Privacy Policy

Personal Information

When you create an account or use our Service, we may collect:

• Name and display name
• Email address
• Profile picture
• Account credentials (managed securely through our authentication provider, Clerk)

Usage Information

We automatically collect certain information when you use the Service:

• Challenge participation and submission history
• Interaction data (pages visited, features used)
• Device information (browser type, operating system)
• IP address and general location data
• Cookies and similar tracking technologies

1. Screenshots

The extension captures periodic screenshots of the active AI platform tab during your challenge session.

• Captured approximately every 5 seconds and on key interactions (e.g., sending a prompt, navigating)
• Format: JPEG (compressed) — only the visible browser tab content
• Screenshots pause automatically after 10 minutes of inactivity
• Only captures the tab associated with your challenge — not other browser tabs or windows
• Restricted URLs (chrome://, extensions, devtools) are never captured

2. User Input (Prompts)

The text of prompts you send to AI platforms during a challenge is captured to evaluate your problem-solving approach.

• Captured on form submission, Enter key press, or send button click
• Subject to automatic PII redaction before transmission (see Privacy Protections below)

3. AI Platform Context

The extension reads publicly visible UI elements on supported AI platforms to understand your session context:

• Selected AI model (e.g., GPT-4o, Claude 3.5 Sonnet)
• Agent/tool mode status (enabled or disabled)
• Conversation message count
• File names referenced in AI responses
• Task status (idle, generating, completed, error)

4. Network Activity

The extension monitors API requests and WebSocket messages on supported AI platforms to capture AI agent behavior:

• Request URLs, HTTP methods, and response status codes
• Response bodies (text-based only; binary files like images are excluded)
• WebSocket messages for real-time AI agent actions
• Authentication endpoints (login, OAuth, token) are automatically excluded — only metadata is retained, response bodies are discarded

5. Navigation & Session Metadata

• Tab URL and page title changes (checked every 3 seconds)
• Session start time, duration, and conversation turn count
• Scroll and DOM interaction events (for detecting user engagement)

Automatic PII Redaction

All captured text data is automatically scanned and redacted for sensitive information before it leaves your browser. The following patterns are detected and replaced with placeholder tokens:

• API keys (OpenAI, Anthropic, Google, AWS, GitHub tokens)
• SSH/PEM private keys
• JWT tokens and Bearer tokens
• Database connection strings (PostgreSQL, MongoDB, MySQL, Redis)
• Generic credentials (passwords, secrets, access keys)
• Email addresses
• Social Security Numbers (SSNs)
• Credit card numbers

PII redaction is best-effort using pattern matching. While we cover common credential formats, we recommend not entering sensitive personal information into AI platforms during challenge sessions.

Authentication Endpoint Protection

Network requests to authentication-related endpoints (login, OAuth, token exchange, SSO) have their response bodies automatically discarded. Only request metadata (URL, status code) is retained.

Challenge-Only Capture

Data collection is controlled by a capture gate system. Capture only begins when you explicitly start a challenge and ends immediately when you submit or exit. The extension performs no data collection outside of active challenge sessions.

Supported Sites Only

The extension only operates on a predefined list of AI platforms. It does not inject content scripts, capture screenshots, or monitor network activity on any other websites.

No Third-Party Analytics

The extension does not include any third-party analytics, advertising SDKs, or tracking services. All collected data is transmitted exclusively to NeoHuman servers.

In-Browser Storage

The extension stores minimal state data in Chrome's local storage: your user ID, session token, active challenge details, and UI preferences. Session-level state (active tab, tab group) is stored in Chrome session storage and is cleared when the browser is closed.

Data Transmission

Trace events are transmitted to our servers every 5 seconds. Screenshots are uploaded in batches every 30 seconds. A complete session summary is sent when the challenge ends. All transmissions use HTTPS encryption.

Server-Side Retention

Challenge session data (screenshots, trace events, session metadata) is retained on our servers for the duration necessary to complete the evaluation process. You may request deletion of your session data by contacting us.

Session End Cleanup

When a challenge ends, in-memory buffers (screenshots, event queues) are cleared from the extension. Local storage is reset to a clean state. No residual challenge data remains in your browser after session completion.

Challenge Hosts

When you participate in an evaluation challenge, your session data (screenshots, trace events, performance metrics) is shared with the challenge host for assessment purposes.

Service Providers

We share information with third-party vendors who help us operate the Service, including authentication (Clerk), cloud hosting and database (Supabase), and analytics (Vercel Analytics).

Legal Requirements

We may disclose information if required by law, court order, or governmental authority, or when we believe disclosure is necessary to protect our rights or the safety of others.

Business Transfers

In the event of a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction.