Privacy
How DevSense handles your data
DevSense is a product of FlowCraft Systems ("we", "us"). It is a browser-based engineering assessment: you work through a simulated engineering situation alongside an AI engineering agent, and the session is recorded so it can be graded and reviewed. This page says what that involves for your data. It is written to be read, not skimmed past.
What we collect
- Your account. Your email address. If you sign in with Google or Apple, the name and email address they share with us, and for Google a profile picture link. If you choose to hide your email from Apple, we receive the relay address Apple issues instead. If you use a password, our authentication provider stores only a one-way hash of it; we never see the password itself.
- Your profile. The professional background you paste during onboarding, and the skill tags derived from it, which decide which challenge you are offered; a display name if you set one; and whether you have chosen to be visible to organisations (below). Your profile page also shows activity counts computed from your sessions — hours in completed sessions, sessions and worlds completed — which are counts of what you did, never a score.
- Your public page, if you make one. A handle (the short name that forms the page's web address), one optional line you write about yourself, and the choices you make about what that page shows. Making a page is optional; once you make one it shows everything listed below unless you switch something off, and all of it is yours to change or remove.
- Your sessions. Everything you type to the agent, the agent's replies, the actions you take in the simulated environment, and when each of them happened, including when you begin and end a session.
- Assessment output. The grading and the written feedback produced from a session.
- Your SEJAT score. Once you have finished enough challenges, we compute a Software Engineering Judgement Aptitude Test score from the same rubric your sessions are graded against, together with the seven-competency profile it comes from and a count of how much evidence it rests on. It is recomputed from your own sessions each time one is graded, and it is arithmetic: no AI model decides it, and no third party is involved. Until enough has been observed for the number to mean anything, it is not shown to anyone, including you.
- Programme membership. If you arrive through an invite link or enter a join code, which programme (a course, cohort or hiring process) that enrolled you in.
- The white-paper and organisations forms. If you ask for one of our papers at /papers or get in touch through /organisations, the name, email address, role and organisation you enter, which paper you asked for, what you said you were interested in, and your consent to be emailed. We use them to send you the download link and, if you agreed, to follow up about DevSense. This is separate from an account: you can request a paper without ever signing in. Email us to be removed.
- Usage analytics. The website and the candidate app run Microsoft Clarity and Google Analytics. They record page views, clicks, scrolling and browser and device details; Clarity also records replays of how the interface was used. Both set cookies. We use them to see how the product is used, never for advertising.
- Technical logs. Our hosting and authentication providers keep server logs that include your IP address and browser details, for security and rate limiting.
Why we collect it
- To run your session, keep your place in it, and let you return to it.
- To grade the session and give you feedback.
- To let the person or organisation that invited you see how it went. That is the point of an assessment, and it is the one use you should expect.
- To keep the service secure, and to understand how the product is used so we can improve it.
We do not sell your data, and we do not share it with anyone for advertising.
Who can see it
- The programme that invited you. If you joined through an invite link or a join code, the administrators of that programme can read your full session transcript, your grading and your feedback. If you signed up on your own, only DevSense administrators at FlowCraft Systems can.
- Organisations — only if you choose. On your profile page there is a switch, visible to organisations, which is off by default. While it is on, DevSense may show organisations that ask us for candidates your display name, your activity counts (hours in completed sessions, sessions and worlds completed, moves recorded), which worlds you played, and your session transcripts and feedback. Switch it off at any time and nothing further is shared; what an organisation was already shown, we cannot take back. Nothing about you is shown to an organisation while the switch is off.
- Anyone at all — but only if you publish a page. You can switch on a public page at devsense.flowcraft.systems/p?u=your-handle. It is off until you switch it on. While it is on, anyone with the link can read it, including people with no DevSense account, and including search engines. It shows your hours in the simulator — that is what the page is for, and it is always on it — and, unless you switch them off, four further things: your display name; what you have been doing here (which worlds you completed, how many sessions you finished, how many moves you made, and when you first and last played); what you have earned inside the simulator; and your SEJAT score, if you have one. Each of those four is a switch on your profile page, and turning one off takes it off your public page at once. The score appears only when you have finished enough for it to mean anything and you have left its switch on, and it is always shown beside the amount of evidence behind it. The page never shows your email address, your session transcripts, your feedback or your grading. Switch the page itself off and it is gone for everyone immediately; what somebody has already read, or a search engine has already copied, we cannot take back.
- Other candidates cannot see anything else. Apart from a public page you chose to publish, access controls in the database ensure that one candidate cannot read another's profile, sessions or results.
-
Service providers that process data for us:
- Supabase, which provides sign-in, the database and the server-side functions. Your data is stored in its Sydney, Australia region. White-paper requests are stored there too.
- Resend, which delivers the white-paper email when you request one; it receives your name and email address for that message only.
- OpenRouter, which routes requests to large-language-model providers to generate the agent's replies, the grading and the skill tags. The content of your session and your onboarding text is sent for that purpose; your email address and name are not, unless you type them into the session yourself. These requests typically leave Australia, most often for the United States.
- GitHub Pages, which hosts the website and the candidate app.
- Google (sign in with Google, Google Analytics) and Microsoft (Clarity), as described above.
- Apple (sign in with Apple), if you use it.
How long we keep it
Your account, profile, sessions and results are kept while your account exists. Sessions graded as part of a programme may be kept for as long as that programme needs its records. We delete everything about you when you ask (see below). The analytics providers keep their data according to their own retention settings.
Your choices and rights
- Access, correction, export or deletion. Email us at devsense@flowcraft.systems from the address on your account. Deleting your account removes your profile, sessions, grading and feedback, and takes down your public page if you had one.
- Google and Apple. You can revoke DevSense's access from your Google or Apple account settings at any time. Your DevSense account remains until you ask us to delete it.
- Analytics. You can block Clarity and Google Analytics with your browser's tracking protection or an extension; the product works without them.
- If you are in the United Kingdom or the European Union, you also have the right to object to processing and to complain to your data protection authority.
Security
Everything travels over HTTPS. Your browser talks to the database through row-level access controls that limit it to your own records, and every privileged operation runs on the server rather than in the browser. Passwords are never stored in plain text.
Children
DevSense is not intended for anyone under 16, and we do not knowingly collect their data.
Changes
When this page changes, the date at the top changes with it. If a change affects what we collect or who can see it, we will say so here rather than bury it.
Contact
FlowCraft Systems · devsense@flowcraft.systems · flowcraft.systems