Legal

Privacy Policy

Last updated: 11 October 2026

1. Who we are

SolveForge is operated by SCIMS LLC ("we", "us"), Atlanta, Georgia, USA. We are the data controller for the personal information described here. Questions or requests: support@solveforge.io.

2. Information we collect

If you create an account

Email address and a password (stored only as a secure hash; we never see your password), or, if you sign in with Google, your Google account email and basic profile.
Profile: your display name, avatar seed, and an optional LinkedIn URL you choose to add.
Practice data: the games you complete, your scores, timings, and derived stats/trophies.
Membership status: which passes you hold (McKinsey, Bain, both, or lifetime) and when each expires.
Marketing preference and sign-up record: whether you have opted in to marketing email and the date you did so, plus, for email sign-ups, when you agreed to the Terms, the country we detected, and whether the marketing box started ticked.
Checklist requests (no account needed): if you ask for one of our prep checklists by email, we keep your email address, the firm, your test date if you give one, whether you ticked the separate box for prep tips (with the wording shown next to it), the page you asked from, and when you asked. To stop abuse of the form we also keep a short log of requests with a scrambled (hashed) version of your IP address, never the address itself.
BCG launch notice: whether you asked to be told when BCG practice launches, and the date you did so. We use it only to send that one email, and you can untick it on the BCG practice page.

If you buy a Pro plan

Payments are handled by Stripe. Stripe collects your payment details directly. We never receive or store your full card number. We receive a confirmation that a payment succeeded, and your email may be shared with Stripe for the receipt. If you leave a checkout without paying, Stripe tells us it expired and whether you ticked Stripe's box agreeing to promotional email (Stripe shows that box to buyers in the United States only). If you ask for a refund, we look at how much you used the pass after buying it (runs completed and question-bank answers) to apply the refund rule in our Terms.

If you use the site without an account (guest)

Your guest profile and practice runs are stored only in your own browser (IndexedDB/localStorage) and are not sent to us. Guest scores are not ranked.

Automatically

Standard technical data our providers process to deliver the site (e.g. IP address, browser type, request logs). We do not run advertising or third-party tracking cookies.
We use Cloudflare Web Analytics, a privacy-first, cookieless analytics service, to understand aggregate site usage (e.g. page views, referrers, country-level location). It does not use cookies, does not fingerprint devices, and does not track you across sites.
We use PostHog (product analytics, hosted in the United States) to understand how SolveForge is used, so we can fix what confuses people. With your permission it records pages you visit, what you click, events such as starting a practice run, finishing it with a score, opening the pass options or starting checkout, and session recordings of how you move around the site. Anything you type into a form is hidden in recordings, and so is your email address where the site displays it. If you are signed in, we link this to your account using your account ID only, never your email address. Who gets asked: for visitors in the United States this runs without a prompt. Everywhere else, and whenever we can't tell your country (worked out from your IP address, country only), we ask first with a cookie bar, and nothing is stored in your browser unless you accept. If you decline or don't answer, PostHog only counts visits anonymously without cookies, using a one-way code that changes daily and can't identify you, with no recordings and no link to your account. You can change your choice at any time: cookie settings.

3. Information that is public

Important: if you have an account and complete practice runs, your display name, avatar, any LinkedIn link you add, whether you hold a pass, and your scores and rankings are publicly visible on our leaderboards and player pages, including to people who are not signed in. Your email address is never shown publicly. If you don't want to be listed publicly, use a pseudonymous display name, leave the LinkedIn field blank, or delete your account.

