Privacy Policy · HiroHunt

We don’t sell dataNot your resume, not your profile, not your replies.

Used to applyYour details go to employers only when an application is sent.

AI doesn’t train on itResume analysis runs with data retention switched off.

You can delete itDownload a copy or delete your account yourself, any time.

01What we collect

From you

Account: your name, email address and profile picture from Google, LinkedIn or GitHub when you sign in. We don’t see or store a password.
Resume and profile: the file you upload, the details we read from it (work history, education, skills, contact details) and any edits you make.
Hunt preferences: the roles, places, salary range, work mode and other settings you choose, plus answers to common application questions.
Interview practice: your chat answers, and for voice calls, the transcript.
Accounts on hiring sites: when a site needs an account to apply, the agent creates one with your HiroHunt address and a password it sets. We keep the site and that password, encrypted, so the agent can sign in again; only the agent applying for you reads it — it isn’t shown in the app. While it applies, the agent can also read the emails in your HiroHunt inbox from the last 7 days, to find codes and confirmation links. Agent settings lists which sites have an account; forgetting one there deletes it from HiroHunt, and the account on the site itself is yours to close there.
Student verification: if you claim the student price, the school email address you verify and when you verified it. The code we email to that address is stored only in scrambled (hashed) form and expires after a few minutes.
One free plan per person: to stop the free plan being claimed again with new accounts, we keep scrambled (hashed) fingerprints — never the values themselves — of a cookie in your browser, the network you signed up from, and the phone number and email on your resume or Profile. We compare them only with other HiroHunt accounts. Network fingerprints are deleted after 60 days; the others stay while your account exists and for a year after you delete it.
Messages to us: anything you send to support.

From using the service

Which jobs were found, scored and applied to, and what the result was.
Employer replies that arrive at your HiroHunt inbox address, and whether each sender passed email authentication checks (DKIM and SPF).
Your plan, credit balance and a ledger of what each credit was spent on.
Referrals: if you sign up through an invite link, we keep a cookie with the invite code for up to 30 days, until you sign up, and then record who invited you. When you open the link you see the first name of the person who invited you. They see your first name and whether you’ve subscribed, never your email address.
Your language choice, kept in a cookie so every page shows up in the language you picked, and the language you last used the app in, stored with your account so the emails we send you are written in it.
Basic technical data, such as device, browser and IP address, used to keep the service secure and working.
How the site and app are used — pages visited and steps such as signing up or starting a mock interview — measured with Google Analytics. See Cookies and analytics.

Payments are handled by Creem, our reseller (Merchant of Record). Your card details go to Creem and never reach us. From Creem we get your Creem customer and subscription IDs, what you bought, the amounts and whether a payment went through.

02How we use it

To run the service: read your resume, find and rank jobs, tailor and send applications, and read, label and summarise the replies that come to your HiroHunt address.
To take payments, give you credits and keep your balance accurate.
To power the Dojo and give you feedback on your practice interviews.
To power Studio: we keep the resume versions and cover letters you make, and send the job text you pick or paste, together with your resume, to the AI provider to write them.
To keep HiroHunt safe: stop abuse, fix bugs and understand what’s broken.
To contact you about your account, your applications and important changes, and to email you when an employer replies.
To send a few emails from the team: help getting started, a reminder when matches are waiting for you, and offers when we have one. Every one has an unsubscribe link, and you can switch them off in Agent settings at any time. We never sell or share your address for anyone else’s marketing.

We use your information because it’s needed to provide what you asked for, because we have a legitimate interest in running a secure product, or because you’ve given consent, which you can withdraw.

03Who sees your data

We never sell your personal information. It’s shared only in these cases.

Who	What and why
Employers and job sites	Your resume, contact details and answers, only for the roles you’re applying to. That’s the whole point of the service.
Our agents, while searching for jobs	They only learn what to search for: popular roles and places across active users. Searching never involves names, resumes or anything that identifies you.
Our agents, while applying for you	For each application you’ve authorized (approved in Decide, or allowed by your autonomy setting), the agent sending it gets the profile, resume, saved answers and inbox access needed to complete that one application — and may use them for nothing else.
AI providers (OpenRouter and the model companies it routes to)	Resume text, your preferences and saved answers, interview content, and the employer emails that arrive at your HiroHunt address, sent to AI models to read your resume, score jobs, answer the questions on application forms, run the Dojo, and label and summarise your replies. We ask for data collection to be denied. See below.
Voice provider (ElevenLabs)	Audio of your Dojo voice calls, to run the call and produce the transcript. It doesn’t record the audio, and it keeps the text transcript for up to 30 days. We fetch the transcript right after the call to grade your interview and keep it with the interview.
Email provider (Postal)	Delivers the mail sent to and from your HiroHunt inbox address.
Email delivery (Zoho Mail)	Your name, the email address you signed in with and the content of the emails we send you — reply alerts (with a short summary of the employer’s reply) and emails from the team. You can turn either off at any time.
Google Analytics	Pages visited, steps taken in the app, device, browser, rough location, a random account ID, your plan, whether you have Studio Pro, your autonomy setting and the value of purchases, to see what works and what to fix. Never your name, email address, resume or messages. See Cookies and analytics.
Payments (Creem)	Creem sells our plans and credit packs as Merchant of Record. It gets your email address, name, billing country and payment details to take payments, charge VAT, send receipts and prevent fraud, under its own privacy policy. We send it your HiroHunt account ID so each payment lands on the right account.
Hosting and storage	Providers who store data and deliver the service for us, under contract and only for that purpose.
Authorities	Only when the law requires it, or to protect people or the service from serious harm.

