Privacy

• Your account: your name, e-mail address and a hashed password (bcrypt, never the password itself).
• Your resume: the file you upload and the text read from it, plus the tailored copies made for each job.
• Your profile and answers: phone, city, profile links (LinkedIn, GitHub…), and the answers you save for application forms (work authorization, start date…).
• Your search: the roles, locations and sources you pick, and your settings.
• Your applications: the jobs found for you, your keep / skip decisions, cover letters, form answers, a screenshot of each filled form, and the history of every step.
• If you connect Google: recruiter e-mails about your applications, and interview events on your calendar.
• If you sync a job-site login with the browser extension (LinkedIn, Internshala): that site's session cookies, so HireFlow can act as you there.

• Google tokens, synced session cookies and saved site passwords are encrypted at rest (AES-256-GCM).
• The dashboard is served over HTTPS, your session cookie is HTTP-only and secure, and other sites can't make changes with it.
• Files are only ever served to their owner.
• E-mail addresses, phone numbers and tokens are masked in the server's logs.

• The AI provider the server is set up with (Anthropic, OpenAI, or a local Ollama model that never leaves the machine): your resume text, job descriptions and form questions are sent to it to score jobs, tailor your resume and draft answers. Their own privacy terms apply. With no AI set up, nothing is sent and rule-based versions are used.
• Employers you apply to receive what their form asks for: your resume, answers and cover letter. Only for jobs you kept.
• Google, if you connect it: HireFlow reads e-mails about your applications, drafts replies for you (sent only when you click Send), adds interviews to your calendar, and can e-mail you your own updates.
• Nobody else. Nothing is sold, and there are no advertising trackers.

For as long as you have an account. Closed applications (rejected, withdrawn, skipped) and their files are removed after two years by default, and notifications after 90 days. In demo mode, everything is reset every night: please don't upload a resume you wouldn't want on a demo server.

• Download my data (Settings › Privacy): everything about you as JSON, plus every file in a .zip.
• Delete my account (Settings › Privacy): every row and file is deleted, and Google access is revoked. It can't be undone.
• Disconnect Google, LinkedIn or Internshala at any time in Settings › Integrations.
• Change or remove any answer, link or setting in Settings.

Open an issue on GitHub. See also the terms and responsible use.