This Privacy Policy explains what information NxtRound collects, why we collect it, and the rights you have over it. It applies to the NxtRound application at nxtroundai.com and any successor NxtRound domains we operate.

1. Who we are and how to reach us

NxtRound ("we", "us") is an independent, free interview-practice service built and operated by an individual developer. It is not currently a registered company. For every purpose in this policy — questions, complaints, and exercising your data rights — contact us at privacy@nxtroundai.com. This address works whether or not you have an account, and we respond within one month as required by the EU General Data Protection Regulation (GDPR, Article 12).

2. What we collect

2.1 Account information

• Profile: your name and email address. If you sign in with Google, we receive your Google profile name, email, and picture.
• Password: handled entirely by Firebase Authentication (a Google service). We never see or store your password ourselves.
• Acceptance records: when you accept these documents we store the timestamp and the document version you accepted, as proof of your consent.

2.2 Practice content

• Interview answers: your spoken responses, transcribed in your browser by the Web Speech API.
• Session details: questions practiced, duration, completion status, scores, and AI feedback.
• Role information: job descriptions and role details you choose to provide.
• Diagrams: system-design drawings and whiteboard content.

Guest practice: you can try NxtRound without creating an account. Guest sessions run under a temporary anonymous ID and the same practice content above is collected so the AI can give you feedback. If you later create an account, your guest practice is attached to it; guest data is otherwise subject to the same rights and retention rules as account data.

2.3 Waitlist

If you join our access waitlist we store your email address and approval status.

2.4 Support and feedback

If you contact us or submit feedback, we keep your message, your email address, and our reply.

2.5 Usage analytics — only if you opt in

With your consent (see section 5), we use Google Analytics 4 to understand how the app is used: pages visited, buttons clicked, device and browser type, and performance data. This data is pseudonymous — it is linked to a random identifier stored in a cookie, not to your name — but under the GDPR it still counts as personal data, so we do not collect any of it unless you agree first.

3. Why we process your information, and the legal basis

Under the GDPR we must name a legal basis for each way we use your data:

• Running your account and practice features (storing sessions, syncing across devices, showing progress) — necessary to provide the service you signed up for (Article 6(1)(b), contract).
• Generating AI feedback (sending your answers to Google's Gemini API, see section 4) — necessary to provide the service (Article 6(1)(b), contract).
• Account emails (verification, password reset, security notices) — necessary to provide the service (Article 6(1)(b), contract).
• Usage analytics — your consent (Article 6(1)(a)), given through the cookie banner and withdrawable at any time.
• Security, rate-limiting, and abuse prevention(including keeping a marker for deleted accounts on the waitlist, see section 7) — our legitimate interest in keeping the service safe and affordable (Article 6(1)(f)).

We do not sell, rent, or trade your personal information. Ever.

4. AI processing of your practice content

When you practice, your relevant content (the question, your transcribed answer, and any job description you provided) is sent to Google's Gemini API to generate your feedback. We use the paid tier of this API, which means under Google's Gemini API terms Google does not use your content to train or improve its AI models. Google processes it only to return the response and handles it as a data processor under its API data-protection commitments.

Practical advice: interview answers are yours to shape — you never need to include real names, employers, or other details you'd rather keep private for the practice to work.

5. Cookies, local storage, and analytics consent

We keep this list short and complete:

• Sign-in cookie ("__session") — keeps you logged in securely. Strictly necessary; set only when you sign in.
• Consent choice (local storage) — remembers whether you accepted or declined analytics. Strictly necessary to honor your choice.
• Google Analytics cookies ("_ga" etc.) — set only after you click Accept in the cookie banner. Declining is one click, and the app works identically either way. You can change your mind anytime via "Cookie settings" in the page footer.
• Offline caching — our progressive web app caches static files (images, scripts, fonts) in your browser for speed. No personal data is involved.

6. Where your data lives and international transfers

Your data is stored and processed on Google Cloud infrastructure (Firebase Authentication, Firestore, Firebase Hosting, the Gemini API, and — with consent — Google Analytics), primarily in the United States. For users in the EU/EEA, UK, and Switzerland, these transfers are covered by Google LLC's certification under the EU-U.S. Data Privacy Framework (and its UK and Swiss extensions), with the European Commission's Standard Contractual Clauses as a fallback safeguard.

7. How long we keep your data

• Account and practice data: kept while your account exists; deleted immediately and permanently when you delete your account (section 8).
• Guest practice data: kept under the anonymous ID; deleted with the account if you upgrade and later delete it.
• Email verification codes: short-lived; deleted with your account.
• Waitlist entries: kept while the waitlist system exists so the access gate works. If you delete your account we keep only your email with a "deleted account" marker, to prevent abuse of the signup gate. You can ask us to remove this entirely at privacy@nxtroundai.com.
• Analytics data: Google Analytics retains event data for 14 months, then deletes it automatically.
• Support and feedback emails: up to 2 years, so we can follow up on past issues.

8. Your rights and exactly how to use them

These rights apply to everyone; for users in the EU/EEA and UK they are guaranteed by the GDPR (Articles 15–21):

• See and export your data (access, portability): Settings → "Your data" → "Download my data" gives you a machine-readable JSON file of everything we store about you — profile, practice sessions, and settings.
• Fix your data (rectification): edit your profile in Settings, or email us for anything you can't edit yourself.
• Delete your data (erasure): Settings → "Delete Account". This permanently removes your profile, all practice sessions, and every other record tied to your account, immediately. It cannot be undone.
• Withdraw consent: for analytics, use "Cookie settings" in the footer. Withdrawing is as easy as giving consent and doesn't affect anything already lawfully processed.
• Object or restrict: email privacy@nxtroundai.com and we'll respond within one month.
• Complain: if you believe we've mishandled your data, you can lodge a complaint with your local data-protection authority (list of EU authorities). We'd appreciate the chance to fix it first, but you don't need our permission to complain.

9. Children

NxtRound is not intended for anyone under 16. We do not knowingly collect personal information from children under 16, and we delete any such data as soon as we discover it.

10. Changes to this policy

When we change this policy, we update the version number and date shown at the top — the date is real, not automatic. For material changes we will notify registered users by email or an in-app notice before the change takes effect, and where our processing relies on your consent, we will ask for it again. We will never treat your silence or continued use as agreement to a material change.

11. Contact

privacy@nxtroundai.com — for privacy questions, data-rights requests, or anything else in this policy. No account required.