Política de privacidade

1. Scope and who is responsible

This policy applies to the hosted InterviewThread website and its account, feedback, and activity features. In this community-preview policy, “InterviewThread,” “we,” and “us” mean the maintainers operating the hosted open-source service. Self-hosted deployments and third-party forks are controlled by their own operators and policies.

2. Information that stays on your device

The current workspace keeps resume and career-evidence text, job descriptions, optional source text and URLs, interview answers and transcripts, tracker items, alerts, language preferences, and local-model settings in browser memory or local storage unless a feature clearly says it will send data elsewhere. Clearing site data removes this local history. A URL alone is provenance; it is not automatically fetched or treated as evidence.

3. Account information we store

When you choose Google, GitHub, or LinkedIn sign-in, we store the provider name, provider account ID, display name, verified email when available, profile-image URL, and—when GitHub provides them—public username and profile URL. We use this only to create and protect your InterviewThread account and associate your own activity with it.

Provider access and refresh tokens are discarded after the identity response and are not stored. The app does not silently link different providers by matching email and does not automatically import profiles, repositories, contacts, resumes, or posts.

4. Feedback and activity information

If you submit feedback, we store its category, rating, message, locale, status, timestamp, account owner, product version, product surface, and active beta cohort when applicable. For signed-in use, we may store limited event records such as analysis completed, interview started or answered, tracker updated, feedback submitted, and beta application or withdrawal. These records indicate that an action happened; they do not contain the resume, job description, answer transcript, or raw voice recording.

If you apply for closed beta, we store your structured role family, experience level, interview timing, primary goal, locale, cohort status, separate research/update choices, and the terms, privacy, and product versions you accepted. We do not ask for a resume or free-text career history in the beta application. You can withdraw from beta without deleting your account.

5. Voice, local models, job data, and ordinary logs

Voice input and read-aloud use browser speech capabilities when available. InterviewThread does not store raw voice audio, but the browser, operating system, or speech provider may process audio under its own policy. You can edit recognized text before submitting an answer.

If you connect a local or third-party model endpoint, your browser sends the content shown by that feature to the endpoint you configured. Model settings stay in local storage; review that provider’s terms before sending career data. Requests to approved job sources send the board or search parameters needed to retrieve listings. Hosting and security providers may process standard request information such as IP address, user agent, requested URL, and time.

6. Why we process information

• Provide and secure sign-in, sessions, requested product features, and account-owned history.
• Return job data, support speech and user-configured model connections, and remember device preferences.
• Receive feedback, understand whether core workflows function, prevent abuse, investigate incidents, and meet legal obligations.

7. Sharing and sales

We use service providers needed to operate the site, including Cloudflare infrastructure and D1, and the identity provider you choose. Data also goes to an external endpoint only when you select a feature that requires it. We do not sell personal data, build advertising profiles, share career evidence with employers, or use the service to make employment decisions.

8. Retention and deletion

Local workspace data remains until you clear site data or the browser removes it. OAuth state expires after ten minutes. A signed-in session expires after 30 days; only a hash of the session token is stored. Account identity, feedback, and limited activity records are kept while needed to provide the community service, handle requests, secure the service, or meet legal obligations.

To request access, correction, export, or deletion of hosted account data, use the private contact channel and identify your sign-in provider and approximate sign-in date. Do not send passwords or tokens. You may separately revoke InterviewThread in your provider’s connected-app settings. We will verify the request before acting.

9. Security, international use, and your choices

We use scoped OAuth access, PKCE, signed short-lived state, HttpOnly session cookies, hashed session tokens, transport encryption, and access checks. No online service can promise perfect security. The service may be accessed globally and information handled by providers may be processed in countries with different laws.

Depending on where you live, you may have rights to access, correct, delete, restrict, object, withdraw consent, or receive a copy of personal data, and to complain to a regulator. You can also avoid account storage by not signing in, avoid voice input, avoid external models, or clear browser data, although the current personal workspace requires sign-in.

10. Children, changes, and contact

InterviewThread is designed for job seekers and is not directed to children under 16. We do not knowingly collect their account data. Material policy changes will be dated here and, when required, presented for consent before a new use of data. Use the contact page for product questions and the private channel for privacy or security requests.