So What Club
Start free

Privacy Policy

Privacy Policy

Last updated: October 1, 2026

The short version: So What Club does not ask for your email, a password, or any other personal details. Your learning progress is saved only in your own web browser, on your device. We do not sell data, we do not use advertising or tracking cookies, and we do not run analytics that follow you around the web.

Who is responsible

This site is run by Aryan Pratap Singh Tomar, R.1, 22 Boulevard du Général Leclerc, 77300 Fontainebleau, France, an individual based in France. We are responsible (the “controller”) for the small amount of personal data described below. You can reach us about anything in this policy at [email protected] or by telephone on +33 7 80 71 09 52. The same address reaches the person who handles privacy requests and complaints for us, including as our Data Protection Officer contact under Singapore's PDPA and our grievance contact under India's Digital Personal Data Protection Act. Because we are in France, the French data protection authority, the CNIL, is our lead regulator. Who publishes and hosts the site is also set out in our legal notice (mentions légales).

What is saved on your device, not with us

When you use the site, it saves what you choose to enter (for example an optional first name, the firms you are targeting, your answers and progress, and any practice stories you write) in your browser's local storage. This stays on your device. It is not sent to us and we cannot see it. The site also keeps a few small things there so it works as you expect: your recent searches, notices you have closed, whether you skipped the skills check for now, and copies of the pages you open, so they also work without a connection. The site sets no cookies of its own. All of this is strictly necessary to provide what you asked for (remembering your progress, working offline), and none of it is used for advertising or analytics. If you clear your browser data, or use another browser or device, your progress will not be there.

Visitor counts. We count visits with Cloudflare Web Analytics, run by our host. It sets no cookies, stores nothing on your device and does not build a profile of you or follow you to other sites. When a page loads, it sends Cloudflare the page address, the page you came from, your browser type and how fast the page loaded, and we see only totals (for example, how many people opened a lesson today). Our legal basis is our legitimate interest in knowing which pages people use so we can improve them.

Some tools keep what you enter on this device only, and never in an account: the application tracker (firms, offices, roles, dates and your notes), the text of your CV and cover letter if you press “Save on this device” in the CV checker (the check itself runs in your browser and nothing is uploaded), your Industry Gym tally, which practice questions you missed recently, and your timer choice for the practice tests. “Download my progress” includes them, and “Delete my data” removes them.

What our hosting provider processes

Like every website, the site is delivered by servers. Our host, Cloudflare, Inc. (101 Townsend St., San Francisco, CA 94107, United States), serves the pages through its global network and automatically processes technical data when your browser requests a page: your IP address, browser type, the page requested, and the time. This is used only to deliver the site, keep it secure (for example against attacks), and fix errors, and it is kept for a limited period under the host's standard log retention. Our legal basis is our legitimate interest in running a secure website. Cloudflare acts as our processor under its data processing addendum.

Transfer to the United States. Cloudflare is a US company, so this data may be processed in the United States and in other countries where its network runs. Cloudflare is certified under the EU-US Data Privacy Framework, which the European Commission has found gives adequate protection to personal data sent to certified US companies. Its data processing addendum also includes the European Commission's Standard Contractual Clauses (with the UK Addendum for UK data) for any transfer the Framework does not cover. You can read the addendum at cloudflare.com.

Who processes data for us

These companies handle personal data on our behalf, only on our instructions:

  • Cloudflare, Inc. (United States): hosts the site and keeps its technical logs, as described above. Always in use.
  • Supabase (database, stored in the European Union, Frankfurt, Germany) and Brevo (Sendinblue SAS, France, for emails): not in use today. They will be used only if we add optional accounts, and we will update this policy before that happens.

If you email us

If you write to [email protected], we receive your email address, your name if your email shows it, and what you write. We use it only to reply and to deal with your request. Our legal basis is our legitimate interest in answering you, or, for a privacy request, our legal duty to answer it. We delete the messages once the matter is closed, and at the latest 3 years after our last exchange, unless we need them to establish or defend a legal claim.

