Privacy
Who we are
The data fiduciary for your personal data is Unaided, a sole proprietorship, trading as Unaided, of Villa 119, The Empyrean, Near Chikkathiruparthi Temple, Malur, Karnataka 563160 (“Unaided”, “we”). Contact: support@unaided.app. Grievance Officer: Siddhartha Pal, grievance@unaided.app. This policy follows India’s Digital Personal Data Protection Act, 2023 (DPDP Act) and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011.
What we collect
Account: your email, name, the time zone you confirm, and your Google account identifier and verified email if you use “Sign in with Google”.
Plan and practice data: your track, plan length, hours, interview date; what you log (minutes, hints used, outcomes, insights, evidence, the code, answers and notes you write, how long each block’s clock ran); your resume details (stack, years of experience, a short list of skills), never the file.
Editor and integrity signals: counts of paste attempts we blocked and of sudden insertions, how fast an answer was typed, whether the window was hidden, and whether you are active or idle. We never see your screen, other tabs or apps, or what you type outside Unaided.
Payment metadata: the amount, pass, time, Razorpay order and payment IDs and status. Razorpay collects your card, UPI or bank details; we never see or store them.
Bug reports: the text you write, the page you were on, browser and screen size, app version, recent error messages from our own code, and an optional screenshot.
Device and log data: IP address, browser user agent, and request logs needed to run and secure the service.
Partners, referrals and witnessing: who you partner with or refer, and the records described in “How work is checked”.
Cookies and browser storage
We use only what the service needs, and no advertising or analytics cookies. Cookies: “refresh_token” (secure, HTTP-only, keeps you signed in); “unaided_in” (a marker that a session exists, so referral links behave correctly); “unaided_mlb” (binds a sign-in link to the browser that asked for it, short-lived); “gh_bind” (only while you connect GitHub, short-lived); “unaided_ref” (holds a friend’s referral code for up to 30 days). Browser storage: your light or dark choice, your language choice, a dismissed time-zone prompt, a short-lived access token and your onboarding draft in session storage. Clearing them signs you out or resets those choices.
Why we use it, and on what basis
We process your personal data on your consent, given when you create an account and accept these documents, and for the limited “legitimate uses” the DPDP Act allows (for example, performing what you asked for, complying with the law, and keeping the service secure). Purposes: to create your account and sign you in; to build and run your plan; to verify how work was done (see “How work is checked”); to take payments and issue refunds; to send the reminders and receipts you asked for; to prevent abuse and fraud; to triage bug reports; to answer support and grievance requests; and to meet legal and tax obligations. We do not use your data for advertising and do not sell it.
Your resume
Your resume is read in your browser. We keep what we found in it — your stack, years of experience and a short list of skills — and never upload or store the file.
Partners
If you add a partner, they see whether you finished each day and your day score. Nothing else: not your insights, evidence, problem times or pass. Either of you can remove the other at any time.
Reminders
Email reminders use the address you sign in with, at most once a day, only if you haven’t started. Switch them off in Settings.
How your plan adapts
Your plan adapts to how you practise. It uses what you already record here: problem outcomes and hints, time per problem, how each block was checked (tests, your partner, or self-reported), and the editor’s paste and sudden-insertion counts. It also uses the role, level and interview date you choose. Nothing extra is collected, nothing leaves Unaided, and nobody else sees it. You can turn it off in Settings → Plan → Adapt my plan.
What we don’t
Idle detection tells us one thing: whether you’re active or idle. We never see what you type, which apps or tabs you use, or your screen. We don’t use advertising trackers.
During a timed attempt your browser also records simple counts and times: when text was pasted, when you switched tabs or the window lost focus, and for how long. We keep them with the attempt so your score can show whether it was earned cleanly. We do not use your webcam or microphone, we do not record your screen, and we do not read other tabs or apps. These signals show what was detected; they do not prove intent, and they stay private to you unless you choose to share a result.
Who sees it
You. Sharing is off until you turn it on, one result at a time. A shared page or card shows only the numbers and wording you chose to share, only for a clean attempt, and goes only where you send it. Switching sharing off stops the link working. We never share a failed attempt, your resume, your code or your account details; a link is public to anyone who has it. Our team can see data only as needed to run the service, answer your request or investigate abuse. We don’t sell or rent data to anyone.
Where it lives
In a Postgres database on a server we run, with nightly backups kept for 14 days. Everything between your browser and Unaided travels over HTTPS.
Who processes it
Razorpay processes payments: it receives your email, the amount and what you bought, and keeps its own payment records as Indian law requires. Amazon Web Services sends our emails through Amazon SES: it receives your email address and the message. Google handles “Sign in with Google” if you use it. Our hosting provider runs the server the database lives on. GitHub, only if you connect it in Settings: we read the commits in the repositories you choose, to check a commit link you submit, and we store no code, file names or commit messages. You can disconnect at any time in Settings, and uninstall the app on GitHub. Sentry receives error reports from our server, with emails, request data and cookies scrubbed out before they leave it. Our support mailbox is hosted by Zoho, which receives what you write to us. None of them may use your data for their own purposes.
