What we collect, and what we don’t.
This is an honest inventory, not a legal shield. Probe is pre-launch and small — we want it to be obvious what data leaves a candidate’s browser and where it ends up. If something here is wrong or missing, please email us.
Who runs this
Probe is operated by Probe Labs, Inc. The service is offered to engineering hiring teams (“customers”), who use it to evaluate candidates (“candidates”). This page covers both.
Customer account data
When a hiring manager signs up, we collect and store:
- Email address (via Firebase Authentication).
- An optional company name and profile metadata entered during onboarding.
- Authentication state — login timestamps, sign-in method (Google or email/password).
Passwords are managed by Firebase Authentication and never stored in our own database. Google sign-in uses OAuth; we receive your email address and Google account ID, nothing else.
Candidate profile data
When a customer invites a candidate, they enter information about that candidate. We store:
- Name, email, the role they’re being considered for, and the interview configuration (task type, number of rounds, whether a behavioral round is included).
- Pipeline status: invited, in progress, completed, hired, not hired, expired.
- An invite token that lets the candidate open their session without a Probe account. Tokens are tied to a single candidate record.
- If a résumé is uploaded: the file name, content type, size, upload timestamp, and the file contents. Résumés are stored on the application’s server filesystem (not in a third-party storage bucket) and indexed in Firestore.
Interview session data
During a coding round, we record an event log of what happens in the session. Each event includes a timestamp. Specifically:
- Code edits — the full text of files in the editor.
- Test runs — the command run, pass/fail counts, and the test output.
- AI assistant interactions — the candidate’s prompts, the assistant’s responses, and any tool calls the assistant made (read file, edit file, run tests).
- Pull-request review activity (for code-review tasks) — comments added or removed and the final hire/no-hire decision.
- Focus events — when the candidate’s browser tab loses or regains focus, and roughly how long it was away. We do not read the clipboard, capture screenshots, or watch what the candidate does in other tabs or applications.
- The final code submission and the submission timestamp.
We do not record the candidate’s screen, keystrokes outside the editor, mouse movements, webcam, or any system telemetry.
Behavioral round data
If the customer includes a behavioral round, the AI interviewer and the candidate exchange messages. We store the text of those messages — both questions and answers — in the same session event log.
Candidates can answer by typing or by speaking. When the candidate speaks, their browser’s built-in speech-to-text (the Web Speech API in Chrome, Safari, etc.) converts their voice to text locally; the resulting transcript is what gets sent to us. The browser may route the audio through Google or Apple for the recognition step depending on the browser used — Probe does not see or control that. We track byte counts from the microphone stream for accounting purposes, but the raw audio is never uploaded to Probe’s servers.
Where data is processed by AI
Two AI-driven things happen during and after the session:
- The candidate’s in-session assistant calls Anthropic’s Claude API. The prompts, conversation history, and the code in context are sent to Anthropic to generate a response.
- After submission, the session transcript and final code are sent to Anthropic again, this time to grade the round against the configured rubric. For the behavioral round, the candidate’s résumé text (capped at ~5,000 characters) is also included as context.
Anthropic processes this data under its commercial API terms. By default, the Anthropic API does not train models on customer API traffic. We do not currently send any data to other AI providers.
Analytics and tracking
We use two analytics providers on the marketing site and app:
- Google Analytics 4 — page views and a small set of event names (sign-up, login, demo-request submitted, interview events). Event parameters are truncated to short strings; the user ID we send is a hash of the Firebase ID, not the raw ID or email.
- Vercel Analytics — first-party page-view and web-vital metrics, collected by Vercel (our hosting provider).
We do not use Segment, Mixpanel, FullStory, or session-replay tools. We do not embed third-party advertising pixels.
Cookies and local storage
Probe doesn’t set its own cookies. Firebase Authentication stores a session token in browser storage so you stay signed in. We use the browser’s local storage for small UI preferences: dark/light theme, last selected coding language, editor panel sizes, and whether the dashboard activity rail is shown.
Where data is stored
- Firestore (Google Cloud, US region) — accounts, candidate records, session event logs, and résumé metadata. Encrypted at rest by Google by default.
- Application server filesystem (Vercel and a Render service) — résumé file contents and the code-execution runner.
- Anthropic API — session transcripts and code are sent to Anthropic for assistant responses and grading.
- Google Analytics, Vercel Analytics — see above.
Retention
Today, we keep candidate, session, and résumé data indefinitely unless you ask us to delete it. The hiring team can delete a candidate record at any time from the dashboard; that removes the candidate’s profile and pipeline state but may leave a session transcript that the customer can still open from its results URL until they ask us to remove it too.
We’re working on automatic expiry rules ahead of paid customers. We’ll publish them here before we turn them on.
Your rights and how to make a request
We don’t have a self-serve data-export or deletion portal yet. If you’re a candidate or a customer and you want us to export, correct, or delete your data, email paran.sonthalia@gmail.com from the address on the account or invite. We’ll confirm what’s on file and act on it manually.
We are not yet formally certified under GDPR, CCPA, SOC 2, or ISO 27001. If your team needs a Data Processing Addendum or a specific compliance attestation before signing a contract, tell us and we’ll let you know exactly where we are.
Changes to this page
We’ll update the “Last updated” date at the top of this page whenever we change it. If we ever start collecting a new category of data, we’ll add it here before we turn it on.
Contact
Probe Labs, Inc. · paran.sonthalia@gmail.com