Privacy Policy

Last updated September 28, 2026

Nodes & Nines is a system design interview practice service operated by Virtual Metrics LLC (“we,” “us,” or “our”). This Privacy Policy explains what information we collect when you use nodesandnines.com and the Nodes & Nines service (together, the “Service”), how we use and share it, and the choices you have. It is part of our Terms of Service.

1. Information we collect

When you sign in with Google

We use Google’s basic sign-in permissions only. Google shares your name, email address, profile picture, and a unique Google account identifier with us. We store your name, email address, and Google account identifier. We receive your profile picture as part of sign-in but don’t store it. We don’t request access to your Gmail, contacts, calendar, files, or any other Google data.

What you create in the Service

• Whiteboards: the text, shapes, arrows, and diagrams you draw for each attempt, which we save automatically.
• Practice activity: the problems you attempt, your progress through each phase, the time you spend in each phase, and when you start and finish attempts.
• AI feedback: the scores, summaries, strengths, gaps, and key-point notes generated for the phases you submit.

Subscription and payment information

Subscriptions are sold through Link, Stripe’s checkout service, which acts as the merchant of record for your purchase. When you subscribe, you enter your payment details directly on the Stripe-hosted checkout page, and we never receive or store your full card number. Link and Stripe handle your payment information under their own privacy policies, and Link sends your receipts and billing emails. Stripe tells us your customer and subscription identifiers and whether your subscription is active. Through our Stripe account we can also see the billing details you give at checkout, such as your name, email address, billing address, card brand, the last four digits of your card, and your payment history.

Technical information

When you use the Service, our hosting providers automatically record technical information such as your IP address, browser and device type, the pages and features you request, and the date and time of each request. We may also use analytics and error-monitoring tools that record how the Service is used (for example, which pages are viewed and which features are used) and details about errors you run into.

When you contact us

If you email us, we receive your email address and whatever you include in your message.

2. How we use information

We use the information we collect to:

• provide the Service: create and maintain your account, save and restore your whiteboards, generate feedback, and show your history and summaries;
• manage subscriptions: check which problems you can access, process payments and cancellations through Stripe and Link, and answer billing questions;
• communicate with you about your account, your subscription, renewals, price changes, security, and changes to our Terms or this policy;
• send you product updates, practice tips, and promotional emails about Nodes & Nines, which you can unsubscribe from at any time (see Section 7);
• keep the Service secure, prevent fraud and abuse, and enforce our Terms and usage limits;
• understand how the Service is used, fix bugs, and improve features; and
• comply with the law and protect our rights and the rights of others.

We don’t use your whiteboards or feedback to train AI models, and we don’t use users’ whiteboards to test or tune our feedback system; we use sample boards we create ourselves. We look at an individual user’s whiteboard only when that user asks us to (for example, in a support request) or when we need to investigate a technical problem, abuse, or a legal matter.

3. AI-generated feedback

When you submit a phase for feedback, we send our AI provider the problem statement and its details, the rubric and key points for that phase, the contents of your whiteboard (the phase you submitted, with the rest of your board as context), and your most recent earlier feedback for that phase, if any. Each request includes a numeric account identifier used for abuse prevention, not your name or email address.

Our AI provider is OpenRouter, which routes these requests to Google’s Gemini models on Google Cloud. We configure these requests to use only zero-data-retention endpoints, meaning the provider doesn’t keep your content after generating a response, and our AI providers don’t use your content to train their models. OpenRouter keeps limited metadata about each request, such as the time, the model used, the request size, and the account identifier we send, for billing and operations.

Feedback is generated automatically and may be inaccurate. It is advisory only: we show it to you, and we don’t use it to make any other decision about you. Please don’t put sensitive personal information or confidential information (such as your employer’s non-public designs) on your whiteboard.

4. How we share information

We don’t sell your personal information, and we don’t share it for targeted advertising or for other companies’ own marketing. We share information only in these situations:

• Service providers that process information on our behalf to run the Service:
  • Google, for sign-in;
  • Amazon Web Services, for our application servers and database, located in the United States;
  • Vercel, for website hosting and delivery;
  • Stripe and Link, for checkout, payments, sales tax, and subscription billing;
  • OpenRouter and Google Cloud, for AI feedback (Section 3); and
  • providers of email, analytics, and error monitoring, if we use them for those purposes.
  Google, Stripe, and Link also handle information under their own privacy policies when you use their sign-in and checkout pages.
• Legal reasons: if we believe disclosure is required by law, legal process, or a government request, or is needed to protect the rights, property, or safety of our users, the public, or us, or to enforce our Terms.
• Business transfers: as part of a merger, acquisition, financing, or sale of all or part of our business. We’ll require the recipient to honor this Privacy Policy.
• With your consent or at your direction.

