Privacy Policy

01 Introduction

Trafy runs a builder-led learning program ("Cohort") and a free-to-use skills assessment product (the "Employability Assessment", sometimes called the Employability Index) that measures a candidate's coding and problem-solving ability through multiple-choice questions and live coding exercises.

This policy covers two things we do, separately and together:

• The marketing site (trafy.ai and its sub-pages), where you can read about our program and submit a cohort application.
• The Assessment platform, a separate authenticated web application where you create an account, build a candidate profile, attempt assessments, submit code, and (optionally) appear on a public leaderboard.

02 Information we collect

We collect information in three ways: what you give us directly, what is generated automatically as you use the Services, and what we receive from third parties who help us run them.

a. Information you provide directly

• Cohort application: full name, email address, phone number, and your stated goal (startup, hiring, or exploring), submitted through our application form.
• Account credentials: email address and password when you register on the Assessment platform (authentication is handled by our infrastructure provider, Supabase; see How we share information).
• Candidate profile: name, college/university, country, and any of the following you choose to add — GitHub, LeetCode, LinkedIn, Instagram, portfolio, and project URLs.
• Assessment content: your selected answers to multiple-choice questions and the source code you write and submit for coding (DSA) problems.
• Correspondence: anything you send us directly, such as support requests or feedback.

b. Information collected automatically

• Usage & device data: IP address, browser type and version, device identifiers, operating system, referring/exit pages, and timestamps.
• Assessment activity: attempt start/end times, time remaining, autosave events, number of questions answered, and submission timing — used to enforce time limits and the fixed number of attempts per assessment.
• Cookies and local storage: small pieces of data stored in your browser; see Cookies & similar technologies.

c. Information from third parties

If a college, hiring partner, or event partner refers you to Trafy, we may receive your name and contact details from them so we can follow up. We do not purchase personal data from data brokers.

03 How we use your information

We use the information described above for the following purposes:

• To operate the Services — create and maintain your account, run and time your assessment attempts, autosave your progress, and compute your score.
• To evaluate cohort applications — review, shortlist and communicate admissions decisions for Cohort '26 and future cohorts.
• To communicate with you — respond to inquiries, send application status updates, and share relevant program, deadline or assessment-result notifications. You can opt out of non-essential communications at any time.
• To maintain integrity and security — detect and prevent cheating, abuse, unauthorized access, and fraud (for example, rate-limiting attempts and validating submissions server-side).
• To improve the Services — understand aggregate usage patterns, question difficulty, and platform performance so we can fix bugs and build better features.
• To comply with legal obligations — respond to lawful requests from public authorities and meet record-keeping and tax obligations.

We do not sell your personal data, and we do not use your assessment code submissions to train third-party AI models.

04 Assessment & code submission data

Because scoring integrity matters to every candidate on the leaderboard, the Assessment platform is built so the correct answers to multiple-choice questions are never sent to your browser, and every score is computed on our server against the pinned question set for your specific attempt — never on the client. Here is what that means for your data specifically:

• Answers you select are saved automatically as you go (autosave) so a closed tab or crashed browser does not cost you progress, and are scored only when you submit or your time expires.
• Code submissions for coding (DSA) problems are executed against hidden and example test cases using a third-party code execution service (Judge0) to compute pass/fail results and partial credit. Submitted code is sent to that service solely to run it and is not published or shared beyond what is needed to grade your attempt.
• Attempts are capped per assessment (typically three), and each attempt, its timing, and its final score are retained so you and, where applicable, cohort reviewers can see your history and best result.

05 Cookies & similar technologies

We use a small number of strictly necessary cookies and browser storage mechanisms, rather than third-party advertising trackers:

We do not currently run third-party advertising or cross-site tracking cookies. If that changes — for example, if we add product analytics — we will update this section and, where required by law, ask for your consent first. Most browsers let you block or delete cookies and local storage through their settings; doing so may prevent parts of the Assessment platform (like staying signed in) from working correctly.

