Privacy Policy

Kernelry is a practice tool for DevOps and SRE interviews. This policy explains what personal data we collect, why, who helps us process it, how long we keep it, and the rights you have. We do not sell your personal data, we do not use it to show you ads, and we do not share it with advertisers.

Who we are

Kernelry is operated by Kernelry LLC, a limited liability company formed in Illinois, United States. Kernelry LLC ("we", "us") is the controller of the personal data described in this policy.

Our business address is 111 N Wabash Ave, Ste 100 #3409, Chicago, IL 60602, United States.

For any privacy question or request, use our Contact page and start your message with "Privacy request". The form works whether or not you are signed in, and a person reads every message.

What we collect

• Account data: your email address, a securely hashed password if you sign up with email, and your time zone. If you sign in with Google, we receive your email address, the name on your Google account, and a link to its profile photo.
• Practice activity: the questions you were given, your answers, AI feedback and scores, helper chat messages, notes you save, and lab activity.
• Voice answers: if you turn on voice answers and use the microphone, your speech is turned into text by a speech model running in your own browser. Your voice recording never leaves your device, and we never receive or store audio. The text goes into your answer box, where you can edit it, and is submitted like a typed answer. When an answer includes spoken text we note that, so our AI grader reads misheard technical words fairly. To improve voice answers, we also keep the text the speech model produced in each listening session, before you edit it, together with the question it was for. These samples are not linked to your account, and we keep only the most recent 200 from all users, plus, separately, the most recent 100 from the example question answered without an account.
• Billing data: your plan, subscription status, and the customer and subscription identifiers Stripe gives us. We never see or store your card details.
• Support messages: anything you send through the Contact page or a support ticket, including the email address you give us.
• Email data: your email preferences, and whether our emails were delivered, bounced, or marked as spam.
• Product usage events: records of actions such as signing up, starting or finishing an interview, and opening a ticket, linked to your account. We use them to understand how the product is used and to fix problems. They are recorded on our own servers, and include the two-letter country code Cloudflare derives from your connection. We do not store the address it was derived from. Your signup record also notes the website you first arrived from, as your browser reports it (for example, Reddit or Google), or the campaign label of the link if it had one. We record the website's name only, not the page you were on. We also use Cloudflare Web Analytics for page views and referrers, which sets no cookies and does not track you across sites. We use no advertising trackers.
• Refused submissions: if our automated grader refuses a submission because it does not answer the question, tries to manipulate the grader, or is abusive, we keep an excerpt of up to 500 characters with your account identifier so a person can review the decision and act on repeated misuse.
• Enforcement records: if we close an account for breaking our terms, for example repeated refund abuse or bulk extraction of the question bank, we keep a short record of what happened together with identifiers for that account: a hashed email address, hashed network addresses, and the payment identifiers our payment provider gives us. We use it only to enforce that decision and to recognize the same person opening another account. It is never used for marketing, never shared with other users, and never based on your nationality or country of residence.
• Network and device data: to prevent abuse, we record a salted, one-way hash of your network (IP) address when you sign up, sign in, reset a password, use AI features, send a contact message, or use our IP inspector tool. Kernelry's own tables do not store raw IP addresses. Our sign-in provider, Supabase, records the IP address and browser of each sign-in session to keep accounts secure, and our hosting and security providers see your IP address and may keep it in their logs for a limited time, as any website does.

Do not paste real credentials, secrets, customer data, or confidential material from your employer into Kernelry. We do not ask for any sensitive personal data (such as health, religion, or ethnicity), and you should not submit it.

You need an email address to have an account. Everything else is up to you, though some features need it to work: AI grading, for example, needs your answer.

Why we use it, and our legal basis

If you are in the European Economic Area or the United Kingdom, the law requires us to state a legal basis for each use:

• To provide the service you signed up for (your account, interviews, AI grading, saved progress, Pro access, and account emails): performance of our contract with you.
• To keep Kernelry secure and prevent abuse (rate limits, bot checks, refused-submission review, network address hashes, and enforcement records after an account is closed for breach): our legitimate interest in protecting the service, its users, and our own work from abuse. You can object to this use at any time, and we will weigh your objection against the reason the record exists.
• To understand and improve the product (product usage events, email delivery status, and reviewing answers and grades to fix questions and grading): our legitimate interest in running and improving Kernelry.
• To send optional emails (digests, question rotation alerts, product news): your consent, which you can withdraw at any time.
• To meet legal obligations (tax, accounting, responding to lawful requests): legal obligation.

How we use AI

When you answer a question or use the helper, the text you submit is sent to Google's Gemini API to grade it and write feedback. We use Google's paid API service, under which Google does not use your submissions to train its models. Google may keep them for a limited time to detect abuse, under its own terms. We do not use your answers to train AI models either.

Question audio is generated with Google Cloud Text-to-Speech from our own question text; none of your data is sent for this.

AI grading is automated, but it only produces practice scores and feedback. It has no legal or similarly significant effect on you. Automated safeguards can apply a temporary cooldown after repeated refused submissions, but a person always makes any decision to suspend or close an account, and you can appeal through the Contact page.

Who processes your data

We share personal data only with providers that help us run Kernelry, and only for that purpose:

• Supabase - database and sign-in.
• Google - AI grading (Gemini), question audio, and Google sign-in if you choose it.
• Resend - sending email, and receiving your replies to it.
• Porkbun and Google (Gmail) - our own mailbox, for anything you email to us directly and for security alerts about accounts. Messages sent through the Contact page or a ticket are read on Kernelry itself, not in this mailbox.
• Cloudflare - content delivery, security, cookieless page-view analytics, and encrypted backup storage.
• hCaptcha - bot protection on sign-in and contact forms.
• Our server hosting provider - runs the application.
• Stripe - payments. Stripe acts as the merchant of record for subscriptions, so it collects and handles your payment details as an independent controller under the Stripe Privacy Policy.