If HiroHunt is ever sold or merged, your data would move with the service and this policy would still apply until you’re told otherwise.

04AI and your resume

HiroHunt reads your resume itself using an AI model, through a provider set to deny data collection. That means your resume is processed to give you a result and isn’t kept or used by the provider to train models.

AI also scores jobs against your profile and writes tailored application text. These are automated suggestions, and the results can be wrong. You can review and edit your profile at any time, and your edits take priority over what was read from the resume.

Roles, skills and places you type may help improve suggestions for others, but only after at least two different people have used the same value. Something only you typed stays private to you.

The free tools on our website (like the resume keyword checker and the email templates) run entirely in your browser. What you type into them isn’t sent to us or to any AI provider.

05Your HiroHunt inbox

Applications use a HiroHunt email address made for you, so replies don’t land in your personal inbox. Messages sent to it, including employer replies and verification codes, are stored, checked for sender authentication (DKIM and SPF), and read by our AI provider to label and summarise them for Signals and to let the applier finish applications that need a code. Images in these emails load when you open them, which can tell the sender your IP address and when you opened the message. Don’t use this address for anything personal.

06Voice interviews

When you start a voice call in the Dojo, your microphone audio goes to our voice provider (ElevenLabs) while the call is running. ElevenLabs doesn’t record the audio and keeps the text transcript for up to 30 days. We fetch the transcript right after the call to grade your interview and keep it with the interview, so you can read the report. The call only starts when you press start, and your browser asks for microphone permission first.

07How long we keep it

We keep your account data, resume and application history while your account is open, so the agent can keep working.
You can delete your account yourself in Agent settings → Your data. We then erase your account, profile, resumes, preferences and answers, applications, Studio versions and cover letters, interview content, and your inbox messages with their attachments. Payment records that Creem and we must keep for tax law stay. Your HiroHunt inbox address is never given to anyone else.
Expired sign-in sessions, old logs and our copies of the emails we sent you are removed on a regular schedule, and backups drop out of rotation.
Applications already sent to employers are in their hands. We can’t pull them back, and their privacy practices apply.

08Your choices and rights

You can see and change most of your data in the app: your profile, resume, preferences and answers. You can pause your hunt whenever you want, which stops the agent from sending anything. In Agent settings → Your data you can download a copy of your data and delete your account.

Depending on where you live, you may also have the right to access a copy of your data, correct it, delete it, object to or limit some uses, take it with you and complain to your data protection authority. Write to us and we’ll respond within 30 days. If you’re in California, we don’t sell or share personal information as defined by California law.

09Security

We protect your data with encrypted connections, restricted access and sign-in handled by Google, LinkedIn and GitHub. Our agent interfaces are private and require keys. No system is perfectly secure, so if something goes wrong that affects you, we’ll tell you promptly and say what we’re doing about it.

10Cookies and analytics

A few cookies are needed for HiroHunt to work: they keep you signed in, remember the language you picked, remember an invite link (for up to 30 days) or an offer link until you use it, and give your browser a random ID (hh_did, two years) so the free plan stays one per person.

We also use Google Analytics to understand how HiroHunt is used: which pages people visit, where they came from, and steps like signing up, finishing setup, starting a mock interview or choosing a plan. Google receives your device and browser type, a rough location worked out from your IP address (Google doesn’t store the address itself) and, when you’re signed in, a random account ID, your plan, whether you have Studio Pro, your autonomy setting and the value of what you buy. It never receives your name, email address, resume, messages or anything you type. We don’t use it for advertising, and Google keeps the detailed data for at most 14 months.

In the EU, the UK and Switzerland, analytics cookies (_ga and _ga_…) are set only after you allow them. Until then Google gets cookieless measurements that can’t be tied to you across visits. Elsewhere they’re on unless you decline. Your choice is saved in this browser, and declining removes the analytics cookies already set.

11Children, changes, contact

HiroHunt isn’t for anyone under 16, and we don’t knowingly collect their data. If you think a child has an account, tell us and we’ll remove it.

We’ll update this policy as the product changes. If a change matters, we’ll tell you in the app or by email, and we’ll update the date at the top. Our data is processed in countries other than yours; where that happens, we rely on contracts and safeguards that protect it to the same standard.

Questions?Write to [email protected] and a person will answer.