Privacy and limits

Clear privacy boundaries

Your study data stays private to your account. Prompts are processed by Microsoft Foundry, so never paste credentials or confidential data. Voice features are opt-in.

• Accounts and saved study sessions are stored in the app’s Azure-hosted service. Secure session cookies require HTTPS in production. Cert Buddy does not store your password in browser storage.
• A recovery code is shown once when created or replaced. Keep it secret and save it offline; anyone holding it can reset your password. Cert Buddy does not retain the plaintext code in browser storage. Password reset replaces the code and signs out existing sessions. There is no email recovery.
• Minimal usage metrics, including request outcomes, latency and provider-reported token counts when available, are stored for owner reports. Analytics do not contain conversation transcripts. Your own reports are private; explicitly authorized administrators can see all-user usage reports. Tracking is not retroactive, and reported tokens are not exact billing. See Usage & account after signing in.
• Your study prompts and relevant saved conversation context are processed by Microsoft Foundry. Do not enter credentials, private customer data or other confidential information.
• Dictation is off until you start it and accept the notice. Your browser may send audio to its speech provider. Only the transcript goes to Cert Buddy after you press Send. Speech availability and privacy depend on your browser and provider.
• Read aloud is a separate opt-in. Your browser’s voice service may process the answer text. Turn it off at any time.
• Old device-only profiles are not cloud accounts and are not automatically imported by matching a name. Create an account to start saving new sessions across devices.
• Delete an unwanted conversation from the workspace. Logging out removes it from the visible workspace but does not delete the account’s stored sessions.