One connection is not a sharing of data at all. On the IP inspector tool, your browser connects directly to Cloudflare's icanhazip.com so the tool can show both your IPv4 and IPv6 address. We send nothing to it and we receive nothing from it. The request is made by your browser, with no cookies, credentials, or referrer, and Cloudflare sees it as it would any other visit to that site.

We may also disclose data if the law requires it, to protect the rights and safety of our users or the service, or to a successor if Kernelry is sold or reorganized, in which case this policy continues to apply.

International transfers

Our providers store and process data in the United States and other countries. When personal data from the EEA, the UK, or Switzerland is transferred to a country without an adequacy decision, the transfer relies on the safeguards our providers offer, such as the European Commission's Standard Contractual Clauses (and the UK equivalent) or the EU-U.S. Data Privacy Framework.

How long we keep it

• Interview content (questions, answers, and AI feedback): deleted automatically 90 days after the interview. The date, status, and scores stay in your history until you delete your account.
• Refused-submission excerpts: deleted automatically after 30 days.
• Network address hashes used for abuse prevention: expire automatically, within a day for most rate limits and after 30 days for sign-up records (kept with the email domain, not the full address). A hash stored with a contact message is kept with that message.
• Your account and practice data: kept while your account is open. When you delete your account, and confirm it through the link we email you, it is closed straight away and permanently deleted after 30 days, so it can be restored if you contact us before then.
• After account deletion: product usage events and email delivery records are unlinked from your account. Messages you sent through the Contact page are kept so we have a record of support conversations. Where we must keep records for tax, accounting, or legal reasons, we keep only what is needed, only for as long as required. An address that bounced or reported spam stays on our do-not-email list.
• Enforcement records: kept for up to two years after the account is closed, and deleted sooner if they are no longer needed to prevent the abuse that caused them.
• Voice answer samples: only the 200 most recent are kept across all users, and the 100 most recent from the example question answered without an account, so each one is replaced as new ones arrive, and none is kept longer than 90 days. They are not linked to any account.
• Backups: encrypted database backups are kept for up to 30 days, so deleted data leaves our backups within 30 days of leaving the live database.

Cookies and local storage

We use only cookies and browser storage that the service needs to work: keeping you signed in, protecting forms from bots (hCaptcha and Cloudflare), remembering your choices during sign-up, remembering which website or shared link you arrived from until you sign up (at most 30 days), and saving preferences such as dismissed notices, starred notes, and recent topics on your own device. If you try the example question without an account, the answer you submit stays in your browser so the page remembers you have tried it, and is not sent to us; if you speak it, the voice answer sample described above is kept the same way it is for accounts. If you turn on voice answers, the speech model (under 100 MB) is also saved in your browser's storage for this site so it only downloads once; you can remove it at any time from your account page, or without an account by clearing this site's data in your browser. We do not use advertising or cross-site tracking cookies, so we do not show a cookie consent banner.

Do Not Track and Global Privacy Control: we do not track you across other websites, and we do not sell or share personal data for advertising, so there is nothing for these browser signals to switch off. Kernelry works the same whether or not your browser sends them.

Email communications

We send emails needed to run your account, such as password resets, security notices, support replies, and billing messages. These cannot be turned off while you have an account.

If you opt in, we also send optional emails: weekly practice summaries, question rotation alerts, and product news. You can change or stop them at any time on your Notification preferences page or with the unsubscribe link in any optional email.

Your rights

Depending on where you live, you have some or all of these rights over your personal data:

• to access it and get a copy;
• to correct it if it is wrong;
• to delete it;
• to receive it in a portable format;
• to object to or restrict how we use it, including uses based on legitimate interests;
• to withdraw consent at any time, without affecting anything done before;
• to not be treated differently for using any of these rights.

You can delete your account yourself from your Account page. For any other request, use the Contact page. We may need to confirm the request comes from the account owner, and we will reply within one month.

If you ask for a copy of your data, we will send you everything we hold for your account at the time of your request, as a machine-readable file, within one month. To protect your account, we send it only to the email address registered on that account.

If you are in the EEA or the UK and are unhappy with how we handle your data, you have the right to complain to your local data protection authority. We would appreciate the chance to fix it first.

United States residents: we do not sell or "share" personal information for cross-context behavioral advertising, as those terms are defined under California and other state privacy laws, and we do not use sensitive personal information to infer characteristics about you. The categories of personal information we collect, their sources, and the purposes are described above.

Security

We protect data with encryption in transit, encrypted backups, access controls that limit administrator access, and hashing of network addresses. No system is perfectly secure. If a data breach is likely to put your rights at risk, we will notify you and the relevant authorities as the law requires.

Children

Kernelry is only for people aged 18 or over (or the age of majority where you live). We do not knowingly collect data from children. If you believe a child has created an account, contact us and we will delete it.

Changes to this policy

We will update the date at the top of this page whenever this policy changes. If a change is material, for example a new use of your data or a new type of data collected, we will give at least 14 days' notice by email or on the site before it takes effect.

On October 1, 2026 we added that answers and grades may be reviewed to fix questions and grading. For accounts created before that date, this applies from October 15, 2026. The other changes that day describe what we already did more precisely: the Google profile photo link, sign-in records kept by Supabase, our own mailbox, and that we do not track email opens.