What we protect, and how

How to read this page

This page describes the controls that are in place on this platform today, written in plain language. It is a statement of current practice by Coach Kay. It is not a certification, an audit result, or a claim of compliance with any standard.

Accounts and access

Starting a diagnostic requires signing in. Sign in is handled by the managed authentication service of our cloud provider, using email and password or Google sign in. Passwords are never stored by this application, and sign in over the network is protected by HTTPS.

Your saved runs are tied to your account. The database rules only return rows that belong to the signed in account, so one participant cannot read another participant's answers through the application.

Where your answers live

Diagnostic sessions are stored in a managed cloud database operated on our behalf. The browser does not talk to the database directly. Reads and writes pass through validated server functions, and row level access rules restrict every row to its owner.

Data is encrypted in transit using HTTPS and encrypted at rest by the database provider.

Resume tokens

Each run carries a random resume token stored in your browser so you can leave and come back. The token is not derived from your name or your email. Selecting Start over, or clearing your browser storage, removes that token from your device.

Reflections and personalization

Five of the twenty questions are reflections and are never scored. When your install plan is personalized, one sentence from the reflection attached to your bottleneck layer is passed to the AI model that drafts that sentence. The framework text itself is fixed, and an automated guard rejects any output that alters it.

If you would rather not have a reflection used this way, leave that reflection blank. The plan falls back to the standard wording.

Aggregate and jurisdictional reporting

Group reporting is designed so that no individual is exposed. Individual scores are never shown to leadership or to peers, and aggregate reporting begins only at five or more participants.

Cookies and tracking

This site does not use advertising cookies and does not run cross-site tracking. Browser storage is limited to what the site needs in order to sign you in and resume your run.

Retention and deletion

Saved runs are kept so you can return to them. You can end a run at any time with Start over. To request deletion of stored runs from our records, write to the address below and we will confirm once it is removed.

Shared responsibility

Hosting, database, authentication, and platform infrastructure are operated by our cloud provider. Application design, access rules, retention practice, and the handling of your requests are the responsibility of Coach Kay. Protecting your own account credentials, and deciding what you are permitted to type into a reflection, remains with you and your organization.

• Provider: hosting, encryption at rest, managed authentication, database operations.
• Coach Kay: access rules, data minimization, retention, response to privacy and security requests.
• You: credential hygiene, and keeping confidential or third party personal information out of reflections.

Reporting a vulnerability

Suspected vulnerabilities can be reported to the contact address below. Please include enough detail to reproduce the issue, and give us a reasonable window to respond before public disclosure. We do not pursue researchers who report in good faith and who avoid privacy violations and service disruption.

Contact

Security questions, privacy requests, and vulnerability reports can all be sent to the address below.