4. How we use your information

To create and secure your account and authenticate you.
To save your progress, compute stats and trophies, and display leaderboards.
To process payments and grant/verify Pro access.
To respond to support requests.
To send you marketing email, only if you asked us to. If the optional marketing box is ticked when you create your account, or you turn it on in your profile, we may email you preparation tips, worked examples, guides, product updates and occasional discount offers. For visitors in the United States the box starts ticked, and you can untick it before you sign up. Everywhere else it starts unticked and we only email you if you tick it yourself. We work out which applies from your approximate location (country only, from your IP address, which our hosting provider already sees), and if we can't tell, the box starts unticked. We do not sell or share your address. Every marketing email includes an unsubscribe link, and you can also turn it off any time in your profile or by emailing us. Withdrawing consent does not affect your account, your Pro access, or the service emails we still need to send you (such as sign-up confirmation, password resets and payment receipts).
To send a checklist you asked for. We email the checklist straight away and, if you gave a test date, one reminder two days before it. We send prep tips only if you ticked the separate box. Every email has a one-click unsubscribe, which stops all emails about your checklist.
To publish anonymous statistics about practice scores, such as the median score on a game. These are totals across many runs and never identify you, and we don't publish any figure based on fewer than 30 runs or 20 players.
One reminder about an unfinished checkout, only if you agreed to emails. If you start buying a pass and don't finish, and you agreed to emails from us (the box in Stripe's checkout, or the marketing setting on your account), we may send one email with Stripe's link back to the same checkout. We send at most one every 7 days, none if you've bought a pass since, and each has the same one-click unsubscribe.
To maintain security, prevent abuse, and comply with legal obligations.

Legal bases (UK/EU GDPR): performance of a contract (providing the Service and your Pro access), our legitimate interests (security, abuse prevention, operating leaderboards), consent (optional LinkedIn link, marketing email, and analytics cookies and session recordings), and legal obligation (tax/accounting records). Where we rely on consent, you may withdraw it at any time.

5. Who we share it with

We do not sell your personal information. We share it only with the service providers we need to run SolveForge:

Supabase: authentication, database, and hosting of your account and practice data.
Stripe: payment processing (under Stripe's own privacy policy).
Cloudflare: website hosting, DNS, and CDN.
PostHog: product analytics and session recordings, as described in section 2.
Resend: sending account emails, run reports you request, and marketing email you opted in to.
Google: only if you choose "Continue with Google" (sign-in), and to serve the site's web font, which means Google may receive your IP address when your browser loads the font.

We may also disclose information if required by law, or to protect our rights, users, or the security of the Service.

6. Cookies and local storage

We use your browser's storage for essential functionality only:

An authentication session (so you stay signed in).
Your theme preference (light/dark).
For guests, your local profile and practice runs.
Your cookie choice (whether you accepted analytics), so we don't ask again.

These are strictly necessary or preference cookies/storage. The one exception is analytics: if you accept (or you are in the United States), PostHog stores a first-party cookie and browser storage with a random ID, so it can tell one visit from the next. We do not use advertising or cross-site tracking cookies. You can change your analytics choice with cookie settings, and clear everything at any time in your browser settings (this will sign you out and erase guest data).

7. Data retention

We keep your account and practice data for as long as your account exists. If you delete your account, we delete your profile and practice data, except where we must retain records (for example, payment and tax records, which Stripe and we may keep for the period required by law, typically up to 7 years).

Checklist requests: we keep your email, firm and test date until you unsubscribe or ask us to delete them. After you unsubscribe we keep a record that you did, so we don't email you again; email support@solveforge.io if you want that removed too.

8. Your rights

Depending on where you live (for example under UK/EU GDPR, or the CCPA/CPRA in California), you may have the right to:

access a copy of your personal information;
correct inaccurate information (you can edit your display name, avatar, and LinkedIn link directly in your profile);
delete your account and personal information;
object to or restrict certain processing, and withdraw consent;
data portability;
not be discriminated against for exercising these rights.

To exercise any of these, email support@solveforge.io from the address on your account. We will respond within the timeframe required by applicable law. If you are in the UK/EU, you also have the right to complain to your local data-protection authority.

9. International transfers

We are based in the United States, and our providers (Supabase, Stripe, Cloudflare, Google, PostHog, Resend) may process data in the United States and other countries. Where personal information is transferred out of the UK/EEA, our providers rely on appropriate safeguards such as Standard Contractual Clauses.

10. Security

We use industry-standard measures to protect your data: encrypted connections (HTTPS), hashed passwords, row-level security on our database, and payment handling delegated to Stripe so card data never touches our systems. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

11. Children

The Service is intended for users aged 16 and over and is not directed to children. We do not knowingly collect personal information from children under 16. If you believe a child has provided us information, contact us and we will delete it.

12. Changes to this policy

We may update this policy. Material changes will be posted here with a new "last updated" date and, where appropriate, notified by email. Continued use after changes take effect means you accept the updated policy.

13. Contact

SCIMS LLC, Atlanta, Georgia, USA
Email: support@solveforge.io