Privacy

This policy describes what CaseDrill collects, what it does with it, how long it keeps it, and how to obtain a copy or have it erased. It is written to be checkable: every category below matches a table in the site's database

Data controller

Mathieu Viel, 75016 Paris, France. For any question about data: contact@casedrill.com

The principle: the site works without an account

Every solo training exercise is available without signing up. In guest mode the site knows neither your name nor your email address: your progress is attached to a random identifier stored in your browser, which cannot identify you or be used to contact you. Creating an account serves to keep that progress and to reach the member features

What is collected

If you create an account

• Email address: login identifier, confirmation link and password reset. Required
• Display name: what appears in rankings and to other members. You may choose to stay anonymous, in which case it is never shown
• First and last name: optional, used only to address messages to you
• Password: never stored in clear text, only as an irreversible hash
• Timezone and target market: to show session times in your local hours and to tailor the resources offered

What you produce while training

• Attempts: for each answer, the section, the item, whether it was right, and how long it took. This is the basis of scores, statistics and rankings
• Text you write: your answers to case studies, your work file answers and your STAR notebook stories. These are free-form texts in which you talk about yourself and your background. They are treated as the most sensitive category on the site: shown to nobody else, never used for anything else, and erased with your account
• Items viewed: the resources, questions and sheets you have opened, so that progress ticks can be displayed

If you use the member features

• Relationships: friend requests, answers, blocks
• Groups: membership and role
• Sessions: date, duration, role, proposed case, the video link you provide, the invitation message
• Availability: the weekly slots you tick, converted to universal time
• Reviews: the scores and comments you give a partner after a session, and those they give you

Audience measurement

The site counts its own visits and uses no external measurement tool: no Google Analytics, no advertising pixel, no social network button. No data is passed to a third party for statistical or advertising purposes

IP addresses are not kept. A visit is recorded as a cryptographic fingerprint computed from the address and the browser, using a secret key belonging to the site. That fingerprint avoids counting the same visitor twice in a day; it cannot be used to recover the original address, and matches nothing outside the site

Technical error logs contain no email address, no name and no written content: only the error message and the file concerned

Cookies and local storage

The site sets no advertising or third-party measurement cookie. It uses only:

• a session cookie, required for the site to work (login, anti-forgery token);
• a preferences cookie holding the language and the light or dark theme;
• a guest identifier, if you train without an account;
• a long session cookie, only if you tick the corresponding option when logging in

None of these is used to follow you from one site to another. They fall under the consent exemptions for strictly necessary cookies and for preferences the user asked for: this is why the site shows no consent banner

Legal bases and purposes

• Performance of the service: account, progress, rankings, member features
• Legitimate interest: aggregate visit counting, site security, abuse limitation (invitation caps, login attempt limits)
• Consent: session reminders, which you can turn off

Recipients

Data is neither sold, rented, nor passed on for commercial purposes. It is accessible to the site's publisher and to its host, EX2 (SARL, SIREN 351 680 764), acting as technical processor. Emails (sign-up confirmation, password reset) are sent through that same host

Other members see only: your display name (unless you are in anonymous mode), your points total, and for your friends and groups your aggregate progress. Your email address is never shown to another member, including in search results: searching an exact address lets you find someone, not read anyone's address

Retention

• Account and written content: as long as the account exists, then erased or anonymised when it is deleted
• Inactive account: deleted after 36 months without a login, following an email warning
• Visit fingerprints: 90 days
• Confirmation and reset tokens: 48 hours, then purged
• Exercise attempts: kept after account deletion, but detached from any person, so that the site's overall statistics stay consistent. A detached attempt contains no personal data

Your rights

You have rights of access, rectification, erasure, restriction, objection and portability. In practice, from your profile:

• Access and portability: the export button immediately hands you a file containing all of your data, in a machine-readable format
• Rectification: your profile information can be changed at any time
• Erasure: account deletion is immediate and irreversible. It erases your written text, your relationships, your groups, your sessions, your availability, your reviews and your notifications, and anonymises the rest
• Objection: anonymous mode removes you from named rankings without depriving you of the site

For any request: contact@casedrill.com. If you disagree with the outcome, you may refer the matter to the competent data protection authority

Minors

The site is aimed at candidates finishing their studies or already working. It is not intended for anyone under 15 and does not knowingly collect their data

Changes

Any change to this policy is dated at the top of the page. A substantial change affecting the member features is announced on the site