Where your data goes
Our server is hosted with Amazon Web Services (Lightsail) in India. Unaided is open to people worldwide, so your data may be processed in, or reach us from, another country. Payment, sign-in, GitHub, error-reporting and support services we use may process data outside India. The DPDP Act permits transfers to other countries except any country the Government of India restricts by notification, and we do not transfer data to a restricted country. Each processor is bound to use your data only for the service it provides to us.
How work is checked
Unaided marks each finished block as verified, witnessed or self-reported. Verified means a machine checked your work: your answer passed the tests, or a framework exercise passed, or a GitHub commit you submitted was written by you during the block. Witnessed means your partner, an established member with a track record of their own, watched your mock live and confirmed it. For that we keep the time they opened the session link and how long they stayed (measured by our server), the short rubric they wrote and whether they chose to show their first name. They see only your first name, the topic and the date, never your answers or scores. Self-reported means you said so and nothing checked it. A GitHub check keeps only the repository name, the commit ID, which checks passed, a count of files and changed lines, and a reason if it failed. It never keeps code, file names or commit messages, and the GitHub token is encrypted and can be removed in Settings. Text you write in an optional design write-up, and your answers to system-design questions, are kept for 7 days and then erased; the verdicts stay. System-design questions are marked by fixed answer keys in our own code, with no AI involved.
Automated decisions
Some outcomes are decided by software: the verification tier of a block, whether your system-design answers pass the fixed answer key, and whether sudden insertions in the editor are counted against a block. They affect the label on your work, not your access to Unaided or your payments. No one is suspended or refused a refund by software alone. If you think one is wrong, write to support@unaided.app or the Grievance Officer and a person will review it and reply.
Bug reports
When you send a bug report we keep what you wrote, the page you were on (without query strings), your browser and screen size, the app version, and the last few error messages from our own code, which never include your answers or code. You see all of it before you send. A screenshot is optional: we strip its hidden metadata, keep it on our server for 90 days, and only our team can open it. Reports are read by our team, who email you if it earns a free day. Reports and screenshots are included in your export and erased when you delete your account.
How long we keep it
Account, plan and practice data: while your account is open. After you ask to delete your account it is removed after 30 days, and from our backups within 14 days after that. Code you run: the code text is erased after 7 days, while results and timings stay. Design-check text: 7 days. Bug-report screenshots: 90 days, or earlier if you delete your account. Backups: 14 days. Server logs: kept for a short operational period (no more than 30 days) and then rotated. Payment, tax and refund records: kept as long as Indian law requires, even after deletion, by us and by Razorpay; after deletion we detach them from you, so they no longer carry your account, name or email. Deletion record: when you delete your account we keep, for 12 months, a one-way salted fingerprint of your email (and of your Google identifier), whether your first day was used and whether you held an early-bird seat, so that deleting and signing up again does not give a second first-day price or free up an early-bird seat; an early-bird seat number stays counted without any link to you. Account-closure records we must keep by law are held separately and used for nothing else.
Security
We use HTTPS everywhere, store sign-in and GitHub tokens encrypted or hashed, keep the database on a private network, limit staff access to what the job needs, rate-limit sign-in and sensitive actions, and keep a short list of administrators. No system is perfectly secure. We follow reasonable security practices under the IT (SPDI) Rules, 2011.
Your controls
Export everything as JSON from Settings. Delete your account from Settings: it’s removed 30 days after you ask, and from our backups within 14 days after that. Payment records Razorpay keeps are outside this and are kept as the law requires.
Your rights
Under India’s Digital Personal Data Protection Act, 2023 you can ask for a summary of the personal data we hold and who we share it with, ask us to correct, complete, update or erase it, withdraw your consent at any time (deleting your account does this, and withdrawal does not affect what we did before), and nominate someone to use these rights if you die or can’t act. Use Settings (export and delete) or write to support@unaided.app; we reply within 30 days. We use your data only to run Unaided for you. You must give accurate information, must not impersonate anyone, and must not file false or frivolous complaints.
Children
Unaided is for working professionals and adults. You must be 18 or over. We do not knowingly collect data from anyone under 18. If we find that an account belongs to someone under 18 we will delete it and its data. If you think this has happened, write to us.
Data breach
If a personal data breach affects you, we will tell you, and we will tell the Data Protection Board of India, as the DPDP Act requires. We will say what happened, what data was involved, and what you can do.
Grievances
Our Grievance Officer is Siddhartha Pal, at grievance@unaided.app. We acknowledge a complaint within 48 hours and resolve it within one month (30 days). If you aren’t satisfied, or we don’t respond, you can complain to the Data Protection Board of India once it is operating, after first raising it with us.
Changes to this policy
If this policy changes in a way that matters, we’ll email you before it takes effect, and the version and date at the top will change. Continuing to use Unaided after the date means you accept the update; if you don’t, you can delete your account.
Contact
Questions go to support@unaided.app. Our full contact details are on the Contact page. See also the Terms of Service.