Privacy Policy

Effective October 22, 2026. Code Maverick is operated by Brenden Bishop as a sole proprietor in the United States ("Code Maverick", "we"). This policy covers the marketing site at codemaverick.dev, the interviewer app at app.codemaverick.dev, and the candidate sync client published as the code-maverick package on npm.

Code Maverick is in a closed beta. This policy describes what the product does today. When the product changes, this page changes with it, and the date at the top moves.

Summary

• Hiring teams use Code Maverick to run live technical interviews. The hiring team decides what to collect about a candidate and why. Code Maverick processes that data on the hiring team's behalf.
• Candidates do not create accounts. A candidate gives a name and an email to check in, then runs a sync client that uploads the files in one exercise folder while the interview runs, plus a record of how agents were used in that folder.
• We do not sell personal data, use it for advertising, or train models on candidate code.
• Everything a candidate sends is listed in the Transparency notice. If the product ever contradicts that notice, the notice wins and the difference is a bug.

Who is responsible for what

For candidate data, the hiring team is the controller and Code Maverick is the processor. The hiring team decides to run the interview, chooses the exercise, invites the candidate, and owns the record afterwards. Candidate requests about that record go to the hiring team first, and we act on the hiring team's instructions. If a candidate cannot reach the hiring team, we help directly at the address at the bottom of this page.

For interviewer accounts and for visits to codemaverick.dev, Code Maverick is the controller.

What we collect

From hiring teams

• Account data: name, email address, and profile picture from the GitHub account used to sign in, through our identity provider WorkOS.
• Workspace data: the name of the team's base and squadron, the exercises the team configures, including any files the team uploads as exercise material, and the missions the team plans.
• Interview notes: observations an interviewer records during and after an interview, and the rubric ratings they submit.
• Support and feedback: anything a team sends us by email.

From candidates

• Check-in identity: the name and email a candidate enters on the join page, matched against what the hiring team entered when planning the interview.
• Synced files: the contents, paths, and content hashes of files inside the exercise folder the candidate runs the sync client in, as they change during the interview. Files and folders listed as skipped in the Transparency notice are never uploaded, including .env files and keys.
• Session events: when the client connects and disconnects, when files change, sync errors, and a heartbeat every ten seconds that carries only a timestamp.
• Agent provenance: for tools that expose it, which lines were written by an agent, which tool and model, prompt and turn counts, and related statistics. Where a tool exposes prompt content, the prompt text tied to agent-assisted edits is captured unless the hiring team turns prompt capture off for that interview. In interviews where agent use is not allowed, prompt capture stays on so the record shows whether agents were used anyway.
• Setup diagnostics: the results of the pre-interview check the client runs, which report whether sync and attribution can work. The report includes the operating system, the versions of Node, git, and the attribution tooling, the absolute paths of the exercise folder and the client's state directory, which usually contain the candidate's local username, and which of the supported agent tools (Cursor, Claude Code, Codex) have a configuration folder in the home directory. The check uses synthetic files, not the candidate's code.

The sync client does not capture keystrokes, clipboard contents, screen recordings, browser history, editor telemetry, or files outside the exercise folder. Beyond the agent-tool presence check above, it collects nothing about other programs on the candidate's machine. It runs only while the candidate runs it.

From everyone, automatically

• Server logs: IP address, user agent, request path, and time, kept by our hosting provider for operation and abuse prevention.
• Waitlist and Bill of Rights sign-ups on codemaverick.dev: the email address entered, which audience it belongs to, and the page it came from.

We do not use advertising cookies or third-party analytics on codemaverick.dev or in the app. The app sets the cookies it needs to keep you signed in.

How we use it

• To run the interview: show the hiring team the candidate's work live, and keep the record for review afterwards.
• To run accounts and workspaces: sign interviewers in, scope data to their base, send transactional email such as invitations and a welcome message.
• To keep the service working and safe: diagnose failures, rate-limit abuse, and respond to security reports.
• To talk to you: answer support requests and tell waitlist sign-ups when the beta opens.

We do not use candidate data to build profiles across interviews, rank candidates against one another, or train machine learning models. Hiring decisions are made by the hiring team's people, not by Code Maverick.

Who we share it with

We share personal data only with the services that run Code Maverick, each bound by its own terms and acting on our instructions:

We will update this table before adding a service that handles personal data. Within a hiring team's base, interviewers on that team can see the interviews their team runs.

We do not sell personal data. We disclose data outside this list only when the law requires it or to protect the safety of a person or of the service, and we tell the affected hiring team when we are allowed to.

How long we keep it

During the beta, interview records are kept until the hiring team asks us to delete them. Email privacy@codemaverick.dev from the account that owns the base and name the interview or the base; we remove the session, every event, the synced file contents, uploaded files, candidate tokens, and setup reports, and confirm by email. Deleting a base removes everything under it: squadrons, exercises, missions, and every interview record. Interviewer accounts are not deleted with a base, because an account can belong to more than one base; ask us to delete an account separately. Self-serve deletion in the app is being built; when it ships, this paragraph will say so. We do not run automated retention windows yet; when we do, this page will state the windows and they will match the product.

Waitlist entries are kept until the beta opens to that audience or the person asks to be removed. Server logs are kept by our hosting provider for a short rolling period. Email sends are logged by Resend under its own retention.

Your choices and rights

If you are a candidate, your first stop is the hiring team that invited you. They control the record and can delete it. If you cannot reach them, write to us and we will help within the limits of our role as their processor.

If you are an interviewer, you can see your workspace in the app and ask us to delete an interview, your account, or your base. We confirm deletion by email.

Depending on where you live, you may have rights to access, correct, delete, or export personal data, or to object to some processing. We honour those requests for the data we control, and we pass requests about candidate data to the controlling hiring team. We do not discriminate against anyone for exercising a privacy right.

The beta is offered in the United States. We do not target users in the European Economic Area or the United Kingdom, and we do not transfer data there on purpose. If that changes, this policy will say so and name the legal basis.

Security

Data moves over TLS. Interviewer sessions are protected by WorkOS with GitHub sign-in; candidates never receive an account or a password. Candidate upload tokens are scoped to one interview and revoked when it ends. Authorization checks on the backend are covered by an automated gate in our build. If you find a security problem, email the address below before posting about it, and we will respond as fast as a one-person company can.

Children

Code Maverick is for hiring teams and the adults they interview. We do not knowingly collect data from anyone under 16.

Changes

We will change this policy as the product changes. The effective date at the top moves when we do. For changes that matter to how we handle your data, we will email hiring teams on the beta.

Contact

Privacy, data requests, and security: privacy@codemaverick.dev