Privacy Policy

1. Introduction

Nobler Works LLC ("we," "us," or "our") operates gitGood.dev (the "Platform"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Platform. Please read this policy carefully. By using the Platform, you consent to the practices described in this Privacy Policy.

2. Information We Collect

2.1 Information You Provide

• Account Information: Name, email address, password, and profile details.
• Profile Data: Skills, education, work experience, certifications, and portfolio links.
• Code Submissions: Solutions to coding challenges and assessments.
• Payment Information: Billing address and payment method details (processed securely through Stripe).
• Communications: Messages, feedback, and support inquiries you send to us.

2.2 Information Collected Automatically

• Usage Data: Pages visited, features used, time spent on the Platform, and interaction patterns.
• Device Information: IP address, browser type, operating system, and device identifiers.
• Cookies and Tracking: We use cookies and similar technologies to run the Platform, measure how it is used and, only if you accept them, measure our advertising (see Section 8).
• Performance Data: Challenge completion times, scores, and progress metrics.

3. How We Use Your Information

We use the collected information to:

• Provide, maintain, and improve the Platform and its features.
• Process your registration and manage your account.
• Show curated job openings and let you track applications you have made.
• Track your progress and provide personalized recommendations.
• Process payments and subscriptions.
• Send you updates, newsletters, and marketing communications (with your consent).
• Respond to your inquiries and provide customer support.
• Analyze usage patterns to improve user experience.
• Measure whether our advertising works, if you have accepted advertising cookies (Section 8).
• Detect, prevent, and address technical issues and security threats.
• Comply with legal obligations.

4. Information Sharing and Disclosure

4.1 Your Public Profile

If your profile is set to public, anyone with the link can view your profile information, skills, achievements and performance metrics - including people who are not signed in. If you set it to private, only you can see it. You control this in your account settings at any time.

We do not sell your profile to employers, and we do not operate a recruiter-facing candidate search. A recruiter marketplace was built and removed in September 2026 without ever being opened to recruiters; no profile was ever shared through it.

4.2 Recruiter Enquiries

Separately, employers and recruiters can leave their details on our "For Recruiters" page. That form collects a work email address (stored encrypted), and optionally a company name and the roles being hired for. It is used only to contact that recruiter about hiring on gitGood. It is not linked to any candidate's profile, and submitting it does not give anyone access to candidate data.

4.3 Service Providers

We share information with third-party vendors who assist us in operating the Platform, including cloud hosting (AWS), payment processing (Stripe), and analytics services. These providers are bound by confidentiality agreements.

4.4 Advertising Partner (Meta)

We may advertise gitGood on Facebook and Instagram, which are run by Meta Platforms, Inc. To learn whether those ads lead to sign-ups, and only if you accept advertising cookies, we share the following with Meta:

• Through the Meta Pixel in your browser: the pages you visit on gitGood, and your browser and device information.
• From our servers, when you create an account, start a trial or make a purchase: that event, its value, your email address in hashed (one-way scrambled) form, and your browser type (user agent), so that Meta can match it to an ad you saw.

We never share your practice answers, scores, interview sessions, resume, stories or any other content you create. If you decline advertising cookies, or your browser sends a Global Privacy Control signal, none of this is sent. Meta's own use of the data is governed by Meta's Privacy Policy.

4.5 Legal Requirements

We may disclose your information if required by law, court order, or governmental authority, or when we believe disclosure is necessary to protect our rights, your safety, or the safety of others.

4.6 Business Transfers

In the event of a merger, acquisition, or sale of assets, your information may be transferred to the acquiring entity.

5. Data Security

We implement industry-standard security measures to protect your information, including:

• Encryption of data in transit (TLS/SSL) and at rest.
• Secure password hashing.
• Regular security audits and vulnerability assessments.
• Access controls and authentication mechanisms.
• Secure cloud infrastructure with AWS.

However, no method of transmission over the Internet is 100% secure, and we cannot guarantee absolute security.

6. Data Retention

We retain your personal information for as long as your account is active or as needed to provide you services. We may retain certain information for legitimate business purposes or as required by law, such as for tax, legal, or accounting requirements.

The records below are kept for a fixed period and then deleted automatically. Each period is the one enforced in our systems - a test in our codebase fails if this list and the code that enforces it ever disagree.

