Privacy

What is stored, and how to remove it

Visiting without an account

Every page, all seven cases, their debriefs and the review page are open without an account. No account, LinkedIn sign-in or profile address is needed.

Aggregate site counts

From when this feature was turned on, the site counts public page views (homepage, cases list, case pages, this page) and case starts and completions, as daily totals per page type and case. No IP address, cookie, visitor identifier, device fingerprint, page address, query string or choice is stored. A tab-only marker in your browser, never sent to the server, stops one case attempt being counted twice. These are estimates: unique visitors are not measured, reloads count again and automated traffic is filtered only approximately.

Connect with Salah (optional)

From the homepage or after a full debrief you can choose to submit your name and email, and optionally a LinkedIn profile address and a short message. Whether it came from the homepage or a case is stored, with the case name if any, but not your choices. The LinkedIn address is not visited, checked or used to verify who you are. Submissions are visible only to Salah, never public, and are not added to any mailing list. No emails are sent automatically.

Permission to contact

A separate, unticked box lets you say Salah may contact you about your message or professional interests. The wording version and time are recorded. If you leave it unticked, your details are still submitted, but Salah will not initiate contact.

Optional account

An optional email-and-password account lets you save your own results and manage optional profile settings. Supabase provides authentication and stores your account email and password credentials. Your browser stores the sign-in session locally so you can stay signed in.

Professional details

Signed-in members may add optional self-declared details, shown as unverified. Nothing is inferred about you.

Owner directory and member activity

Signed-in members choose directory visibility and activity measurement separately. Directory details are visible to Salah only when directory consent is given. With analytics consent, page types, case starts, completions and browser performance measurements are recorded against the account, with a tab session identifier. These choices are off by default and separate from anonymous aggregate counts.

Saved results

The case, its version, your three choices and the time saved. Only you can see your saved results.

Referrers and third parties

Pages tell browsers not to send referrer information, and fonts are served from this site. The application does not integrate advertising or third-party audience analytics. Cloudflare hosts the site and Supabase handles authentication and data storage. Development previews may include editor diagnostics; those previews are separate from the public production site.

Retention

The database schedules a daily cleanup of aggregate counts and member activity older than 13 months, and connection requests older than 12 months. Salah can delete a connection request sooner. Cleanup status and deletion counts are logged without contact details and can be checked in the owner dashboard. Account profiles and saved results remain until you delete them or your account.

Deletion requests

To have a connection request removed early, submit the form again from the homepage or any debrief with the same email and say so in the message; Salah will delete it. Members can delete their profile and account data themselves at any time.

Service performance

Server request counts, errors and response times are aggregated into minute buckets by request type. They do not contain names, IP addresses, page paths or choices. External uptime probes, when configured, record check time, source, success and latency. These operational records are separate from member activity.

Infrastructure logs

The hosting platform and sign-in service keep standard technical logs, such as request addresses and IP addresses, for security and reliability. These are outside this site's application data and cannot be fully eliminated. This page describes practice; it is not a legal compliance statement.

This page will be updated before any new kind of data is collected.