Legal
Privacy Policy
How we collect, use, and protect your data when you use CaseBlitz to prepare for case interviews.
Last updated: March 2026
1. Who we are
CaseBlitz (caseblitz.app) is a case interview practice platform operated by Philippe Kam. For questions about this policy or your data, contact us at [email protected].
2. Data we collect
We collect only the data necessary to provide and improve CaseBlitz. Here is exactly what we store:
Account information
- —Name and email address — provided when you sign in via Google OAuth or magic link email
- —Anonymous session identifier — assigned if you use CaseBlitz without creating an account
Practice data
- —Drill scores, timestamps, and time per question
- —Case framework text you submit for AI-powered feedback
- —Streak data and daily completion records
Preferences & optional data
- —Interview target date and firm label (optional, only if you provide them)
- —Currency preference (EUR, USD, or GBP)
- —Browser timezone (detected automatically to display times correctly)
- —Push notification subscription data (only if you opt in)
We do not collect your location, contacts, browsing history, or any data beyond what is listed above.
3. How we use your data
- —Authenticate you and maintain your session
- —Save and display your drill scores, streaks, and progress
- —Generate AI-powered feedback on case frameworks you submit
- —Process your Pro pass purchase
- —Send magic link sign-in emails (only when you request them)
- —Deliver push notifications (only if you opt in)
- —Understand aggregate usage patterns via self-hosted analytics to improve the product
We do not sell, rent, or trade your personal data to anyone. We do not serve advertisements. We do not build advertising profiles.
4. Third-party services
CaseBlitz relies on the following third-party services to operate. Each receives only the minimum data required for its function:
Supabase
Database (PostgreSQL)
Stores your account, scores, and practice data. Hosted in EU West 1 (Dublin, Ireland). Data does not leave the EU.
Anthropic Claude API
AI feedback
When you submit a case framework for critique, the text you wrote is sent to Anthropic's Claude API for analysis. Anthropic is a US-based company. Your framework text is processed by their servers to generate feedback and is subject to Anthropic's data usage policy. No other personal data is sent to Anthropic.
Polar.sh
Payment processing
Handles the €30 one-time Pro pass purchase. Polar processes your payment information directly — CaseBlitz never sees or stores your card details.
Resend
Transactional email
Delivers magic link sign-in emails. Receives only your email address and the sign-in link. No marketing emails are sent.
Google OAuth
Authentication
If you choose to sign in with Google, Google provides us your name and email address. We do not receive your Google password or access your Google data beyond basic profile information.
Vercel
Application hosting
Hosts the CaseBlitz web application. Vercel processes HTTP requests necessary to serve the application.
OpenPanel
Analytics
Self-hosted at api-openpanel.philippekam.dev. Collects anonymous usage metrics (page views, feature usage). No third-party tracking. No data is shared with external analytics providers.
5. Google User Data
If you sign in to CaseBlitz using Google OAuth, we access the following Google user data. This section specifically addresses the requirements of the Google API Services User Data Policy.
Data Accessed
When you sign in with Google, CaseBlitz requests access to your basic profile information only:
- —Your name (as displayed on your Google account)
- —Your email address
- —Your profile picture URL (if available)
We do not access your Google Drive, Gmail, Calendar, Contacts, or any other Google service data. We do not request any sensitive or restricted Google API scopes.
Data Usage
Your Google profile data is used exclusively for the following purposes:
- —Creating and authenticating your CaseBlitz account
- —Displaying your name within the CaseBlitz application (e.g., on your profile page and dashboard)
- —Associating your practice data (drill scores, streaks, progress) with your account
Your Google user data is not used for advertising, marketing, user profiling, or any purpose unrelated to providing the CaseBlitz service. Your Google user data is not used to train AI or machine learning models.
Data Sharing
Your Google user data is not shared with any third parties for their own purposes. Specifically:
- —We do not sell, rent, or trade your Google user data
- —We do not share your Google data with advertisers or data brokers
- —We do not transfer your Google data to any third party except as strictly necessary to operate the service (see below)
The only third-party services that process your Google-provided name and email are: Supabase (database storage in EU) and Vercel (application hosting). These services process your data solely to operate CaseBlitz and are bound by their own data protection policies.
Data Storage & Protection
Your Google user data is stored securely in our PostgreSQL database hosted by Supabase in the EU (Dublin, Ireland). All data is:
- —Transmitted exclusively over HTTPS/TLS encrypted connections
- —Stored in a database with row-level security policies
- —Protected by secure, httpOnly authentication cookies (not accessible to client-side JavaScript)
- —Accessible only to authenticated application processes — no direct database access is exposed
Data Retention & Deletion
Your Google user data is retained only for as long as your CaseBlitz account exists. You can delete your account and all associated data at any time:
- —Self-service: Delete your account from the Profile page within the CaseBlitz application
- —By request: Email [email protected] and we will delete your account and all data within 30 days
Upon account deletion, all Google-provided data (name, email, profile picture URL) and all associated practice data are permanently and irrevocably removed from our database. No copies are retained.
6. International data transfers
Your primary data (account, scores, progress) is stored in the EU via Supabase (Dublin, Ireland).
When you use the AI framework feedback feature, the case framework text you submit is sent to Anthropic's servers in the United States for processing. This transfer is necessary to provide the AI critique feature and occurs only when you actively submit a framework for review. The legal basis for this transfer is your explicit consent through use of the feature, in accordance with Article 49(1)(a) of the GDPR.
Vercel may process HTTP requests through global edge locations to serve the application efficiently. No personal data is persistently stored outside the EU.
7. Data retention
8. Your rights under GDPR
If you are located in the European Economic Area (EEA), you have the following rights regarding your personal data:
- —Right of access: Request a copy of the personal data we hold about you.
- —Right to rectification: Request correction of inaccurate personal data.
- —Right to erasure: Request deletion of your data. You can do this immediately by deleting your account from the Profile page.
- —Right to restrict processing: Request that we limit how we use your data.
- —Right to data portability: Request your data in a structured, machine-readable format.
- —Right to object: Object to our processing of your data where we rely on legitimate interest.
- —Right to withdraw consent: Withdraw consent at any time where processing is based on consent (e.g., push notifications, AI feedback feature).
To exercise any of these rights, email [email protected]. We will respond within 30 days. You also have the right to lodge a complaint with your local data protection authority.
9. Legal bases for processing
- —Contract performance: Processing your account data, scores, and streaks to provide the CaseBlitz service you signed up for.
- —Consent: Sending push notifications (opt-in), processing framework text via Anthropic's AI (initiated by you), magic link emails (requested by you).
- —Legitimate interest: Self-hosted analytics to understand usage patterns and improve the product, without identifying individual users.
11. Security
All data is transmitted over HTTPS. Authentication is handled via secure, httpOnly cookies. Passwords are never stored — we use Google OAuth and magic link email sign-in exclusively. Payment processing is handled entirely by Polar.sh; we never receive or store payment card details.
Our database is hosted on Supabase with row-level security policies. Access to production infrastructure is restricted and audited.
12. Children's privacy
CaseBlitz is not directed at children under 16. We do not knowingly collect personal data from children. If you believe a child under 16 has provided us with personal data, please contact us at [email protected] and we will delete the data promptly.
13. Changes to this policy
We may update this privacy policy to reflect changes in our data practices or legal requirements. When we make material changes, we will update the "Last updated" date at the top of this page. We encourage you to review this page periodically. Continued use of CaseBlitz after changes constitutes acceptance of the updated policy.
14. Contact
For questions, concerns, or data requests related to this privacy policy, contact:
CaseBlitz — Philippe Kam
Email: [email protected]