legal

Privacy Policy

Last updated 27 September 2026.

This explains what Crack The Loop collects, why, who else ever sees it, and how to get it back or have it deleted. It covers the site at cracktheloop.net and the coaching application at app.cracktheloop.net.

The short version: we run our own servers, your session recordings never leave them, we have no analytics or advertising trackers of any kind, and we do not sell anything about you to anybody.

1. Who we are

Crack The Loop is operated by Bruno Albuquerque, 19053 Planetree St, Orlando, FL 32827, United States, which is the data controller for the information described here. Reach us at admin@cracktheloop.net.

2. What we collect

What	Details
Account	Your name, email address, and a hashed password (we store a bcrypt hash — never the password itself). If you sign in with a passkey, we store its public key. Optionally a profile picture you upload. Your time zone, read from your browser, so times are shown and emailed correctly. Whether you want occasional email about offers.
Coaching record	Your sessions and bookings, the program they belong to, your coach's agendas, scorecards and recaps, homework you were set, what you submitted, and the messages you exchange with your coach in the application.
Session content	What is produced in the room: code you write and run, whiteboard drawings and notes. If you share your screen, periodic screenshots of what you shared. This is the substance of the coaching and is kept so you can review it.
Recordings	Audio of sessions that are recorded, and the transcript generated from it. See section 4.
Payments	What you bought, what it cost, and whether it has been settled. We invoice rather than take card details, so we never see or store a card number.
Technical	Ordinary server logs — IP address, timestamp, the page or endpoint requested, and your browser's user-agent — kept to run and secure the service.
Calendar	Only if you connect one. See section 5.

We do not collect special category data, we do not build advertising profiles, and we run no analytics, tag managers, session replay or third-party trackers on either the site or the application.

3. Why, and on what basis

To provide the coaching you bought — your account, bookings, sessions and the record of them. Basis: performance of our contract with you.
To contact you about your sessions — invitations, reminders, recaps, payment instructions. Basis: performance of our contract.
To keep the service working and secure — logs, abuse prevention, backups. Basis: our legitimate interest in running a reliable service.
To write your sessions into your calendar — only if you connect one. Basis: your consent, withdrawable at any time by disconnecting.
To meet legal and accounting obligations — records of what was sold. Basis: legal obligation.

4. Recordings and transcripts

Sessions may be recorded so you can go back over them. Recording is disclosed in the room before it begins.

Your audio never leaves our servers. Transcription runs locally on the same machine that stores the recording — there is no third-party speech service, no cloud transcription API, and no AI provider involved. Nobody outside Crack The Loop receives your session audio.

The same is true of live captions: when they are switched on, they are produced in your own browser and the audio behind them is not sent anywhere for the purpose.

Screenshots of a screen you share are stored beside the recording and treated the same way.

Recordings, screenshots and transcripts are visible to you and to the coach who ran the session. You can ask us to delete a specific recording at any time without closing your account.

5. Google Calendar

Connecting a Google Calendar is optional, and everything below happens only if you choose to connect one.

We ask Google for the narrowest permissions that do the job:

calendar.events — to write, update and remove your Crack The Loop sessions on your calendar. We only ever touch events we created. We do not read, change or delete anything else in your calendar.
calendar.freebusy — to see when you are busy, so a session is not offered at a time you are not free. This returns times only. It does not tell us the titles, guests, locations or contents of your other events, and we never see them.
openid and email — to show you which Google account is connected, since people have several.

We deliberately do not request the broad calendar scope, which would hand over every calendar you own and your calendar settings.

Google's access and refresh tokens are encrypted before they are stored, with a key derived from a deployment secret held outside the database.

Disconnecting takes the events we created off your calendar and deletes the stored tokens. You can do it at any time from Settings in the application, and independently from your Google account permissions page.

Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google user data to train generalised AI models, we do not transfer it except as needed to provide the feature you asked for, and we do not sell it.

6. Live calls

Session audio is sent directly between you and your coach where the network allows it. To set that up, browsers use a STUN server, which sees the IP addresses of both ends but none of the conversation. We currently use Google's public STUN server for this, so your IP address is visible to Google during call setup.

Where a direct connection is impossible — a restrictive network or firewall — audio is relayed through our own TURN server, which we operate ourselves on the same infrastructure as everything else.

7. Email we send you

Most of the email we send is about your own sessions — invitations, reminders, recaps, payment instructions and calendar attachments. You cannot turn these off while you have sessions booked; they are how the service works.

We may also send you occasional email about offers and coaching. You can turn that off in Settings, or with the unsubscribe link in any such message, without affecting anything else.