5. Cookies and similar technologies

We use only the cookies needed to sign you in and keep you signed in securely: an encrypted session cookie that keeps you signed in for up to 30 days, and short-lived cookies that protect the sign-in process. We also save some preferences in your browser’s local storage, such as your side-panel layout and which problem details you’ve revealed during an attempt. That information stays on your device.

We don’t use advertising cookies or third-party tracking pixels. Google, Stripe, and Link may set their own cookies on their own sites when you sign in or check out. If we add analytics that use cookies, we’ll update this section first.

Do Not Track. We don’t track you across third-party websites or allow third parties to do so through the Service, so we don’t change our practices in response to browser Do Not Track signals.

6. How long we keep information

• Your account, whiteboards, practice activity, and feedback: for as long as your account exists. When you ask us to delete your account, we delete this information within 30 days. Copies in our database backups are removed as those backups expire, within 7 days after deletion.
• Billing records: we, Stripe, and Link keep records of payments, subscriptions, and your agreement to subscription terms for as long as the law requires, which can be several years after your account is deleted.
• Technical logs: kept for a limited time for security and troubleshooting, then deleted or overwritten.
• Emails with us: kept as long as needed to respond to you and keep a record of our conversation.
• Marketing opt-outs: if you unsubscribe, we keep your email address on a suppression list so we don’t email you again.

7. Your choices and rights

• Access and copy: email us to request a copy of your account information, whiteboards, and feedback.
• Correction: your name and email address come from your Google account and update when you use the Service. You can change them in your Google account or ask us to correct them.
• Deletion: email support@nodesandnines.com from the address on your account to delete your account and data. We’ll confirm the request and complete it within 30 days. Deleting your account cancels any active subscription; our Terms of Service explain how refunds work.
• Payment information: Link and Stripe hold your payment details. You can ask Link to delete them, which also cancels any subscription you bought through Link.
• Marketing emails: use the unsubscribe link in any marketing email, or email us. You’ll still receive messages about your account and subscription.
• Google access: you can remove Nodes & Nines’s access to your Google account at any time from the Third-party apps & services page of your Google Account. This stops future sign-ins but doesn’t delete your data; email us for that.

We respond to requests within 30 days and may need to verify your identity first. Depending on where you live, you may have additional rights under local law. We’ll honor requests as applicable law requires, and we won’t treat you differently for making one.

8. Google user data

Nodes & Nines’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy. We access only your name, email address, profile picture, and Google account identifier, and we use them only as this policy describes: to create and identify your account, to communicate with you, and to send you emails about Nodes & Nines that you can unsubscribe from. We store your name, email address, and Google account identifier in our database in the United States. We don’t sell this information, use it for advertising, or use it to train AI models, and we share it only with the service providers and in the circumstances described in Section 4. You can delete it as described in Section 7.

9. Security

We protect your information with measures such as encryption in transit (HTTPS), encrypted database storage, and access limited to the people who need it to run the Service. No method of transmission or storage is completely secure, so we can’t guarantee absolute security. If a security breach affects your personal information, we’ll notify you as required by law.

10. Children

The Service is only for people 18 and older. We don’t knowingly collect personal information from anyone under 18. If you believe someone under 18 has created an account, contact us and we’ll delete it.

11. Where we process information

We’re based in the United States, and the Service is intended for users in the United States. We store and process your information in the United States, and our service providers may process it in other countries. If you use the Service from outside the United States, your information will be transferred to and processed in the United States.

12. Changes to this policy

We may update this policy from time to time. We’ll post the updated version here with a new “Last updated” date. If we make material changes, including using your Google account information in a new way, we’ll notify you by email or in the Service before the changes take effect and, where required, ask for your consent.

13. Contact us

Questions or requests about your privacy? Contact us by email at support@nodesandnines.com. Nodes & Nines is operated by Virtual Metrics LLC.