Privacy Policy

Only what the product needs to work:

• Account — your email address, and your name and profile picture if you sign in with Google or add them yourself.
• Prompts — the rough prompt you paste, your answers to the interview questions, and the compiled result, saved to your history so you can return to it.
• Attached context — text, files or links you attach. See section 3, which describes how these are handled differently.
• Usage — a per-day count of refinement sessions, used to enforce the free plan’s daily limit.
• Subscription status — your plan, its state and renewal date, synced from Polar.

We do not run analytics or advertising trackers, and we do not sell personal data. Card details never reach us — Polar handles payment entirely.

• Supabase — authentication, database and file storage.
• NVIDIA — our AI provider. Your prompt, your answers and any attachment summaries are sent to NVIDIA’s hosted inference API to generate the interview questions and compile the final prompt. This is the processor that receives your prompt content.
• Polar Software, Inc. — payments, as merchant of record. Receives your email and billing details directly.
• Cloudflare and our hosting provider — serve the site and process request logs, including IP addresses.

Each processor handles your data under its own privacy policy: Supabase, NVIDIA, Polar and Cloudflare.

If we change AI provider we will update this section and the date at the top before your prompts are sent anywhere new.

When you attach a file, link or block of text, it is read, summarised into a short context note, and then discarded. The original file is never written to disk and the fetched page is never retained. Only the summary is kept, as part of the prompt it belongs to.

Uploaded files are parsed, never executed. We accept PDF, DOCX, TXT and Markdown, and check the file’s actual contents rather than trusting its extension.

• Saved prompts — until you delete them or your account
• Account details — until you delete your account
• Daily usage counts — one row per day, removed with your account
• Attachment originals — never stored

Deleting your account from Settings removes your profile, prompts, usage records and subscription rows immediately. It does not remove records Polar must retain for tax and accounting.

Server access logs, which include IP addresses, are kept for 30 days and then deleted. Cloudflare retains its own edge logs under its policy, which we do not control.

Depending on where you live you may have the right to access, correct, export or delete your personal data, and to object to certain processing. Account deletion is available directly in Settings; for anything else, contact us.

If you are in the UK or EU, we rely on these legal bases under the UK GDPR and GDPR: performance of a contract for your account, your prompts and your subscription — this is the service you asked us to provide; and legitimate interests for security logging and preventing abuse of the free plan. We do not process your data for marketing, and we do not rely on consent, so there is no consent for you to withdraw.

Your prompts are sent to NVIDIA for processing, which may involve a transfer outside the UK and EEA. Where that happens we rely on the provider’s standard contractual clauses. You can also complain to your local data protection authority — in the UK, the Information Commissioner’s Office.

To exercise any of these rights, email [email protected]. We will respond within one month, as the GDPR requires.

Traffic is encrypted in transit. Database access is row-level restricted so one account cannot read another’s data. Payment webhooks are signature-verified before anything is written.

No system is perfectly secure. If a breach affects your data we will notify you and any regulator we are required to inform.

We will post any update here and change the date at the top. Material changes will be notified by email or in the app. Questions about this policy, or the Terms of Service, can be sent to [email protected].