Privacy Policy

ApexIB ("we," "us," or "our") provides an interview-preparation platform for investment banking recruiting. This policy explains what information we collect, how we use it, and the choices you have.

Information we collect

We collect information you provide directly:

• Account information — name, email address, and password (stored as a salted hash, never in plain text). If you sign up or sign in with Google, we receive your name, email address, and profile picture from your Google account instead of a password — see "Google Sign-In" below for details.
• Profile information — school, graduation year, avatar, and any bio details you choose to add.
• Practice content — your written or spoken answers to interview questions, session history, and self-reported interview dates.
• Payment information — subscription plan and billing status. Card details are handled directly by Stripe or Apple's In-App Purchase system; ApexIB does not store your card number.
• Social content — posts, comments, reactions, and study party activity you choose to share with other users.
• Networking contacts — names, emails, banks, and notes you add to My Network to track your own recruiting outreach.
• Google Calendar data — if you connect Google in Settings → Connectors, we read calendar event details (title, time, attendees, location). See "Google Calendar integration" below for details.

We also collect information automatically:

• Device and usage data (app version, general interaction logs, crash reports).
• Approximate location derived from IP address, used only for fraud prevention and regional pricing.
• Precise device location — only on iOS, and only if you grant permission — used solely to calculate your local sunrise and sunset time so the app can automatically switch between light and dark mode. We store the resulting coordinates and computed times so this preference stays consistent across your devices; we do not track your location over time or use it for any other purpose.

How we use your information

• To grade your practice answers and generate personalized feedback and weak-spot tracking.
• To operate account, subscription, and billing functions.
• To power social features you opt into — school leaderboards, feeds, and study parties.
• To power My Network features you opt into — the Upcoming and History calendar cards, and Network Insights (aggregated stats like meetings by bank and your busiest day for calls, computed from your Google Calendar data and never shown to anyone but you).
• To automatically switch the app's theme based on your local sunrise and sunset, if you have Auto theme enabled.
• To send transactional email (receipts, verification, password resets) and, if you opt in, product updates.
• To maintain the security and integrity of the platform.

How your answers are graded

When you submit a practice answer, the text is sent to Anthropic's Claude API to generate feedback and a score. Anthropic processes this content solely to return a grading result to ApexIB and does not use it to train models, per Anthropic's API terms.

Who can see your information

Your practice answers, scores, and progress are private by default and visible only to you. If you enable social features, your name, school, and activity (such as streaks or session summaries) become visible to other users according to your privacy settings, which you control at any time in Settings → Privacy. Your networking contacts, calendar data, and Network Insights are private and visible only to you — never shared with other users.

Google Sign-In

If you choose "Continue with Google" to sign up or sign in, we request only your basic Google account information — name, email address, and profile picture — to create and authenticate your ApexIB account. This is separate from, and does not require, the Google Calendar integration described below. We do not access your calendar or any other Google data as part of sign-in. You can review or revoke ApexIB's access at any time from your Google Account permissions page.

Google Calendar integration

Connecting Google is entirely optional and lives in Settings → Connectors. It's off by default; you choose to turn it on, and you can disconnect at any time from the same screen, which immediately revokes ApexIB's access.

When connected, we access:

• Google Calendar (read-only) — event titles, times, locations, and attendees, used to show upcoming and past calls/meetings in My Network, and to compute aggregated meeting statistics (like meetings by bank and your busiest day for calls) in Network Insights.

We do not read, store, or process calendar content unrelated to your My Network contacts. We store only what's needed to power these features — the date of your last meeting with a contact and aggregated statistics (like "3 meetings this month" or "Tuesday is your busiest day") — not the full content of your calendar events. Disconnecting Google stops all future access and does not affect your Calendar data itself.

Our use and transfer of information received from Google APIs to any other app adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not use this data for advertising, and we do not allow humans to read it except as necessary for security, legal compliance, or with your explicit consent.

Third-party service providers

We share limited data with vendors who help us operate ApexIB, each bound by their own privacy and security obligations:

• Stripe — payment processing for web subscriptions.
• Apple — payment processing and subscription management for iOS purchases, via RevenueCat.
• RevenueCat — subscription status and entitlement management.
• Anthropic — AI grading of practice answers.
• Resend — transactional email delivery.
• Railway — application hosting and database infrastructure.
• Google — used for "Continue with Google" sign-in (name, email, profile picture), for Calendar access if you separately connect your Google account in Settings → Connectors, and for Google Analytics (see "Cookies and analytics" below).

We do not sell your personal information.

Cookies and analytics

We use Google Analytics to understand how visitors use ApexIB — which pages get viewed, how people navigate the site, and whether key actions (like creating an account or answering a practice question) are completing successfully. Google Analytics uses cookies and similar technologies to distinguish visitors and collect this usage data, which is processed by Google according to its own privacy policy. We do not use this data to build advertising profiles or sell it to third parties. If you'd prefer not to be tracked by Google Analytics, you can install Google's opt-out browser extension, or use your browser's tracking-prevention or ad-blocking settings.

Data protection

We take a small number of concrete, verifiable steps to protect your data rather than relying on broad claims:

• Encryption in transit — every connection to ApexIB, including all API and database traffic, is encrypted via TLS/SSL. We do not transmit account credentials, Google data, or practice content over unencrypted connections.
• Encryption at rest — our database is hosted on Railway's managed PostgreSQL infrastructure, which encrypts stored data at rest.
• Password security — passwords are never stored in plain text. We store a salted cryptographic hash and cannot see or recover your original password.
• Session security — authenticated sessions use signed JSON Web Tokens (JWTs) rather than long-lived shared credentials, and access to Google Calendar data requires a valid, current OAuth token that you can revoke at any time.
• Access control — ApexIB is operated by a small team with no unnecessary standing access to user data; production credentials and API keys are managed as environment-level secrets, not stored in source code.
• Incident response — in the event of a data breach affecting your personal information, we will notify affected users and any relevant authorities as required by applicable law.

Data retention

We retain your account and practice data for as long as your account is active. If you delete your account, we delete your personal information within 30 days, except where retention is required for legal, tax, or fraud-prevention purposes.

Your choices

• You can edit or delete your profile information at any time in Settings.
• You can make your profile private, limiting visibility of your activity to followers only.
• You can disconnect Google Calendar at any time in Settings → Connectors, and revoke ApexIB's access entirely from your Google Account permissions page.
• You can turn off location-based Auto theme, or deny/revoke location access at any time in your iOS Settings for ApexIB.
• You can request a copy of your data or request deletion by contacting us below.
• You can unsubscribe from marketing email at any time via the link in any such email.

Children's privacy

ApexIB is intended for users 13 years of age and older. We do not knowingly collect personal information from children under 13.

Changes to this policy

We may update this policy from time to time. If we make material changes, we will notify you by email or in-app notice before the changes take effect.