Privacy Policy

Last updated: 11 November 2026

KickOff is a practice tool. You talk through technical interview questions with an AI interviewer and get a scored report. This page explains what we collect, why, who helps us process it, how long we keep it and how to use your rights. Questions are welcome at [email protected].

Who we are

KickOff ("we", "us") runs this website and the interview service. For anything about your data, write to [email protected].

What we collect

Your account. Your name, email address, a hash of your password (we never store the password itself), your time zone, and the version of our terms you accepted and when.

Your interviews. The role, level and number of questions you chose; when it started and ended and how it ended; a transcript of what you and the interviewer said (text produced by speech-to-text from your voice); a score and feedback for each question; and your report (overall score, topic scores, radar ratings, strengths and focus areas). We also keep a short summary of whether you left the interview tab or your connection dropped (see "Integrity monitoring" below).

Your certificates. The certificate code, role, level, issue date, your name shown as first name and last initial, and the evidence behind it (which interviews counted).

Sign-in and security data. For each sign-in session: your IP address, browser details and times. A security log of actions such as sign-up, sign-in (including failed attempts), email verification, password changes and interviews started or ended, each with an IP address and browser details. Short-lived counters that limit how often something can be tried, keyed by IP address or a hash of your email address.

Emails we send you. Verification and password-reset links, a "your report is ready" email (which names the role and your score) and a "certificate earned" email, plus whether each was delivered.

What we do not collect

• No audio or video recordings. During an interview your microphone audio is streamed live and turned into text by our speech-to-text provider (see below). KickOff does not save the audio. We do not use your camera.
• No tracking. There are no analytics, advertising or third-party tracking scripts or cookies on KickOff.
• No keystrokes, clipboard or screen content. The browser only reports the interview-tab signals described below.
• We do not sell your personal data.

Integrity monitoring

While an interview is running, your browser tells us when the interview tab is hidden or the window loses focus for three seconds or more, and sends a small heartbeat every five seconds so we can note connection gaps. We store totals (how many times you left, for how long in total, the longest absence, and the number of gaps) with the interview and with each question. You are told about this before the interview, see a notice when you come back, and can see the result in your report.

This is a deterrent, not proof of anything. It is used for one purpose: an interview with a lot of time away does not count towards a certificate.

How we use your data

• To provide the service: sign you in, run interviews, score answers, build reports and show your history, dashboard and certificates.
• To issue certificates and let anyone with a code confirm that it is genuine.
• To email you about your account and your results.
• To keep KickOff secure and working: preventing abuse, rate limiting and fixing problems.

KickOff does not use your interview content to train AI models. We rely on these legal bases where the law asks for one: providing the service you asked for (contract), keeping it secure and fair (legitimate interests) and meeting legal obligations.

Who processes your data

We use these services to run KickOff. Each handles data under its own terms and privacy policy.

• LiveKit, which we run on our own server. It carries the live audio between your browser and the interviewer.
• Deepgram turns your speech into text. It receives your live microphone audio during an interview.
• Groq runs the language model that decides follow-up questions, scores your answers and writes your feedback. It receives the interview question, your transcribed answers, your scores, and the role and level. It does not receive your name, email address or account ID.
• ElevenLabs turns the interviewer's words into speech. It receives only what the interviewer says, nothing about you.
• Our email delivery provider sends account emails. It receives your email address, name and the content of the message.
• Cloudflare protects and routes traffic to our server, so it sees the technical details of your web requests.

Some of these providers may process data outside your country, including in the United States. We choose providers that publish their own privacy and security terms, and we send them only what is needed for their part of the job.

Cookies

KickOff sets two cookies, both strictly necessary, so there is no cookie banner:

• __Host-ko_session keeps you signed in. It expires after 14 days without use and never lasts longer than 30 days.
• __Host-ko_csrf protects forms against cross-site requests. It lasts 30 days.

We load fonts from our own domain.

How long we keep data

• Account details: until your account is deleted.
• Interviews, transcripts, reports and certificates: until you ask us to delete them. We do not delete these automatically yet.
• Raw interview event data (temporary processing data used while an interview runs): deleted 7 days after the interview ends.
• Sign-in sessions and verification or reset links: removed within 7 days after they expire or are ended.
• Security log (IP address and browser details): deleted after 12 months. Entries are not linked to your account once it is deleted.
• Rate-limit counters: about 2 days.
• Records of sent emails: 30 days.
• Diagnostic logs on our interview server (short excerpts of answers and tab-away events): deleted after 30 days.

If we keep backups, deleted data disappears from them when they rotate out.

Your rights

You can ask us to give you a copy of your data, correct it, delete it, or restrict or stop how we use it. Email [email protected] from the address on your account and we will reply within 30 days. We may need to confirm it is you first. Deleting your account removes your interviews, results and certificates. A self-service settings page for exporting and deleting your data is planned; until then, email is how to do it.

If you are in the UK or EU you can also complain to your local data protection authority.

Certificates and public verification

Anyone with a certificate code can check it on our verification page. It shows only your name as first name and last initial, the role, the level and the issue date. A code that does not exist and one that has been revoked look identical.

Children

KickOff is not for anyone under 16. If you think a child has signed up, email us and we will delete the account.

Security

Passwords are stored as argon2id hashes. Connections use HTTPS, sign-in cookies are HttpOnly, forms are protected against cross-site requests, repeated attempts are rate limited, and email links are single-use and expire. No online service is perfectly secure, but we take care to protect what you give us.

Changes

If we change this policy in a meaningful way we will update the date above and tell you by email or in the app.

Contact

[email protected]