Политика приватности

1. Scope and who is responsible

This policy applies to the hosted InterviewThread website and its account, feedback, and activity features. In this community-preview policy, “InterviewThread,” “we,” and “us” mean the maintainers operating the hosted open-source service. Self-hosted deployments and third-party forks are controlled by their own operators and policies.

2. Information that stays on your device

For signed-in use, the workspace may keep resume and career-evidence text, job descriptions, optional source text and URLs, interview answers and transcripts, manually saved application items, language preferences, and local-model settings in browser memory or local storage unless a feature clearly says it will send data elsewhere. Guest mode keeps interview work only in the current page session and does not save interview history, practice progress, tracker items, or model settings; language preference may still be remembered. A URL alone is provenance; it is not automatically fetched or treated as evidence.

Background job tracking is the exception: when a signed-in user explicitly connects an official employer board, we store the provider, board identifier, subscription owner, normalized public job listings, content hashes, first/last-seen timestamps, change events, sync health, and notification preferences in D1 so the feed can update across devices. We do not store a resume or interview transcript in this tracking database, and tracking never submits an application.

3. Account information we store

When you choose Google, GitHub, or LinkedIn sign-in, we store the provider name, provider account ID, display name, verified email when available, profile-image URL, and—when GitHub provides them—public username and profile URL. We use this only to create and protect your InterviewThread account and associate your own activity with it.

Email job alerts are off by default. If you opt in, we store the verified email returned by your sign-in account, locale, consent time, and delivery state. The browser cannot supply a different recipient address. You can turn email alerts off or stop tracking a company at any time.

Provider access and refresh tokens are discarded after the identity response and are not stored. The app does not silently link different providers by matching email and does not automatically import profiles, repositories, contacts, resumes, or posts.

4. Feedback and activity information

If you submit feedback, we store its category, rating, message, locale, status, timestamp, account owner, product version, product surface, and active beta cohort when applicable. For signed-in use, we may store limited event records such as analysis completed, interview started or answered, tracker updated, feedback submitted, and beta application or withdrawal. These records indicate that an action happened; they do not contain the resume, job description, answer transcript, or raw voice recording.

When you use a contact or partnership form, the name, reply-to email, topic, message, locale, and source page you provide are sent through our transactional email provider to the relevant InterviewThread inbox. Do not include passwords, tokens, full resumes, interview transcripts, or other sensitive information in these forms.

If you apply for closed beta, we store your structured role family, experience level, interview timing, primary goal, locale, cohort status, separate research/update choices, and the terms, privacy, and product versions you accepted. We do not ask for a resume or open-ended career history in the beta application. You can withdraw from beta without deleting your account.

5. Voice, local models, job data, and ordinary logs

Voice answers use a two-stage flow. While you speak, the browser or device provides provisional live captions. For signed-in users, after you consent to cloud transcription, InterviewThread temporarily sends the recorded answer audio, selected language, and up to 80 short vocabulary hints drawn from the role, resume, and job description to ElevenLabs Scribe first, with Microsoft Azure Speech as a fallback, to produce a more accurate final transcript. The vocabulary hints are terms, not the full resume or job description.

InterviewThread does not store raw voice audio or write it to logs. The transcription response is returned with private no-store instructions. In Voice interview mode, when you choose “Finish answer & continue,” the completed transcript is submitted as your answer so the service can score it and generate a follow-up or new topic. In Text mode, the transcript remains editable in the answer box until you review it and press Send yourself. Browser-only mode does not upload the recording to InterviewThread, although the browser, operating system, or browser speech vendor may process it under their own terms. If recording or cloud correction is unavailable or fails, the browser or device transcript remains in the answer box instead of being erased. ElevenLabs and Microsoft may process or retain provider-side voice data under their own account settings and privacy terms.

