Last updated: 2026-10-09
FDE Spot ("we", "us") operates the fdespot.com website and platform. [Legal entity name, registered address, and jurisdiction to be added once confirmed by product/legal, see the draft notice above.] For any privacy question or to exercise the rights described below, contact us at hi@fdespot.com.
Account & profile data. You can sign in two ways. With Google Sign-In (OAuth), we receive the identity claims Google provides (name, email, profile photo) and use your Google identity token as your session credential. With an email address and password, your account is held by Google's Firebase Authentication: it stores your email, an optional display name and your password in hashed form (we never see the password), sends the email that confirms your address, and issues the token we use as your session credential. Either way, we use this to create your account, save your learning progress, and show your profile on leaderboards (which you can turn off in Settings).
Billing data. Paid access ($99/yr all-access) is sold through Stripe's hosted checkout: we never see or store your card details. We do store billing metadata Stripe sends us: subscription status, order records, and a Stripe event/subscription ID, so we can grant and manage your access.
Newsletter & sign-up data. If you give us your email (newsletter form, waitlist), we store that email plus how you found us (referrer and UTM campaign parameters, if any) so we can send you a welcome email and, if you opt in, occasional updates. You can unsubscribe at any time via the link in any email we send.
Optional role and campaign attribution. Our sign-up forms optionally ask whether you are an engineer, tech lead, engineering manager, executive/founder, or in another role. You can leave this blank. We use the answer to understand who finds the lessons useful. Our website also saves first-visit campaign labels in your browser under fde_attribution: utm_source, utm_medium, utm_campaign, utm_content, utm_term, and the registered utm_partner, utm_placement, and utm_referral fields. When you submit a form or create an account, that attribution may be attached to your lead or account in Firestore. Page and referrer fields use the origin and path; unrelated query parameters and URL fragments are removed by the browser attribution helper. We use these fields to understand which campaigns lead to sign-ups, not to assess your purchasing authority. The first-visit browser record has no automatic expiry; clear this site's storage to remove it. Contact hi@fdespot.com to request removal of stored lead, role or campaign data. Unsubscribing stops updates but does not itself erase the stored lead record. Google Cloud hosts these records, Resend delivers the emails, and our self-hosted Plausible records aggregate conversion events such as form location, optional role and duplicate status.
Lab & tutoring interactions. Some interactive lessons (the AI tutor, simulation labs, boss battles) send the text you submit to Google's Gemini API to generate a response or grade a submission. We do not use this content to train our own models; it is processed to serve that specific interaction.
Simulation sessions & discovery transcripts. When you participate in discovery simulations (such as the Meridian stakeholder interview or Boss Battles), we record your conversational exchanges with stakeholder personas, the questions you asked, the facts surfaced, and the resulting scorecard. We store these transcripts in your account so you can review your history, track trajectory across attempts, and practice in retry mode. Transcripts remain attached to your account while it is active and are completely deleted when your account is deleted. In workshops and dedicated cohorts, participants may explicitly consent in their engagement terms to have anonymized transcripts included in our benchmark calibration corpus to test and validate rubric reliability (such as Krippendorff's α). Self-serve learners may optionally opt in to this benchmark calibration via their settings or scorecard. Deleting your account or withdrawing consent immediately purges your transcripts from future evaluation sets, though it cannot retract previously published aggregate, anonymized statistical reliability metrics.
The free practice drill on the home page. You can have one drill answer graded without an account. What you type is sent to Google's Gemini API to be scored, exactly as above. Two things are worth stating plainly because no sign-in is involved: your answer and the grade it received are stored in a shared response cache, so that an identical answer submitted later (by you or by anyone else) is served from the cache instead of being sent to the model again; and we record your IP address for a short period, solely to enforce the daily limit on free graded attempts and to keep the feature from being abused. We do not attach either to an identity, we do not use them to build a profile of you, and we do not use your answer to train our own models. If you would rather not have an answer processed this way, don't submit one: the rest of the page works without it.
Product-usage analytics. We record which lessons/modules you access and complete so the platform can track your progress, XP, and streaks, and so we can understand product usage in aggregate. This is first-party: it stays in our own database, visible to us on an internal admin dashboard, not sold or shared with advertisers.
We use the following processors, each only for the purpose named:
FDE Spot itself does not set cookies. We store your session and preferences in your browser's local storage instead. If you sign in with Google, Google sets its own cookies as part of that sign-in: that's governed by Google's privacy policy, not this one. Our analytics (Plausible, self-hosted) is cookieless by design. We're separately working on a cookie/consent banner as part of ongoing EU-compliance work; this section will be updated when that ships.
We process account and billing data to perform our contract with you (providing the service you signed up/paid for), newsletter data on the basis of your consent (withdrawable any time), simulation transcripts to maintain your learning attempt trajectory while your account is active, and lab/tutoring content as necessary to provide the specific feature you're using. We keep account and billing records for as long as your account is active plus a reasonable period for tax/accounting purposes; newsletter updates until you unsubscribe; simulation transcripts while your account is active (deleted upon account deletion). Benchmark calibration corpus inclusion is strictly based on explicit consent (cohort agreement or self-serve opt-in). Unsubscribed lead records remain stored unless removed on request; the optional role and campaign fields follow the same retention. Some of our processors (Google, Stripe, Resend, NVIDIA) may process data outside the EEA; where that happens, they do so under their own published safeguards (such as Standard Contractual Clauses); we have not yet independently audited each processor's specific transfer mechanism, and will update this section once that review is complete.
Subject to applicable law (including the GDPR, if you're in the EEA/UK), you have the right to access, correct, delete, or export your personal data, and to object to or restrict certain processing. To exercise any of these, email hi@fdespot.com: we'll respond as required by applicable law.
We're planning an AI-proctored certification exam as part of a future paid tier. It is not built or live today, and no proctoring data (webcam, screen, or otherwise) is collected. When/if this ships, we'll update this policy before it goes live, with its own dedicated disclosure.
We'll update the "Last updated" date above whenever this policy changes, and post material changes visibly on the site. Continued use of FDE Spot after a change means you accept the updated policy.
Questions, requests, or concerns about this policy or your data: hi@fdespot.com.