Privacy Policy

What this covers

HackOffer listens to a call you are on, transcribes it, and suggests answers. This page describes what that produces, where it goes, who else sees it, and how long it stays.

It covers the website, the web app and the desktop app, and it is written to be accurate about how the product is actually built rather than broad enough to cover anything we might do later. Where the architecture makes something impossible, it says so. Where it is a decision we could reverse, it says that instead.

Who we are

HackOffer is run by one person, not a company. That person is the data controller for everything described here, is resident in Poland, as a registered sole trader, and can be reached at support@hackoffer.com. There is no support queue in front of them.

Stripe processes every purchase. It holds your payment details on its own terms rather than under ours; the seller on your invoice is us.

Call audio

Call audio does not pass through our servers. Your browser or the desktop app holds the connection to Deepgram, our speech-to-text provider, directly, using a short-lived access grant our server mints for one session at a time. We never receive the audio stream, and we store no recording of any call.

That is an architectural fact rather than a policy promise: there is no code path in the product that uploads audio to us, because removing that hop is what makes an answer arrive fast enough to be useful. What Deepgram does with the audio it receives is governed by its own terms, as our processor.

On macOS the desktop app asks for Screen Recording permission the first time it runs. That is the only interface Apple exposes for tapping the system audio mixer, and it is what the app uses it for. No video is captured through it unless you press the screenshot shortcut described below.

What a session stores

We store the finalized transcript of each session, with each segment attributed to either you or the other side and placed in time.

Interim transcription — the text that flickers and rewrites itself while someone is still speaking — is rendered on your screen and thrown away. It never reaches us.

We store each question that was answered and the answer that was generated for it, along with which model produced it, how long the first word took, roughly how much text went in and came out, and the rating if you left one. That last set is how we can tell whether question detection is getting better or worse.

We store the session itself: when it started, how long it ran, how it ended, and the model, language and answer style it was configured with. Those are what the plan limits are measured against and what your session list is built from.

The transcript switch, and what it does not do

The setup screen has a switch that stops the transcript being stored. It is enforced where the storing happens, not only in the interface: with it off, transcript segments are discarded as they arrive rather than written down.

Two things it does not do, said plainly because assuming otherwise would be reasonable. It does not stop the recent dialogue being sent with a question — that is how an answer gets its context, and it travels in the request rather than being read back out of storage. And it does not stop questions and answers being stored; those are the record of what the product told you, and they are kept and then deleted on the same schedule as everything else.

Screen captures

One shortcut sends a picture of your screen to the model, so it can answer about a task that was never spoken aloud — an algorithm on a shared editor, a diagram, a bug.

In the desktop app the capture is taken directly, without a further prompt: it is the display the overlay is on, with the overlay itself excluded, so the model sees roughly what someone sharing your screen would see. In a browser tab the browser opens its own picker every time and you choose what is shared; one frame is taken and the capture stops immediately.

The image goes to the model provider with your question and is not stored. We record only that a capture was attached, never the picture itself.

It captures whatever is on that display at that moment, including anything open on it that has nothing to do with the call. That is worth knowing before the shortcut becomes a reflex.

Your documents and session setup

Documents you attach as context — a resume, a job description, free-form notes — are stored as plain text on your account and sent to the model provider as part of the prompt when a question is answered. They are used for nothing else: not for training, not for analytics, not for anything shared between accounts.

If you upload a PDF instead of typing one out, we read the text out of it and keep the original file so you can open and download it later. Only the text is ever sent to the model — the file itself is never handed to a model provider or to anyone else. It is stored in a private bucket on the same host that runs the app, and it is reachable only through a short-lived link this app issues after checking that the account asking for it owns the document.

The same is true of what you type into the setup screen: the company, the role, and any instructions you give for how answers should sound. Those are stored on the session, and unlike the transcript they stay there until you delete the session.

If you paste a link — a job posting on the setup screen, or any page you save as a document — our server fetches it and asks the model to pull the relevant text out of it. The request comes from our server rather than from your device, so the site you linked to sees us and not you; what comes back is stored like anything you had typed yourself, and the page itself is not kept.

Delete a document and it stops being sent immediately, and its uploaded file is deleted with it. Deleting it does not rewrite answers already generated from it, which remain in the sessions they belong to until those sessions or their retention window are gone.

Account and billing data

We store less about you than you would expect. Your account row holds the identifier Clerk, our sign-in provider, gave you, and nothing else. Your name, email address, password and sign-in methods live with Clerk, which is where you edit them and where the app reads them to draw them on screen. We keep no copy of any of it.

Payments are handled by Stripe. It holds your payment details and billing address and issues your invoice on our behalf; we never see a card number. What we store is your Stripe customer and subscription identifier, the plan, its status, the current period dates and any scheduled change — the facts the app needs in order to decide what your account may do.

We keep a per-month total of seconds used, which is what the fair-use budget on your plan is checked against.

Devices

If you install the desktop app we store which platform it runs on, its version and when it last checked in — one row per platform. It is what tells you which machines are set up, and where a support conversation starts.

The installed app checks GitHub for its own updates, which means GitHub sees your device’s network address when it does. Downloads from the website are streamed through our own server instead, so that visit is not passed on.

Cookies, local storage and technical data

We set no analytics, advertising or tracking cookies. The public website is counted with Plausible, which measures pages without cookies, without local storage and without anything that follows you to another site. It has no identifier to write on your device, which is why there is still no cookie banner: there is nothing stored on your machine to ask you about.

Besides page views, Plausible counts four moments and nothing else: an installer downloaded, an account created, a checkout opened and a payment completed. Each arrives as a bare event name — with the installer’s platform in the first case and whether the account was created from the website or the desktop app in the second — and never with your account, your email address or anything that identifies you. It tells us how many people who arrived from a given link went on to sign up, never which people.

