Privacy Policy

What DiffDojo collects

DiffDojo collects only the information needed to run the training product:

• When you sign in with Google OAuth, we store your Google account email, display name, avatar URL, and stable Google account ID.
• When you are signed in and submit a review, we store your review attempt results, including the challenge, category, pass/fail result, verdict correctness, issue counts, and timestamp.
• When you are not signed in, we store usage events such as the PRs you open and the reviews you submit (your comments and verdict included), with your country as Cloudflare reports it, how you arrived (for example a referring site), and a pseudonymous fingerprint computed from your IP address and browser user agent with a secret salt. The fingerprint links your visits to each other; these rows are not tied to an account or email.
• If you send feedback, we store the message, the optional reply email you type, and your user ID if you are signed in.
• If you answer "Was this grade fair?" on a result, we store your answer, the optional note you type, which review it is about, and your user ID if you are signed in. If you are not signed in, we link it to your review through a pseudonymous fingerprint computed from your IP address and browser user agent (the same one we use to count visits); it is not your name or email, but it does link your visits to each other.
• If you join a waitlist, we store your email address, the waitlist kind, and your user ID if you are signed in.
• If someone creates a take-home review link for you, we store the name or email they typed for you. If you agree to share your results with them, we also store your reviews (comments, verdicts, what you caught, time per PR) and show them to that person only (your comments are also sent for grading, see Service providers). We delete all of this 90 days after you finish, or 90 days after the link expires if you never finish.

Cookies and sessions

DiffDojo uses a session cookie named session. It contains a signed JWT, expires after 7 days, and is set with HttpOnly and SameSite=Lax. In production it is also marked Secure.

Service providers

Google provides OAuth sign-in. To grade a review that has comments, DiffDojo may send the comments you wrote, together with the challenge’s code, requirements and answer key, to OpenAI. It may also send your comments with the challenge’s code, requirements and grading rubric to TypeSafe for a second grade that we store only to check how well our grading works; it never changes your result. Take-home reviews are graded the same way. We do not attach your email, name, or account ID to these requests, but anything you type in a comment is sent as written. We do not use third-party analytics, advertising trackers, or ad networks.

How data is used

We use the data above to authenticate accounts, show progress, grade review attempts, understand product usage, reply to feedback, and maintain waitlists. We do not sell personal data.

Deletion

To request deletion of your account data, feedback, or waitlist email, contact [email protected]. We may need enough information to verify which records belong to you.