Privacy Policy
AdversaryAI is operated by Tech Shepherd LLC, an Arizona limited liability company ("we", "us"), at getadversaryai.com. This policy explains what we collect, why, and the choices you have.
What we collect
- Account: your email address and a salted, hashed password. We never store your password itself.
- Practice sessions: the text of what you and the AI opponent say, your chosen mode and settings, and the scores and feedback generated for you. If you use voice input, your speech is turned into text in one of two ways. On Android and in browsers without built-in speech recognition (such as Brave and Firefox), your audio is streamed from your browser to Microsoft Azure Speech to turn it into text, only while the mic is on; it is not stored by us. Elsewhere your browser's built-in speech recognition does it, and depending on your browser the audio may be sent to its maker's speech service (for example Google in Chrome, Microsoft in Edge, Apple in Safari), under that company's privacy terms. Either way we receive only the resulting text and never record or store audio of your voice.
- Billing: payments are processed by Stripe. We receive your subscription status and a Stripe customer ID; we never see or store your card number.
- Usage & device data: replies used, timestamps, IP address (for security and rate limiting), the country that IP address is in (from Cloudflare, kept to understand where visitors come from and what we can offer them), browser type, and privacy-friendly analytics from Cloudflare Web Analytics.
- Advertising measurement: if you arrive from an ad, we may store the campaign parameters (UTM codes) and use advertising pixels (such as Meta, TikTok or Google) to measure sign-ups and purchases. In the EU/UK these load only after you accept the cookie notice.
- Creator referrals: if you arrive through a creator's link or enter a creator's code, we keep that code in a cookie (aai_ref) and in your browser's storage for up to 60 days, and save it with your account when you sign up, so we can pay the creator. Creators see counts and amounts only, never your name or email. In the EU/UK the link is remembered only if you accept the cookie notice or type the code yourself.
How we use it
- To run your sessions: your text is sent to our AI providers to generate the opponent's replies, speech and scores.
- To bill you, enforce plan limits, prevent abuse, and provide support.
- To email you: account messages (password resets, payment problems) and practice emails (reminders, weekly summaries and plan offers). Every practice email has an unsubscribe link.
- To improve the product using aggregate, de-identified statistics.
- We do not sell your personal data, and we do not use your sessions to train AI models.
Who processes your data
- Microsoft Azure — AI language model responses, text-to-speech and speech-to-text (United States).
- Cloudflare — hosting, database, security and analytics.
- Stripe — payments and subscription management.
- Resend — sends account and practice emails to your email address.
- Tavily — web search for the company and field research in paid Interview Gauntlet runs. It receives the company name, the job's location, the job title and key skills of the job, and, if we couldn't read it ourselves, the job posting link you gave; never your résumé, background summary, name or email address.
Résumés, LinkedIn profiles and job postings (Interview Gauntlet)
If you add a résumé or LinkedIn profile file, your browser reads the text from it on your device; the file itself is never uploaded. That text, or text you paste, is sent through our server to Microsoft Azure to write a short summary, and we do not store it. We keep the summary you approve with that practice run and its interview sessions, and send it to the AI during those interviews so the interviewers can refer to your background. It is deleted when you delete the run or your account. Before the AI reads that text, we remove the web links, email addresses and phone numbers we recognise in it. We also ask the AI to leave out names, contact details, links, dates, graduation years and other personal details interviewers should not use, and we remove the links, email addresses and phone numbers we recognise from its summary too. If you notice anything personal left in the summary, edit it out or remove the summary before you create the run. We do not open LinkedIn, and we never ask for your LinkedIn password. We do not use any of this to train AI models.
If you give a job posting link, our server fetches that public page once to read the job. The posting text, or text you paste, is sent through our server to Microsoft Azure to write a short summary, and we do not store it. We keep only the summary you approve (or the text you choose to use as pasted) with that practice run and its interview sessions, together with the site's name and the day it was read, not the link. It is deleted when you delete the run or your account. We do not open LinkedIn, Indeed, Glassdoor or ZipRecruiter pages. We do not use any of this to train AI models.
Company research (paid Interview Gauntlet runs)
If you buy a run, or you have a paid plan (monthly, yearly or paid through ESA) or a plan we gave you, a reply pack you bought, or membership of a paid team or club season, we research the job on the public web for your interviewers. Free replies, promotional or bonus replies and free team pilots don't include it. For the research, we search through Tavily for the company name and job title you entered, the job's location (so we find the right employer when several share a name), a few key skills of the job and recent news about the company. If we couldn't read the job posting link you gave, we may also ask Tavily to read that public page once; we don't keep the link or the page's text. An AI (Microsoft Azure) writes a short summary of what the public pages say (it also reads the start of the job posting text you approved, only to tell which employer is meant), and we keep that summary, with the links of the public pages it comes from, in that run until you delete the run or your account. Your interviewers use it like any interviewer who knows their own company. Search results are also kept in a shared cache for up to 7 days under a one-way code made from the search, so the same search isn't repeated. We never send your résumé, background summary, answers, name or email address to Tavily. Guest runs, runs that use only free, promotional or bonus replies, and runs by members of a free team pilot are never researched.
Sharing sessions publicly
Sessions are private by default. You can choose to publish a session to the Community Arena, which makes its transcript and scores visible to anyone with the link. You can unpublish it at any time from your History.
Cookies
We use two essential cookies: one keeps you signed in, and one (aai_dev, kept for up to 400 days) recognizes your browser so each browser gets one set of free replies. If you arrive through a creator's link, we also set a creator-referral cookie (aai_ref, up to 60 days), described above. Advertising cookies are used only as described above.
Retention & deletion
We keep your account and sessions until you delete them. You can delete individual sessions from your History, and you can delete your entire account (including all sessions) from Account → Delete account. Deletion is permanent. Billing records are kept as required by law.
Children & schools
AdversaryAI is for people aged 13 and over. Students under 13 may only use it through a school account managed by their school, which is responsible for obtaining any required parental consent. We do not knowingly collect data from children under 13 outside a school account; contact us to remove it.
Your rights
You can access, correct, export or delete your data by using the account tools or emailing us. EU/UK residents have additional rights under GDPR, including the right to complain to a supervisory authority.
Changes
We'll post any changes here and update the date above.