Beyond those four, nothing inside the product is measured — not the screens of the app you sign in to, not the overlay, not the desktop app, which sends no analytics of any kind. There is no session recorder, no heat map and no advertising tag anywhere in this product, and none of what Plausible does collect can be tied back to you: it is counts, referrers, campaign names and countries in aggregate.

The cookies that do exist are the ones the app cannot work without: your Clerk session, your chosen interface language, and whether the sidebar is open.

Your device also keeps a few preferences in its own local storage — default model, transcript language, answer profile, overlay appearance, and what the setup form was last filled with. Those stay on the machine and are never sent to us.

Our server sees your network address on every request and uses it in memory to enforce rate limits. It is not written to the database. Railway, which hosts the app, keeps ordinary infrastructure logs of requests.

Who else processes your data

Clerk — accounts, sign-in, and the profile shown in the app.

Deepgram — speech-to-text. It receives call audio directly from your device, never from us.

Google — answer generation. Gemini receives the recent dialogue, the detected question, the documents attached to that session, your session instructions, and the screen capture if you sent one.

Stripe — payment processing, invoicing and subscription management.

Neon — the database everything above is stored in.

Railway — hosting for the website and the API, and storage for the files you upload.

GitHub — distribution of the desktop app and its updates.

Plausible — aggregate visitor counts for the public website and the four anonymous events described above, without cookies, hosted in the European Union.

That is the complete list. We do not sell your data, we do not share it for advertising, and no one outside it receives it unless the law requires us to hand it over.

Training

We do not train models on your content. We do not sell it, and there is no advertising anywhere in this product to share it with.

What each provider above may do with what it receives is governed by that provider’s own terms. Those differ between them and they change, so this page does not restate them: a summary of somebody else’s policy is exactly the kind of promise that goes quietly out of date while still sounding reassuring. The section above names all eight so you can read the ones you care about, and if the answer for a particular provider matters to your decision, ask us and we will tell you what our contract with them currently says.

Where it is processed

The operator is in Poland, inside the EEA. The providers above are United States companies. So if you are in the EEA your data leaves the region once, in reaching them; if you are anywhere else it is handled outside your own country from the start.

Each of those providers offers standard contractual clauses for that transfer. Ask us and we will tell you which of them we have in place at the time you ask, rather than leaving you to assume from this page that all of them are.

Why we are allowed to hold it

For readers under the GDPR and the UK GDPR, the grounds are these.

Running the service you asked for — your account, your sessions, your transcripts, your answers, your documents — is performance of our contract with you.

Rate limiting, abuse prevention, and the quality data attached to each suggestion rest on our legitimate interest in keeping the product working and affordable for everyone on it.

Invoices and tax records are a legal obligation; Stripe holds them for us, and we keep them for as long as the law requires.

Where a permission is genuinely a choice — the microphone, system audio, a screen capture — it is consent, given at the operating system prompt or in the browser, and withdrawable in your system settings at any time.

How long it is kept

Transcripts, questions and answers are deleted automatically thirty days after they are created. Nobody re-reads an interview from six months ago, and text nobody reads is only exposure. A scheduled job does this; you do not have to ask for it.

The session outlives its words. Its title, the company, the role, the duration and the counts stay until you delete the session, so your history and your usage remain checkable after the transcript is gone.

Documents stay until you delete them. The device rows stay for as long as the account does; there is one per platform, and installing again overwrites rather than adds.

Deleting your account removes your sessions, transcripts, answers, documents, uploaded files, devices, usage counters and subscription record together, and cancels any subscription immediately so nothing keeps billing an account that no longer exists. The invoices and payment records we are required to keep for tax and accounting survive it, in Stripe, for as long as the law requires.

Your rights

You can ask for a copy of what we hold, have it corrected, have it deleted, have it handed to you in a portable form, object to a use of it, or ask us to restrict one while a question is settled. Write to us and you will have an answer within thirty days.

Most of it is faster done yourself: sessions and documents are deletable in the app, your profile is editable in the account dialog, and closing your account there removes the rest.

If you are in the EEA or the United Kingdom and think we have handled any of this badly, you can complain to your national data protection authority. We would rather you wrote to us first.

Keeping it safe

Everything travels over TLS, and every database query in the product is scoped to a single account’s identifier — there is no query in the codebase capable of reading across accounts.

The credential handed to your browser for transcription is a grant that expires in minutes and buys nothing but transcription minutes. The account key it is minted from never leaves our server, and neither do the model provider keys.

No system is beyond reach. If something happens that puts your data at risk, we will tell you and the relevant authority within the time the law allows, and we will say what actually happened.

Other people on the call

The other participants on your call are not our users and have agreed to nothing with us. You are the one who decides to transcribe a conversation they are part of, and whether that is lawful and appropriate where you are is yours to establish before a session starts, not ours to establish afterwards.

Several jurisdictions require every party to consent to a recording or a transcript, and some employers, platforms and examiners forbid assistance regardless of what the law says. Check both.

If someone else on your call writes to us about what was said, we will need you to identify the session before we can act: it sits on your account, and we have no way of finding it otherwise. You can delete it yourself at any time.

Age

The service is not for anyone under 18, and we do not knowingly hold data about anyone under that age. If you believe a minor has an account here, write to us and it will be removed.

Changes and contact

If this page changes, the date at the top changes with it. A change that materially affects what we do with data we already hold will be announced in the app before it takes effect, rather than applied quietly.

For access, correction, export, deletion, or any question about a sentence on this page, write to support@hackoffer.com.