Privacy notice

What we collect

• Account: your email address and any profile details you add (name, handle, bio, photo). Your password is held by Amazon Cognito; we never see it.
• Practice: your code, runs, submissions, results, the hints you open, and your progress.
• Assessments: what the organization's form asks for, the acknowledgements you tick, your answers, code and results, and when you started, saved and finished. If the organization turns them on: when the window loses focus, the tab is hidden or the window is resized, and when copy or paste is blocked. Answers may be compared with each other to spot copying; the organization reviews this.
• Feedback: your message, a contact email if you aren't signed in, the page you were on (link tokens and query removed), screen size, browser, site version, and your account or assessment attempt, or your IP address if you aren't signed in.
• IP address: counted briefly to limit how many requests can be made.

Who sees it

• Your assessment data: the owners and invigilators of the organization that ran that assessment.
• Your practice data: not shared with organizations or other users.
• Feedback: Crucible's administrators. A notice of each is emailed to controller@malkyon.in, up to a limit each hour.

Where it is stored

We store data on AWS in the Mumbai region. AWS also sends our emails: sign-in codes and, when the organization chooses, your results. We don't sell your data or use it for advertising.

Logs, metrics and cookies

The service keeps logs of requests and events, and the output of programs you run, for 7 to 30 days. Passwords, sign-in tokens and assessment link tokens are not logged. It also counts requests and timings with no personal identifiers. There are no analytics, no click tracking and no tracking cookies. Your browser stores only your sign-in, preferences and unsaved drafts; signing out clears them.

How long we keep it

• Assessment records: deleted automatically after the organization's retention period, 7 days after the assessment closes unless it sets 1 to 365 days.
• Platform event records: 90 days.
• Feedback: 365 days.
• Account and practice data: until you ask us to delete them.

Seeing or deleting your data

Write to controller@malkyon.in to see, correct or delete your data. You can edit your profile yourself. For an assessment, the organization that ran it decides about its records; we will pass your request on.