Privacy policy

QALadder is a free learning site run by one person. There is no analytics empire behind it and nothing here is sold. This page describes exactly what the software does, and it was written by reading the code rather than by filling in a template.

What you can do without giving us anything

Most of the site needs no account and stores nothing about you: the roadmap, all 150 interview questions, the take-home and scenario guides, the career articles, the Locator Lab, and every one of the seven QA tools.

The tools deserve a specific note, because people reasonably assume otherwise. The ATS resume checker analyses your resume entirely inside your browser. Your resume text and the job description you paste are never transmitted to our server or anyone else's. The same is true of the boundary value generator, metrics calculator, bug report builder, test plan generator, STAR builder and take-home generator. You can verify this yourself: open your browser's developer tools, switch to the Network tab, and run any of them — no request is made.

What we store if you create an account

An account exists for one reason: to save your progress across devices. In our database we keep:

• Your name and email address, as you entered them.
• A cryptographic hash of your password (bcrypt). The password itself is never stored and cannot be recovered from the hash — not by us either.
• Your progress — which modules and checkpoints you've completed.
• Saved work from in-app tools, where a tool offers to save something to your account.
• The date you signed up and the date you were last active.
• Your Ask AI conversation history, so the assistant has context and so your daily quota can be counted.

That is the complete list. There is no tracking profile, no behavioural scoring, no data broker, and nothing is sold or shared for marketing.

Third parties that necessarily see something

Four services are involved in running the site. Each sees only what it needs to do its job:

• The AI provider (currently Groq). When you use Ask AI, your message and recent conversation are sent to the provider's API to generate a reply. Don't paste anything confidential — employer code, client names, personal data — into any AI chat, including this one.
• Piston (emkc.org). In the Code Lab, Python runs inside your browser and is never transmitted. The other ten languages have no in-browser runtime, so that code is sent to the Piston execution API to be run in a sandbox. Treat anything you type in a non-Python language as leaving your machine.
• Resend. Handles account emails — confirmation and password reset. It sees your email address and the message content.
• Cloudflare and jsDelivr CDNs. Serve the code editor and related assets. Like any web request, they can see your IP address and browser user-agent.

Analytics

If page analytics are enabled, we use Cloudflare Web Analytics, which is cookie-less and does not fingerprint or track individuals across sites. It reports aggregate page views and referrers. There is no Google Analytics on this site.

Cookies

We set no cookies at all, which is why you have never seen a cookie banner here. Three things are kept in your browser's local storage instead, and they never leave your device except where noted:

• qal-theme — whether you chose light or dark.
• qal_token — your login token, sent with requests to keep you signed in.
• qal_avatar_data — your profile image, if you set one.

Logging out removes the login token and avatar. Clearing your browser data removes all three.

IP addresses

Your IP address is held briefly in memory to enforce rate limits — the mechanism that stops a script hammering the server. It is not written to the database and not retained. The web server keeps standard access logs, as every web server does.

Advertising

This site currently shows no ads and contains no advertising code. If that changes, this page will be updated to name the ad provider and describe what it collects before any ad code goes live, and visitors in regions that require consent will be asked for it.

Your data is yours

Email hello@qaladder.org to:

• Get a copy of everything stored about you.
• Correct anything wrong.
• Delete your account and all associated data. No retention period, no "are you sure" gauntlet — it's removed.

If you're in the EU or UK, these are your rights under GDPR and we honour them regardless of where you live.

Security, stated honestly

Passwords are bcrypt-hashed, traffic is HTTPS-only with HSTS, the site sends a strict Content Security Policy, and the database is backed up. What no one can honestly promise is perfect security. This is a free site run by one person: don't reuse a password here that protects anything important, and don't store anything sensitive in it.

Children

QALadder is aimed at working professionals and is not directed at children under 16. We don't knowingly collect their data; if you believe a child has created an account, email us and it'll be removed.

Changes to this policy

The date at the top changes when this page changes. Material changes — new data collected, a new third party, or advertising — will be reflected here before they take effect, not after.

Contact

Questions about any of this: hello@qaladder.org. See the contact page for what else to reach out about.