Privacy policy

• Account: your email and name, from Google sign-in or the magic link you request.
• Prep data: job postings you paste, answers you write, questions generated for you, mastery and readiness computed from your work, and interview outcomes you choose to record.
• Resume: only if you upload or paste one, and only to generate questions about it.
• Product events: which features get used — signups, tracks created, purchases.
• Page views: which pages get opened and which site sent you, counted without a cookie and without an identifier that joins today’s visit to next week’s. Not keystrokes, not a session replay, and there are no advertising trackers on this site.

Six processors, each for one job:

• Vercel serves the site and counts the page views above. Its analytics are cookieless by design — there is no visitor profile for us to read, and none for anyone to buy.
• Supabase hosts the database. Your rows are protected by row-level security: queries run as you, and the database itself refuses cross-user reads.
• Stripe handles payments. Card details go to Stripe directly and never touch our servers.
• Anthropic / OpenAI receive the text needed to generate your content — the posting, your answers, your resume if attached. Under their API terms this data is not used to train their models.
• Resend sends the emails you’ve opted into.
• Google, only if you choose to sign in with it. Pressing the button sends you to Google, you pick an account there, and you come back; Google then tells us your email and name, and nothing else. No Google code runs on this site.

We do not sell your data, and nothing here is shared with employers unless a future feature asks for your explicit opt-in first.

Sign-in links are transactional and always work. Everything else — study plans, review reminders — is controlled per-type in Settings, and every message carries a working one-click unsubscribe.

Two kinds, both functional: your sign-in session, and (on gated preview deployments) a cookie proving you entered the site password. Signing in with Google briefly adds a third, which exists only to prove that the request coming back from Google is the same one that left here; it is deleted the moment you land. No advertising cookies, no third-party cookies, and no analytics that follow you off this site.

Both are buttons, not requests. Settings has Download my data, which hands you every row we hold as one JSON file, and Delete account, which removes them. Deletion cascades: tracks, answers, mastery, resume, preferences — the schema is built so removing the account removes the rows, and any active subscription is cancelled before it happens. It is immediate and cannot be undone.

Two things survive on purpose. Stripe keeps the payment records it processed, because a payment processor is required to. And our own count of what happened — that a purchase occurred, that an account was deleted — stays, with the account id set to null, so we can tell how the business is doing without keeping a list of who you were. Anything still unclear goes to support@hardwareintern.com.