Privacy Policy

What we collect

• Sign-in. You sign in with Google. Google gives us your name, email address and profile picture. We never see your Google password.
• Your profile. Your timezone, preferred language, level, how many minutes you can study, how long your plan runs, the topics you picked, your notification choices and, if you add it, your LeetCode username.
• What you do in the app. Your answers to Feed cards and how they were graded, check-ins and the notes you add to them, missions and progress, points, mock interview records, stories you write, and the lessons you open.
• Coach. Your chats with the Coach and the short memory notes it keeps about you (such as a habit or a weak spot) so it can help better next time. You can read and remove these in Me, then Settings, then "What Coach knows". When Coach can't find a topic in the Library, we keep the topic name (not your message, and not who asked) so we know what to add.
• Friends. If you invite or accept a friend, we store the invite (their email address) and the link between you. A friend you accept can see your name, picture and progress figures, such as check-ins and mock scores. They cannot read your answers, notes or Coach chats.
• Notifications. If you turn on push notifications, we store the address your browser or phone gives us for them.
• Problem reports. What you write, plus the page, browser and app version, when you use Report a problem.
• Technical data. Like any website, our host sees your IP address and browser details when a page loads. Error reports (a technical description of what broke) and page-speed measurements are collected without your name or email. Counters that stop one account from overusing a feature are kept against your account ID.

Cookies and storage on your device

We set the cookies that keep you signed in (Supabase Auth session cookies). They are essential: without them the app cannot know who you are. One more first-party cookie notes where your first visit came from (for example a LinkedIn link), so we can see which posts bring people in; it is saved once to your profile when you sign up and then deleted, and it expires after 30 days if you never sign up. When you press a sign-in button, a cookie notes which one for an hour, so we can count sign-ups from each place; it is deleted once you are signed in. We use no advertising or cross-site tracking cookies. Vercel Web Analytics counts visits without cookies and without following you across sites. The try page counts what visitors do on it (answers, plays, time on the page) with a random id that lives only for that visit: no cookie, no account, no address. The app also stores a few preferences and an offline copy of pages and cards in your browser so it works on a train. Signing out or visiting the landing page clears the offline copy.

Why we use it

To run the app: sign you in, grade your answers, plan your days, answer you as the Coach, send the notifications you asked for, show friends the progress you agreed to share, keep the service secure and within its limits, and answer your reports. We do not sell your data and we show no ads.

Who else handles it

We use these services to run 90x. Each only gets what it needs for its job.

• Supabase: database and sign-in, hosted in the Mumbai region.
• Vercel: hosting (Mumbai region), plus Web Analytics and Speed Insights.
• Upstash: Redis and QStash, for short-lived state such as your Feed queue, rate limits and scheduled jobs.
• Third-party AI model providers: when you submit an answer for grading, ask the Coach something or request a review, the text needed for that task (your answer or code, your message, the relevant card or problem, and your Coach memory notes and progress summary) is sent to an AI model provider by API. The provider is set in our configuration and can change; the app supports DeepSeek and Anthropic and any OpenAI-compatible service. We do not send your email address. Each provider handles that text under its own terms. AI output can be wrong, so do not treat it as authoritative.
• Resend: sends the few emails the app sends, such as friend invites, account emails (you're in, account deleted), and reports to the owner.
• Apple, Google and Mozilla push services: carry push notifications to your device if you turn them on.
• Sentry: receives error reports when something breaks, when it is switched on.
• Google: signs you in. LeetCode: if you turn on activity sync, your LeetCode username is sent to LeetCode's public pages to read your public submissions.

Some of these companies run servers outside India, so your data can leave India.

How long we keep it

Until you delete your account. Deleting it (see Delete my account) removes your profile, answers, check-ins, Coach chats and memory, friendships, push address, points, reports and sign-in record from our live database straight away. Short-lived copies in Redis expire on their own. Encrypted nightly backups of the database are kept for 14 days, so deleted data is gone from them within 14 days. We keep the AI spend log without anything that identifies you, because it is how we watch our budget. Logs kept by our host follow its retention. Emails already sent stay in Resend's log for its retention period.

When an account is deleted, we keep a short record for 90 days: its email, name, the dates it was created and deleted, and whether you or an admin deleted it, so we can answer questions about it. After 90 days the record is removed and only a count of deleted accounts remains.

Your rights

You can ask to see what we hold about you, have it corrected or have it erased. You can withdraw your consent at any time by deleting your account. To do any of these, use the in-app tools or contact us as described below.

We may block or delete an account that breaks the Terms; if we delete it, we email you.

Security

Traffic is encrypted in transit. The database limits each person to their own rows, and AI and admin features are rate limited and checked on the server. No system is perfectly safe; if a breach affects you, we will tell you.

Children

90x is not intended for anyone under 18. If you are under 18, please do not use it. If we learn that we hold data about someone under 18, we will delete it.

Changes

If this policy changes in a way that matters, we will update the date at the top.

Contact

Contact: support@mail.90x.amanarya.com. This is a personal project; requests are handled on a best-effort basis.