What we do not do

  • We do not collect your name, email, phone number, or password.
  • We do not use advertising cookies or tracking pixels. Visitor counts are cookie-free and anonymous (see above).
  • We do not sell or share personal data.
  • If the site is ever sold or merged into another organisation, the data we hold would move with it only under this policy's promises. We would tell you before that happens, and you could delete your data first.
  • We never put personal information in web addresses, except your alias in the video-call link, which only your browser and Jitsi read.
  • When you choose “Answer out loud”, we use your microphone, only after your browser asks you, to turn your answer into text on your own device. The recording is never sent to us or anyone else and is deleted as soon as the text is made. The optional camera preview for a spoken close is never recorded (see Spoken answers).

Spoken answers: turned into text on your device

In the case simulator, the story workshop and other practice, you can press “Answer out loud” and speak your answer instead of typing it. This is how it works:

  • Your browser asks before the site can use your microphone, and only after you press the button. A red Recording sign and a timer show the whole time, and recording stops by itself at the time limit.
  • Your recording is turned into text on your own device by a speech model that runs in your browser. It is kept only in the page's memory while that happens and is deleted straight after. It is never sent to us or to anyone else, and it is never saved.
  • The text appears in the answer box so you can correct it, and it is then scored by the same published rules as a typed answer. The speaking figures shown (words per minute, filler words, length) are simple counts from the text, not a judgement of your voice, emotions or confidence.
  • The first time, your browser downloads the speech model and program files from Hugging Face and jsDelivr (about 68 to 104 MB, shown before you start) and keeps them for next time. The file hosts see your IP address and basic browser details, as any file host does; we send them nothing about you or your answers.
  • For a spoken close you can show your camera as a practice preview. The picture stays on your screen: it is never recorded, saved or sent.

Typing always works instead, and on devices that cannot run the speech model the site says so and keeps the typed box.

How long we keep data

  • What is saved in your browser: until you delete it (see below). We cannot see or delete it ourselves.
  • Hosting logs: for the limited period of Cloudflare's standard log retention.
  • Emails you send us: until the matter is closed, and at the latest 3 years after our last exchange.

Your rights and controls

If you are in the European Union, the GDPR gives you these rights over your personal data: to access it and get a copy (article 15), to correct it (article 16), to have it deleted (article 17), to restrict how it is used (article 18), to receive it in a format you can reuse (article 20), to object to a use based on our legitimate interest (article 21), to withdraw consent at any time without affecting earlier use (article 7), and not to be subject to a decision made by machine alone that has legal or similarly serious effects on you (article 22). French law also lets you give instructions about what happens to your data after your death (article 85 of the loi Informatique et Libertés). If you live elsewhere, your local law may give you similar rights, and we honour them in the same way.

For the data on your device, you control it directly: open your profile and choose “Delete my data” to erase your profile, progress, stories, application tracker, saved CV text, and any practice results waiting to be sent from this browser, and the speech model files kept for spoken answers, or clear the site's data in your browser settings, which also removes small settings such as your recent searches and the offline copies of pages. For the hosting data, email us and we will respond within one month (or sooner where your local law requires).

You have the right to complain to a data protection regulator. You can write to us first, and we will try to put things right, but you do not have to. Our lead regulator is the French authority, the Commission nationale de l'informatique et des libertés (CNIL), Service des plaintes, 3 Place de Fontenoy, 75007 Paris, France. You can complain to it online at cnil.fr/fr/plaintes. If you live or work in another EU country, you can also complain to the authority there. Outside the EU, for example:

  • United Kingdom: the Information Commissioner's Office (ICO)
  • India: the Data Protection Board of India
  • Singapore: the Personal Data Protection Commission (PDPC)
  • United Arab Emirates: the UAE Data Office
  • Saudi Arabia: the Saudi Data and AI Authority (SDAIA)
  • Qatar: the National Cyber Governance and Assurance Affairs (NCGAA) of the National Cyber Security Agency
  • Brazil: the National Data Protection Authority (ANPD)
  • Nigeria: the Nigeria Data Protection Commission (NDPC)
  • South Africa: the Information Regulator
  • Kenya: the Office of the Data Protection Commissioner (ODPC)

Young people

The site is written for students and professionals preparing for consulting interviews, and it does not ask anyone for personal data. If you are under 18, please use it with the knowledge of a parent or guardian.

Changes to this policy

If we add anything that changes this picture, such as accounts that sync across devices, analytics, or the paid live mock interview, we will update this policy before the change goes live, ask for any consent the law requires, and change the date at the top.

Contact

Questions or requests about your privacy: [email protected].

Start learning, no details needed

The first lesson needs no account and no personal details: your progress stays in this browser.