• Account deletion marker: when you delete your account, a marker that stops a still-signed-in device from recreating it is kept for 24 hours, then removed. Your data itself is erased immediately.
• Backups: daily database backups are kept for 35 days, so deleted data can persist in a backup for up to that long before it ages out.
• Security audit log: records of sensitive actions on your account (sign-in events, password changes, deletion requests, administrator actions) are kept for 1 year.
• Signed-out session tokens: when you sign out, the token you were using is blocked until its own expiry - at most 15 minutes - and the block is then discarded.
• Rate-limit counters: per-account and per-IP request counters are kept for the window they count plus a one-minute cleanup margin - most windows are a minute to a day; the longest (the signed-out prep-plan allowance) is 30 days and 1 minute in total.
• Error reports: client-side error reports (the page, the message, your browser version - never your content) are kept for 30 days after the last occurrence.
• Support email: the raw copy of email you send to support@ (including attachments) is kept for 30 days; the ticket itself stays until it is resolved and you ask for it to be erased, or your account is deleted.

7. Your Rights and Choices

You have the following rights regarding your personal information:

• Access: Request a copy of your personal data.
• Correction: Update or correct inaccurate information.
• Deletion: Request deletion of your account and personal data.
• Portability: Request your data in a portable format.
• Opt-out: Unsubscribe from marketing communications.
• Profile Visibility: Control whether your profile is publicly viewable.

To exercise these rights, please contact us at privacy@gitgood.dev or through your account settings.

8. Cookies and Tracking Technologies

We use cookies and similar technologies for:

• Essential Cookies: Required for the Platform to function properly.
• Analytics Cookies: Help us understand how users interact with the Platform (Google Analytics).
• Advertising Cookies: Let us measure whether our ads on Facebook and Instagram lead to sign-ups (the Meta Pixel, see Section 4.4). We do not use them to show you ads on gitGood, and we do not allow other advertisers on the Platform.
• Preference Cookies: Remember your settings and preferences.

Analytics and advertising cookies are set only after you click "Accept" in our cookie banner. If you click "Decline", neither is set, and the Meta Pixel does not load. You can change your choice at any time from "Manage Cookies" in the footer. You can also block cookies in your browser settings; disabling essential cookies may affect Platform functionality.

9. Third-Party Links

The Platform may contain links to third-party websites or services. We are not responsible for the privacy practices of these external sites. We encourage you to review their privacy policies before providing any personal information.

10. Children's Privacy

The Platform is not intended for users under 18 years of age. We do not knowingly collect personal information from children. If we become aware that we have collected data from a child under 18, we will take steps to delete that information.

11. International Data Transfers

Your information may be transferred to and processed in countries other than your country of residence. These countries may have different data protection laws. By using the Platform, you consent to such transfers. We ensure appropriate safeguards are in place to protect your information.

12. California Privacy Rights (CCPA)

California residents have additional rights under the California Consumer Privacy Act:

• Right to know what personal information is collected and how it's used.
• Right to delete personal information.
• Right to opt out of the sale or sharing of personal information. We do not sell personal information. When you accept advertising cookies, the data described in Section 4.4 is shared with Meta for advertising measurement, which California law may treat as "sharing". You opt out by declining cookies, by choosing "Manage Cookies" in the footer, or by sending a Global Privacy Control signal.
• Right to non-discrimination for exercising privacy rights.

13. GDPR Rights (European Users)

If you are located in the European Economic Area (EEA), you have the following additional rights:

• Right to access your personal data and receive a copy.
• Right to rectification of inaccurate personal data.
• Right to erasure ("right to be forgotten").
• Right to restrict processing of your personal data.
• Right to data portability.
• Right to object to processing based on legitimate interests.
• Right to withdraw consent at any time.
• Right to lodge a complaint with a supervisory authority.

Our legal bases for processing include: consent, contract performance, legal obligations, and legitimate interests.

14. Do Not Track and Global Privacy Control Signals

Some browsers have a "Do Not Track" feature that signals to websites that you do not want your online activity tracked. We currently do not respond to Do Not Track signals as there is no consistent industry standard for compliance.

We do honor the Global Privacy Control (GPC) signal. If your browser sends it and you have not made an explicit choice in our cookie banner, we treat that as a decline: analytics and advertising cookies are not set, the Meta Pixel does not load, nothing is sent to Meta from our servers, and we do not record how you arrived at the site. The banner still appears so you can opt in explicitly; a choice you make in the banner takes precedence over the signal, and you can change it at any time from "Manage Cookies" in the footer.

15. Data Breach Notification

In the event of a data breach that affects your personal information, we will notify you and any applicable regulatory bodies as required by law. We will provide information about what data was affected and steps you can take to protect yourself.

16. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new Privacy Policy on this page with an updated "Last updated" date. We encourage you to review this Privacy Policy periodically.

17. Contact Us

If you have any questions or concerns about this Privacy Policy or our data practices, please contact us at:

Nobler Works LLC
Email: privacy@gitgood.dev