Privacy Policy

Effective 12 October 2026

Alloy is exam preparation for the Claude certifications. It is operated by Memriq Holdings, Inc. ("Memriq", "we"), which is the controller of the personal information described here. This policy covers how we collect and use information in Alloy.

What we collect

• Your account — the email address you sign in with and your sign-in method (a password, or your Google sign-in). If you sign in with Google, Alloy receives your name, email address and Google account ID, only to sign you in; it asks Google for nothing else and reads nothing in your Google account.
• Study signals — for example, how long you spent on a section of a written passage, and how long you spent on a segment of an audio episode.
• Your answers and your confidence ratings on practice questions, drills and exams.
• Your plan, if you pay — which plan you are on, your payments and your credit balance. Your card details go to Stripe, never to Alloy.
• Operational logs — the ordinary records a web application keeps in order to run and to be debugged.

Alloy keeps a learner model of you, one per course: a per-concept estimate of your mastery, how well-calibrated your confidence is, and how quickly a given concept fades for you.

If you send a bug report through the in-app reporter, it carries the page you were on, your browser details, and — if you use the picker — a screenshot of what you clicked and a short replay of roughly the last thirty seconds in the app.

How we use it

We use it to run the platform, to decide what to teach you next, and to show you your own progress. Alloy also reads these models in aggregate to produce platform-level numbers on an internal operator dashboard.

Large language model completions are processed by OpenAI and/or Anthropic; we transmit only the context and prompts each feature requires.

We do not sell or share your personal information, and we have not done so in the past twelve months.

What an employer can see

No employer sees you at all unless you have turned employer visibility on in your account. An absence of that consent is treated as a refusal.

Study behaviour is blocked from employer-facing pages by a check in the code, not by a promise. If one of those fields ever appeared, the request fails outright rather than quietly stripping the field.

Code you ask us to scan

To scan a private repository, Alloy never asks you for a password or a token; if a URL you paste contains a token, we refuse the URL rather than store it. The short-lived access it uses lives about an hour, is scoped to the repositories that were ticked, is never stored and never reused. A token used to open a pull request is held for that single request, and is never written to our database, a log line or an error message.

Who else processes your data

We use a small number of service providers to run Alloy. Each one is bound by a contract that limits it to processing your data only on our instructions, and only to provide the service listed here.

• Railway — runs the application · United States.
• MongoDB Atlas — stores your account and learning data · United States.
• Neo4j Aura — stores the course knowledge graph · United States.
• Resend — sends sign-in links and receipts, through Memriq's one email sender · United States.
• Google — optional sign-in · United States.
• Stripe — takes payment for plans and credits, through Memriq's billing service · United States.
• OpenAI and Anthropic — the language models behind Alloy's study material and coaching, given only the context each feature requires · United States.

We update this list when our providers change, and we post material changes here before they take effect.

How long we keep your data

• Account details (name, email, sign-in records) — while your account is open, then deleted within 30 days of closure.
• Learning data (progress, answers, exam attempts, flashcards) — while your account is open, then deleted within 30 days of closure.
• Purchase and billing records — 7 years after the transaction; tax and accounting law requires this.
• Support conversations — 2 years from the last message.
• Server and security logs — 90 days, then deleted automatically.
• Backups — deleted data remains in encrypted backups for up to 35 days, then is overwritten.

Billing records are the one category we cannot delete on request. Everything else goes.

Deleting your account and your data

There is no self-serve delete button yet. To have your account and data deleted, email [email protected] from the address on your account.

We will acknowledge within 5 business days and complete the deletion within 30 days. We will tell you what we are keeping and why — that is billing records only, and only for as long as tax law requires.

Deletion is permanent. Your progress, your exam history, any certificates you have earned and any unused credits go with the account and cannot be restored.

Your rights over your data

Wherever you live, you can ask us to give you a copy of your data, correct it, delete it, or stop using it for a particular purpose. Email [email protected].

If you are in the UK or the EU. Memriq Holdings, Inc. is the data controller for your data. We process it to provide the service you signed up for (performance of a contract), to keep the service secure and improve it (our legitimate interests), and, where you have given it, with your consent (marketing email). Your data is processed in the United States under the European Commission's Standard Contractual Clauses. You have the right to complain to your local data protection authority.

If you are in California. You can ask what personal information we collect, ask for a copy, ask us to correct it, and ask us to delete it. We do not sell or share your personal information, and we have not done so in the past twelve months. We will never treat you differently for exercising these rights.

Cookies

Alloy uses first-party session cookies to keep you signed in.

Changes and contact

We may update this policy. The new version is published here with its date before it takes effect. Privacy questions: [email protected]. Anything else: [email protected].