Privacy Policy

We collect the following information when you use Aceloop:

• Account Information: Email address and password (hashed) when you create an account.
• Hardware ID: A one-way hash derived from your machine's hardware identifiers, used solely for license key binding.
• Payment Information: Processed entirely by Stripe. We do not store credit card numbers, CVVs, or full billing details on our servers.
• Usage Data: Basic server logs including IP addresses, request timestamps, and error reports for operational purposes.
• Product Telemetry: Server-side records of product events — downloads, app registration, usage and quota counts, update checks, license activation — derived from the API calls the apps make, plus loader-reported install, sign-in, download, and launch outcomes with one-time device context (OS version, locale, timezone, screen geometry). Analytics identities are synthetic random IDs; raw hardware IDs and IP addresses are stored only as HMAC-SHA256 hashes. Interview content (problem text, code, terminal output) is never collected as telemetry, and the overlay sends no analytics beacons during a session.
• Browser Proctor Session Data: If you use Browser Proctor, the app may request webcam, microphone, and screen-share permissions and may process focus changes, clipboard activity, keyboard shortcuts, screen geometry, browser-environment signals, timing data, and code-progression metadata during the session.

• We do not store full payment card numbers, CVVs, or raw Stripe payment credentials on our servers.
• We do not use third-party advertising trackers or sell your personal information.
• We do not grant third parties independent access to your browser-proctor session unless required to operate payment, hosting, authentication, or support infrastructure.

• To create and manage your account.
• To validate your license key and bind it to your device.
• To process payments via Stripe.
• To send transactional emails (account creation, password resets, purchase confirmations).
• To run browser-proctored coding sessions and classify integrity or environment issues when you use Browser Proctor.
• To diagnose errors and improve the Service.

When you use the Free tier of Aceloop, the desktop app sends the following anonymous identifiers to our servers:

• Hardware identifier (HWID): Computed from a hash of your computer's hardware characteristics, such as Windows MachineGuid, CPUID, motherboard SMBIOS UUID, and baseboard serial. We store only a cryptographic hash of this value (HMAC-SHA256 with a server-side secret), never the raw HWID.
• IP address hash: Your IP address is stored only as an HMAC-SHA256 hash.
• Machine token: An opaque random token we issue to your device on first launch to enforce the three-problem Free trial limit.
• Download and install attribution IDs: A random download ID attached to the download link and a random install ID minted by the loader, used to connect a website download to a first app launch for funnel measurement. Both are coin-flip random identifiers — not derived from your hardware or your identity.

We use these identifiers to enforce the Free trial limit per machine, detect abuse such as repeated token resets, and understand aggregate Free tier usage. We do not associate these identifiers with your name, email, or other personally identifiable information unless you choose to upgrade to a paid tier and provide that information at checkout.

You can clear your local machine token at any time by deleting %LOCALAPPDATA%\aceloop.ai\free_machine.json. This will not refund any free problems already used because the server retains the machine binding via the hashed HWID, but it stops the local token from being sent on future launches.

We use the following third-party services:

• Stripe: Payment processing. Subject to Stripe's Privacy Policy.
• Google OAuth: Optional sign-in. Subject to Google's Privacy Policy.
• OpenRouter: AI model routing for the desktop application. Extracted context (problem text, your code, terminal output; no raw pixels or screenshots) is sent to OpenRouter's API and is not stored by Aceloop.
• PostHog: Product analytics. Receives validated funnel events with synthetic identifiers only — never raw hardware IDs, IP addresses, license keys, or interview content. Desktop events route through our server first; nothing on the desktop talks to PostHog directly. Subject to PostHog's Privacy Policy.
• Google Cloud Platform: Infrastructure hosting.

We retain account and billing data for as long as your account is active. If you request account deletion, we will remove personal data we are required and able to delete within a reasonable period, subject to legal, tax, fraud-prevention, and support obligations. Operational server logs are typically retained for up to 90 days. Browser-proctor session data may remain local to your browser session unless you explicitly submit or share it with us for support or review.

We use industry-standard security measures including encrypted connections (TLS), hashed passwords (bcrypt), and secure cookie handling. However, no method of transmission or storage is 100% secure.

You have the right to:

• Access the personal data we hold about you.
• Request correction of inaccurate data.
• Request deletion of your account and associated data.
• Reset your hardware ID binding at any time via the dashboard.

To exercise these rights, contact us at support@aceloop.ai.

We use a single httpOnly authentication cookie to maintain your session. We do not use tracking cookies, analytics cookies, or third-party advertising cookies.

The Service is not intended for individuals under 18. We do not knowingly collect data from minors.

We may update this Privacy Policy from time to time. We will notify you of significant changes by posting a notice on our website.

For privacy-related questions, contact us at support@aceloop.ai.