Privacy

ReviewCoach is a working prototype, not a launched product. This page describes what the running demo actually does with what you type into it.

Signing in is real, but the accounts are not

Your password is genuinely checked. Sign-in runs on Better Auth, the session lives in the database, and the cookie is httpOnly and signed with a server secret. There is no email verification and no account recovery — this is a prototype, and a forgotten password is not something it can help you with.

What is not real is the accounts themselves. Every person in the demo was created by a seed script and they all share one password, which is written down in the repository. Anyone who has read it can sign in as any of them. Treat those identities as public.

What you enter is stored, and it persists

Clips, notes, threads, notifications and preferences are written to a PostgreSQL database and survive a restart. Voice comments and image attachments are stored as real bytes. None of it is encrypted beyond what the connection and the host provide, and there is no backup, no retention schedule and no way to ask for deletion other than writing to the address below.

Assume other people can see it

Because the seeded accounts share a published password, anything you put into a demo group can be read by anyone else who signs into that group. Treat it as a public sandbox: do not put anything private, personal or confidential into it.

Video uploads carry no video

Choosing a video does not upload it. The demo sends only the file’s name, type and size, and mints a fake upload target in return; the video itself never leaves your browser, and the preview you see is a local URL that disappears when you close the tab. Voice recordings and image attachments are the exception — those are uploaded and kept.

Nothing is tracked

There is no analytics, no tracking pixel, no advertising and no third-party script anywhere on this site, and no cookie other than the session cookie above. The typeface is served from this site rather than fetched from Google Fonts.

One third-party request does exist, and it is worth naming: inside the app itself the typeface is still fetched from Google Fonts, so your browser contacts that domain there. The marketing pages — including this one — do not.

Questions

Write to hola@reviewcoach.app. The companion notes on what the prototype is and is not are on the terms page.