Privacy Policy

WavePillars operates the website at wavepillars.com, a catalog of hands-on engineering practice assessments. For privacy questions or requests, use the contact form.

Depending on how you use the site, we may process:

• Account sign-in (Google). If you sign in with Google, we receive your email address and, when provided by Google, your display name and profile picture. We do not display your name or profile picture on the site. We need your email address to match paid assessment access to the email used at checkout, which prevents access keys from being shared with other users.
• Purchase and access. For paid assessments, Stripe processes payment on its secure checkout page. We receive the email address associated with the completed checkout (from Stripe) so we can generate and email your access key. We do not receive or store your full payment card number.
• Quiz activity. Your answers, score, and timer state during an assessment run in your browser only. We do not upload quiz responses or results to our servers.
• Technical and usage data. Our hosting provider and analytics tools may collect information such as IP address, browser type, pages visited, and referring URL. We use short-lived in-memory rate limits keyed by IP on certain API routes to reduce abuse; those counters are not kept as a long-term log.

We use the information above to:

• Provide and operate the assessment catalog and quiz experience
• Authenticate you and maintain your signed-in session
• Verify paid access keys against your signed-in email
• Send transactional email with your access link and key after purchase
• Understand aggregate site usage and improve the service
• Protect the site from fraud, abuse, and misconfiguration

We do not sell your personal information. We do not use your data for third-party advertising profiles.

The site may store data on your device as follows:

• HttpOnly session cookie. After Google sign-in, a signed cookie keeps you signed in for up to seven days. It contains your email address (not your Google password or token).
• Browser local storage. We cache your email, name, and picture locally so the header can show your signed-in state without asking Google on every page load. You can clear this by signing out or clearing site data in your browser.
• Analytics cookies. Google Analytics and Ahrefs Analytics may set cookies or similar identifiers to measure traffic. You can limit analytics through your browser settings or industry opt-out tools where available.

We rely on trusted processors to run the site. They handle data only as needed to provide their services:

• Google — Sign-In and (when enabled) Google Analytics
• Stripe — payment processing
• Resend — delivery of purchase access emails
• Cloudflare — hosting and content delivery
• Ahrefs — website analytics

Each provider’s own privacy policy governs how they process data on their systems. Payment card data is handled by Stripe under its terms and PCI obligations.

Signed-in session cookies expire after seven days unless you sign out sooner. Access keys are cryptographic tokens tied to your purchase email and quiz; we generate them at purchase time and send them to you by email. We do not maintain a separate customer database of quiz scores or answers.

Server and provider logs may be retained for a limited period for security, debugging, and billing, according to each provider’s practices.

We use HTTPS, signed HttpOnly cookies for sessions, and encrypted access tokens for paid content. No method of transmission or storage is completely secure; we work to apply reasonable safeguards appropriate to the data we handle.

You can:

• Sign out to clear your server session cookie
• Clear site data in your browser to remove local sign-in cache
• Decline optional sign-in and use free assessments without an account
• Contact us to request access, correction, or deletion of personal information we control, subject to applicable law and legitimate business needs (for example, completing a purchase you initiated)

If you are in the European Economic Area, United Kingdom, or other regions with privacy laws, you may have additional rights (such as objection or portability). Contact us and we will respond as required by law.

WavePillars is not directed at children under 13 (or the minimum age required in your country). We do not knowingly collect personal information from children. If you believe a child has provided us data, contact us and we will take appropriate steps to delete it.

We and our service providers may process data in the United States and other countries. Where required, we rely on appropriate safeguards for cross-border transfers.

We may update this policy from time to time. The “Last updated” date at the top will change when we do. Continued use of the site after changes means you accept the revised policy.

Use the contact form for privacy requests. You can also review our FAQ for payment and access questions.