06 How we share information

We do not sell, rent, or trade your personal data. We share it only in the following circumstances:

• Service providers (sub-processors): vendors who process data on our behalf, under contract, and only to provide the Services:
  • Supabase — authentication, database hosting, and storage for accounts, profiles and assessment attempts.
  • Judge0 (self-hosted or managed code execution API) — compiles and runs your DSA code submissions to grade them.
  • Vercel and Render — hosting for our frontend and backend infrastructure respectively.
  • Google Forms — currently used to collect cohort applications submitted through the "Apply" form on this site.
• Cohort review & hiring partners: where you apply to a cohort or opt in to be visible to hiring partners, we share relevant profile and assessment-result data to support admissions and recruitment purposes.
• Legal & safety: when required to comply with a legal obligation, enforce our Terms of Service, or protect the rights, property or safety of Trafy, our users, or the public.
• Business transfers: if Trafy is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction, subject to the commitments of this policy.

07 Public leaderboard & profile visibility

The Assessment platform includes a public leaderboard that ranks candidates by their best score. If you complete an assessment, the following may be displayed publicly to anyone who views the leaderboard:

• Your display name, country and university/college (if provided).
• The social/portfolio links you chose to add (GitHub, LeetCode, LinkedIn, Instagram, portfolio, project URL).
• Your total score, maximum possible score, and number of correct answers.

We do not publicly display your email address, phone number, password, submitted source code, or individual question-level answers on the leaderboard. If you would prefer not to appear on the public leaderboard, contact us using the details in Contact us and we will remove your entry from public view; your assessment history remains visible to you and, where relevant, to cohort reviewers.

08 Data retention

We retain personal data only as long as reasonably necessary for the purposes described in this policy:

• Account & profile data is retained for as long as your account remains active, and for a reasonable period afterward in case you return.
• Assessment attempts, scores and code submissions are retained to preserve your attempt history, support leaderboard integrity, and allow dispute resolution over scoring.
• Cohort application data is retained for the admissions cycle it was submitted for and a reasonable period after, for program reporting and to consider you for future cohorts, unless you ask us to delete it sooner.

When data is no longer needed, we delete it or anonymize it so it can no longer identify you, except where we must keep it to comply with a legal obligation, resolve disputes, or enforce our agreements.

09 Data security

We apply technical and organizational measures designed to protect your data, including:

• Encryption of data in transit (HTTPS/TLS) between your browser and our servers.
• Server-side authentication and authorization (Supabase JWTs) so assessment scoring and answer keys are never exposed to the client.
• Access controls that limit who on our team can view personal data, restricted to what is needed to operate and support the Services.
• Server-side validation of every scored action, so a client cannot forge or inflate a score.

No method of transmission or storage is 100% secure. If we become aware of a security incident that affects your personal data, we will notify affected users and relevant authorities as required by applicable law.

10 Your rights & choices

Depending on where you live, you may have some or all of the following rights over your personal data, including under India's Digital Personal Data Protection Act, 2023 and, where applicable, the EU/UK GDPR:

• Access — request a copy of the personal data we hold about you.
• Correction — ask us to correct inaccurate or incomplete data (you can also edit most profile fields yourself from your account).
• Deletion — ask us to delete your account and associated personal data, subject to the retention needs described above.
• Withdraw consent — where we rely on consent (for example, appearing on the public leaderboard), withdraw it at any time.
• Objection / restriction — object to or ask us to restrict certain processing of your data.
• Portability — request your data in a structured, commonly used, machine-readable format, where technically feasible.
• Grievance redressal — raise a complaint with our designated contact below, or with your local data protection authority.

To exercise any of these rights, email us at the address in Contact us. We will verify your request and respond within a reasonable timeframe, and in any event within the period required by applicable law.

11 Children's privacy

The Services are intended for students, early founders and working professionals generally aged 16 and above. We do not knowingly collect personal data from children under the age of 16 (or the relevant minimum age in your jurisdiction). If you believe a child has provided us with personal data, please contact us and we will take steps to delete it.

12 International users & data transfers

Trafy is based in India, and our infrastructure providers may process and store data in India and other countries (including where Supabase, Vercel, Render and our code-execution provider operate their servers). If you access the Services from outside India, your information may be transferred to, stored, and processed in a country with different data protection laws than your own. Where required, we rely on appropriate safeguards (such as contractual commitments from our providers) for such transfers.

13 Changes to this policy

We may update this Privacy Policy from time to time to reflect changes to our practices, the Services, or applicable law. We will post the updated policy on this page with a revised "Last updated" date, and where a change is material, we will provide additional notice (such as an email or an in-app notification) before it takes effect. Your continued use of the Services after a change takes effect constitutes acceptance of the updated policy.

14 Contact us

If you have questions, concerns, or requests regarding this Privacy Policy or how we handle your data, reach out to us: