not require an account. For an anonymous session we do not collect your name, email, or link anything you do to a profile. The one exception: for the free preview chat specifically, we temporarily record your IP address, solely to enforce a daily limit on how many messages you can send without an account. It is never linked to any profile or account, is not used for anything else, and is automatically deleted once that day's limit window passes. If you sign in afterward, that starts a fresh, separate session under your account — it does not carry over what you did anonymously.

If you sign up through a friend's invite link, we record which account referred you, solely to grant both of you a bonus session once you complete your first graded scenario. We don't use this to build a social graph, and we don't display anywhere who referred you or who you've referred.

When you use the simulator, we store the architecture scenario assigned to you, the diagram you build (component types and connections — not screenshots or personal content), which phase of the session you're in, and the final score once a session completes.

We also collect product usage analytics: which pages you visit, which features you use (e.g. starting a scenario, triggering Chaos Roulette, completing a session), and coarse session-progress events. This is tied to your account once you're signed in, so we can understand how the product is actually used and where people get stuck — not to build an advertising profile. These events are automatically deleted after 180 days.

• To authenticate you and keep your sessions associated with your account.
• To send your submitted architecture and chat messages to Google's Gemini API for evaluation and to generate scenarios — see Third parties below.
• To compute your aggregate career score across past sessions.
• To understand product usage and improve the experience — see Third parties below.

We do not sell your data, and we do not use it to train our own models.

Three features let you generate a public link that anyone can open without signing in: sharing a graded session's result, challenging a friend to attempt the same scenario, and inviting a friend to sign up. A result-share link shows your overall score and the AI's design rationale (a plain-language summary of what you built and why) and, only if you choose the "Full" option, also the AI's post-mortem and reference design — it never shows your email or account details. A challenge link shows your first name (if set on your profile) and the scenario's title and background — it never shows your score, your architecture, or any other session data. An invite link shows your first name (if set) and nothing else — it never shows your email, score, architecture, or any other account details. Result-share and challenge links are created only when you explicitly generate one from a session, and can be revoked at any time from the same place you created them; your invite link is generated once from your Profile page and stays the same afterward.

We use Supabase for authentication, data storage, and product usage analytics (page views and feature-usage events, not the content of your architecture or chat messages — this data does not leave our own database), and Google's Gemini API to generate scenarios and evaluate your submissions. Content you submit to the AI panel — including your serialized architecture diagram and chat messages — is sent to Google for processing under their API terms.

If you subscribe to Pro, payment is processed by Razorpay, which receives what's needed to complete the charge (name, email, and payment details) directly — we never see or store your card or UPI details ourselves. We also use Vercel Web Analytics for aggregate, privacy-respecting traffic metrics (page views and referrers) — it does not use cookies and does not tie activity back to your individual account.

We use Zoho ZeptoMail to send transactional email — a referral bonus notification, or a Pro subscription confirmation, renewal reminder, or end-of-Pro notice. It receives your email address and name for this purpose only; we don't use it for marketing email.

You can permanently delete your own account at any time from your Profile page — this immediately removes your profile, architecture sessions, and career score. Billing records (plan, amount, dates) are retained afterward with the personal link removed, since Indian tax law generally requires payment records to be kept for several years regardless of account deletion. Separately, an architecture session you start but never finish is automatically deleted after 90 days of inactivity — a completed, scored session is never affected by this and is only ever removed by the account deletion above. The same Profile page also lets you export a copy of your data at any time. For anything this self-service flow doesn't cover, email support@chaosbench.com.

If you are located in India, the Digital Personal Data Protection Act, 2023 gives you the right to access, correct, and erase your personal data, and to withdraw consent at any time. Export and erasure are self-service from your Profile page; correction is via the same page's account details form. For anything not covered by the self-service tools, or to raise a grievance about how your personal data is handled, contact our designated Grievance Officer at support@chaosbench.com. We aim to acknowledge grievances within 7 days and resolve them within 30 days.

Questions about this policy or your data can be sent to support@chaosbench.com.