Privacy Policy

• Account data — your email, name, optional avatar, and (if you sign in with Google or GitHub) the basic profile fields those providers return.
• Practice data — the interview questions you generate, the answers you give (typed or transcribed from your microphone), AI-generated scores and feedback, and any session metadata (topic, difficulty, timestamps).
• Voice recordings (opt-in only) — if you enable “Save audio recordings” in Settings, we store the audio file alongside its transcript so you can replay it later. Off by default; you can disable it any time and existing recordings can be deleted.
• Billing data — if you subscribe, Stripe processes your payment. We store your Stripe customer ID and subscription status; we do not see or store your card number.
• Usage analytics — anonymous product analytics via PostHog (page views, button clicks, feature usage). Off by default for users who send Do-Not-Track or Global Privacy Control headers; opt-out per device under Settings → Privacy.
• Diagnostics — error traces and request IDs via Sentry so we can debug crashes. No keystrokes or page content is captured.

• Run the AI evaluator that scores your answers and writes feedback.
• Generate interview questions, plan follow-ups, and (on the Pro tier) deliver the real-time conversational interviewer's voice.
• Show you your own progress over time (scores, sessions, weak areas).
• Bill your subscription via Stripe and manage upgrades/cancellations.
• Send transactional emails (sign-up confirmation, password reset). Optional weekly digest can be turned off in Settings → Notifications.
• Investigate and fix bugs (Sentry), and understand which features get used (PostHog, opt-out).

We do not sell your data, share it with advertisers, or use your practice answers to train third-party AI models. The LLM providers we call (below) operate on a no-training-on-customer-data basis under their API terms.

We use the following sub-processors. Each is contractually bound to handle your data only to deliver their service to us:

• Supabase — database, auth, file storage (audio recordings).
• Stripe — payment processing and subscription management.
• Google (Gemini) — LLM for question generation, answer evaluation, and feedback.
• Anthropic (Claude) — LLM fallback when Gemini is rate-limited or unavailable.
• Deepgram — speech-to-text for the conversational interviewer (Pro tier only).
• Cartesia — text-to-speech for the conversational interviewer's voice (Pro tier only).
• Sentry — error tracking and performance traces.
• PostHog — product analytics (opt-out).
• Vercel — hosting and CDN.

• Access & export — email us and we'll send you a copy of your data.
• Delete — remove your account and all associated data via Settings → Security. This is permanent and immediate.
• Opt-out of analytics — toggle off in Settings → Privacy. We honor Do-Not-Track and Global Privacy Control automatically.
• EU/UK/California residents — you have additional rights (rectification, restriction, data portability) under GDPR and CCPA. Email us to exercise them.

Practice data, sessions, and audio recordings persist until you delete them or your account. Billing records are retained as long as legally required (typically 7 years for tax purposes). Diagnostic data (Sentry, PostHog) follows their default retention (90 days for events, 30 days for full event payloads).

We use TLS for all data in transit, Supabase row-level security to enforce per-user data isolation, and bcrypt for password hashing (via Supabase Auth). No system is perfectly secure; if you spot a vulnerability, please report it to the address below.

We'll update this page when our practices change and bump the “Last updated” date. Material changes will be announced via in-app notification or email.

Questions, requests, or vulnerability reports: support@go-interview.ai.