8. Cookies

Every cookie we set is strictly necessary — the application does not work without it — so we do not ask for consent to set them:

slate_session — keeps you signed in. Expires after 7 days.
slate_oauth — holds the in-flight state of a sign-in redirect. Expires after 10 minutes.
slate_webauthn — holds the in-flight challenge while you use a passkey. Short-lived.
A branding cookie, which remembers which organization's portal you arrived through. Expires after 30 days.

Your browser may also keep small preferences locally, such as light or dark theme. These never leave your device.

There are no advertising, analytics or cross-site tracking cookies. We do not use any, on either the site or the application.

We do not sell your information, and we do not share it for anybody else's marketing. It is seen by:

Your coach — your sessions, your work in them, and the record of your coaching. That is the service.
Our administrators — where needed to run the service, answer a support question or settle a payment.
Our email provider — messages we send you are delivered through Google's SMTP relay, so the message and your address pass through it.
Google Calendar — only if you connected it, and only your session details, as described above.
Google's public STUN server — your IP address during call setup, as described in section 6. No audio and no content.
Authorities — if we are legally required to, and we will tell you unless we are forbidden from doing so.

That is the complete list. There is no advertising network, analytics provider, data broker, AI provider or content delivery network in it.

10. How long we keep it

Your account and coaching record — while your account is open.
Session audio and screen-share screenshots — 90 days after the session, then deleted automatically.
The keystroke-by-keystroke replay — 30 days, after which it is collapsed to the final state of the work. What you ended up with survives; the recording of you typing it does not.
Transcripts, and the final code, whiteboard and notes — 12 months. The transcript is written before the audio is deleted, so the record of what was said outlives the recording of it, in a far smaller and less sensitive form.
You can ask us to delete any recording, screenshot or transcript sooner, at any time, without closing your account.
Records of email we sent you — 30 days, then deleted automatically. This is the delivery record, not the coaching record.
Server logs — no longer than 30 days.
Invoices and payment records — kept as long as accounting and tax law requires, even after an account is closed.
The audit log — a record of administrative actions, kept for security. It survives account deletion.

Deleting a recording does not delete the coaching. The record of your sessions survives all of the above for as long as your account is open: that a session happened, when, with which coach and on what, your coach's scorecard and its comments, the agenda and the recap, your program, your homework and what you submitted, and the messages you exchanged. Retention removes the recording of a session — the audio, the screenshots, the replay of you typing — and never the written record of it.

So a year after a session you still have everything you would look back on: what was covered, how you were scored, what your coach advised, and what you were asked to work on. What has gone is the media — and the transcript, which by then has outlived the audio it was made from by nine months.

11. Your rights

Depending on where you live, you have some or all of the following rights over your information: to access it, to have it corrected, to have it deleted, to restrict or object to our use of it, to portability, and to withdraw consent where we relied on it.

Much of this you can do yourself in the application — your record is visible to you, your profile is editable, your calendar is disconnectable and your account is deletable. For anything else, write to admin@cracktheloop.net and we will respond within 30 days.

If you are in the UK or the EEA and you think we have handled your information badly, you may complain to your local data protection authority. We would rather you told us first.

12. Deleting your account

Settings → delete account in the application. It permanently deletes your account and everything you own — your sessions, your recordings, and anything you created. It cannot be undone.

Three things survive it, and only these:

records we must keep for accounting and tax;
the security audit log, which records that an administrative action happened rather than what you did in a session; and
material another person or organization owns that refers to you — a coach's own notes about a session they ran, or a record an organization holds about somebody it interviewed. Where such a record was linked to your account, deleting the account severs the link.

13. How it is protected

Everything travels over HTTPS.
Passwords are stored as bcrypt hashes; we cannot read them, and neither can anybody who obtains the database.
Calendar tokens are encrypted at rest with a key held outside the database, and linking is refused outright rather than storing them unencrypted.
Access to the production systems is limited to the people who operate them.
Backups are taken regularly and kept on separate infrastructure.

No service can promise perfect security. If a breach affects you, we will tell you and the relevant authority as the law requires.

14. Where it is stored

Your information is stored on servers we control in the United States, in our own database and object storage rather than on a third-party platform. The exceptions are the two services named in section 7: email delivery, and Google Calendar if you connect it. Both are operated by Google and may process data outside your country under their own safeguards.

15. Children

Crack The Loop is for adults preparing for professional technical interviews. It is not intended for anyone under 18, and we do not knowingly collect information from children. If you believe a child has given us information, tell us and we will delete it.

16. Changes

We may update this policy. The date at the top always reflects the current version, and if a change materially affects how we handle your information we will email you before it takes effect.

17. Contact

Questions, requests, or a complaint: admin@cracktheloop.net.