legal

Privacy policy

Last reviewed 13 September 2026

This policy explains what Code Review Wars (“we”) collects when you use codereviewwars.dev, why, who processes it, and what you can ask us to do with it. It is written to be read, not skimmed past.

Who we are

Code Review Wars is operated by Chibeze (sole trader) — confirm legal trading name before launch, Trading address — add before launch. We are the data controller for the personal data described here. Contact: support@codereviewwars.dev.

What we store

  • Account: your email address and a hashed password, managed by Supabase Auth. We never see your plaintext password.
  • Credits and payments: your credit balance and a ledger of purchases and usage, including the Stripe payment reference. Card details go directly to Stripe; we never receive or store them.
  • Review sessions: the generated code you reviewed, your inline comments and general notes, the grading result (score, grade, feedback, model answer), the language and domain you picked, and how long the session took.
  • Custom domain prompts: if you describe your own domain for a challenge, that text is stored with the session so it can be resumed.
  • Technical data: our hosting provider keeps short-lived server logs (including IP address) for security and debugging. Analytics are cookieless page-view counts — no cross-site tracking, no user profiles.

Why we use it

  • To run the service: sign you in, generate challenges, grade your reviews, track your progress and rank.
  • To process payments and keep the credit ledger accurate.
  • To prevent abuse, keep the service secure, and understand aggregate usage.
  • To reply when you contact us.

Under UK GDPR our legal bases are: performance of our contract with you (account, credits, grading); our legitimate interests (security, abuse prevention, aggregate analytics); and legal obligation (keeping payment records).

Who processes it

We use a small number of third-party processors. Each only receives what it needs:

  • Supabase — authentication and our Postgres database, hosted in AWS eu-west-1 (Ireland). Everything listed under “what we store” lives here.
  • Vercel — hosting, server-side rendering, and cookieless Web Analytics / Speed Insights.
  • Stripe — payment processing. Stripe is an independent controller for card data; see Stripe's own privacy policy.
  • Anthropic — the AI model provider. To generate a challenge and to grade your review, we send the generated code, your inline comments and your general notes (and a custom domain prompt, if you wrote one) to Anthropic's API. Your email and account details are not sent. Under Anthropic's commercial API terms, inputs and outputs are not used to train their models. See their privacy policy.

Stripe, Vercel and Anthropic process some data outside the UK, principally in the United States. Those transfers rely on the UK International Data Transfer Agreement / Addendum to the EU Standard Contractual Clauses, or an adequacy decision where one applies.

How long we keep it

  • Account, credit and session data: for as long as your account exists. Ask us to delete your account and it goes, along with your sessions.
  • Payment records: as long as UK tax and accounting law requires (currently six years), even after account deletion.
  • Server logs: short-lived, retained by the hosting provider for a matter of days to weeks.

Cookies

We set only the cookies needed to keep you signed in (Supabase session cookies). There are no advertising or tracking cookies, and our analytics do not use cookies, so there is no cookie banner.

Your rights

Under UK GDPR you can ask us to:

  • Give you a copy of the personal data we hold about you (access).
  • Correct anything inaccurate (rectification).
  • Delete your account and data (erasure), subject to the payment-record retention above.
  • Restrict or object to processing based on legitimate interests.
  • Export your data in a machine-readable format (portability).

Email support@codereviewwars.dev from the address on your account and we will respond within one month. You also have the right to complain to the Information Commissioner's Office at ico.org.uk.

Children

The service is not directed at children under 13 and we do not knowingly collect their data.

Changes

If this policy changes materially we will update the date at the top and, for anything that affects how your data is used, email account holders. See also our terms of service.