Coached voice is optional and requires separate consent each time. If you choose it, the current recording is sent to ElevenLabs to return a transformed practice voice. The returned audio is kept only temporarily in your browser for playback and is not automatically submitted as an answer. InterviewThread does not store the recording or transformed audio or write either to logs, but ElevenLabs may process or retain provider-side data under its own account settings and privacy terms.

When cloud read-aloud is configured and you ask InterviewThread to read a question, only the current question text and selected language are sent to ElevenLabs to generate the primary audio response. If ElevenLabs is unavailable, the same limited data may be sent to Microsoft Azure Speech as a fallback. Because questions are tailored, that text may contain short role, evidence, or gap terms derived from your resume or job description; the full documents, your answer, transcript, and raw voice recording are not sent. InterviewThread returns the audio with private no-store instructions and does not save it; if both cloud providers are unavailable, the feature falls back to the browser or device voice. ElevenLabs and Microsoft may process or retain provider-side request data under their own account settings and privacy terms; InterviewThread's no-store response does not override a provider's retention policy.

If you connect a local or third-party model endpoint, your browser sends the content shown by that feature to the endpoint you configured. Model settings stay in local storage; review that provider’s terms before sending career data. Requests to approved job sources send the board or search parameters needed to retrieve listings. Hosting and security providers may process standard request information such as IP address, user agent, requested URL, and time.

6. Why we process information

• Provide and secure sign-in, sessions, requested product features, and account-owned history.
• Return job data, support speech and user-configured model connections, and remember device preferences.
• Receive feedback, understand whether core workflows function, prevent abuse, investigate incidents, and meet legal obligations.

7. Sharing and sales

We use service providers needed to operate the site, including Cloudflare infrastructure and D1, the identity provider you choose, ElevenLabs for signed-in cloud transcription, requested cloud read-aloud, and separately consented coached voice, Microsoft Azure Speech for cloud-transcription and read-aloud fallback, and a transactional email provider for contact-form delivery. Data also goes to an external endpoint only when you select and, where presented, consent to a feature that requires it. We do not sell personal data, build advertising profiles, share career evidence with employers, or use the service to make employment decisions.

8. Retention and deletion

Guest workspace content is not written to an InterviewThread account or local interview history and is lost when the page session ends. Signed-in local workspace data remains until you clear site data or the browser removes it. OAuth state expires after ten minutes. A signed-in session expires after 30 days; only a hash of the session token is stored. Account identity, feedback, and limited activity records are kept while needed to provide the community service, handle requests, secure the service, or meet legal obligations.

A tracked employer source remains active only while at least one signed-in user subscribes to it. Inactive subscriptions, disabled notification destinations, and unused sources are deleted after 30 days. Completed email-alert delivery records are deleted after 90 days. Removed public postings and change events that are no longer required by an alert are deleted after 180 days. These bounded windows support deduplication, reliable removal detection, retry safety, and abuse investigation without keeping tracking history indefinitely.

To request access, correction, export, or deletion of hosted account data, use the private contact channel and identify your sign-in provider and approximate sign-in date. Do not send passwords or tokens. You may separately revoke InterviewThread in your provider’s connected-app settings. We will verify the request before acting.

9. Security, international use, and your choices

We use scoped OAuth access, PKCE, signed short-lived state, HttpOnly session cookies, hashed session tokens, transport encryption, and access checks. No online service can promise perfect security. The service may be accessed globally and information handled by providers may be processed in countries with different laws.

Depending on where you live, you may have rights to access, correct, delete, restrict, object, withdraw consent, or receive a copy of personal data, and to complain to a regulator. You can avoid account activity storage by using guest mode, avoid voice input and read-aloud, avoid external models, or clear browser data. Guest interview history and practice progress are not saved.

10. Children, changes, and contact

InterviewThread is designed for job seekers and is not directed to children under 16. We do not knowingly collect their account data. Material policy changes will be dated here and, when required, presented for consent before a new use of data. Use the contact page for product questions and the private channel for privacy or security requests.