Privacy
How DevSense handles your data
DevSense is a product of FlowCraft Systems ("we", "us"). It is a browser-based engineering assessment: you work through a simulated engineering situation alongside an AI engineering agent, and the session is recorded so it can be graded and reviewed. This page says what that involves for your data. It is written to be read, not skimmed past.
What we collect
- Your account. Your email address. If you sign in with Google or Apple, the name and email address they share with us, and for Google a profile picture link. If you choose to hide your email from Apple, we receive the relay address Apple issues instead. If you use a password, our authentication provider stores only a one-way hash of it; we never see the password itself.
- Your profile. The professional background you paste during onboarding, and the skill tags derived from it, which decide which challenge you are offered.
- Your sessions. Everything you type to the agent, the agent's replies, the actions you take in the simulated environment, and when each of them happened, including when you begin and end a session.
- Assessment output. The grading and the written feedback produced from a session.
- Programme membership. If you arrive through an invite link or enter a join code, which programme (a course, cohort or hiring process) that enrolled you in.
- Usage analytics. The website and the candidate app run Microsoft Clarity and Google Analytics. They record page views, clicks, scrolling and browser and device details; Clarity also records replays of how the interface was used. Both set cookies. We use them to see how the product is used, never for advertising.
- Technical logs. Our hosting and authentication providers keep server logs that include your IP address and browser details, for security and rate limiting.
Why we collect it
- To run your session, keep your place in it, and let you return to it.
- To grade the session and give you feedback.
- To let the person or organisation that invited you see how it went. That is the point of an assessment, and it is the one use you should expect.
- To keep the service secure, and to understand how the product is used so we can improve it.
We do not sell your data, and we do not share it with anyone for advertising.
Who can see it
- The programme that invited you. If you joined through an invite link or a join code, the administrators of that programme can read your full session transcript, your grading and your feedback. If you signed up on your own, only DevSense administrators at FlowCraft Systems can.
- Other candidates cannot. Access controls in the database ensure that one candidate cannot read another's profile, sessions or results.
-
Service providers that process data for us:
- Supabase, which provides sign-in, the database and the server-side functions. Your data is stored in its Sydney, Australia region.
- OpenRouter, which routes requests to large-language-model providers to generate the agent's replies, the grading and the skill tags. The content of your session and your onboarding text is sent for that purpose; your email address and name are not, unless you type them into the session yourself. These requests typically leave Australia, most often for the United States.
- GitHub Pages, which hosts the website and the candidate app.
- Google (sign in with Google, Google Analytics) and Microsoft (Clarity), as described above.
- Apple (sign in with Apple), if you use it.
How long we keep it
Your account, profile, sessions and results are kept while your account exists. Sessions graded as part of a programme may be kept for as long as that programme needs its records. We delete everything about you when you ask (see below). The analytics providers keep their data according to their own retention settings.
Your choices and rights
- Access, correction, export or deletion. Email us at devsense@flowcraft.systems from the address on your account. Deleting your account removes your profile, sessions, grading and feedback.
- Google and Apple. You can revoke DevSense's access from your Google or Apple account settings at any time. Your DevSense account remains until you ask us to delete it.
- Analytics. You can block Clarity and Google Analytics with your browser's tracking protection or an extension; the product works without them.
- If you are in the United Kingdom or the European Union, you also have the right to object to processing and to complain to your data protection authority.
Security
Everything travels over HTTPS. Your browser talks to the database through row-level access controls that limit it to your own records, and every privileged operation runs on the server rather than in the browser. Passwords are never stored in plain text.
Children
DevSense is not intended for anyone under 16, and we do not knowingly collect their data.
Changes
When this page changes, the date at the top changes with it. If a change affects what we collect or who can see it, we will say so here rather than bury it.
Contact
FlowCraft Systems · devsense@flowcraft.systems · flowcraft.systems