Privacy & trust
Privacy Notice
Hirecue helps you prepare for English interviews and understand conversations you are permitted to process. This notice explains what happens to the information you choose to use.
Data controller and contact
The data controller for Hirecue is Dode Yazılım. Send privacy, access, correction, data-copy and deletion requests to iletisim@dodeyazilim.com. General app support: destek@dodeyazilim.com. We respond to privacy and deletion requests within 30 days. If you cannot open the app, see the deletion page; in-app deletion is the only reliable route for a guest account.
Legal grounds and collection
We collect information electronically through the text/files you submit, microphone features you use, sign-in/store transactions and limited technical events.
- CV, job advertisement, practice, live mode and report data: performance of the contract (Turkish KVKK Article 5/2-c; GDPR Article 6(1)(b)).
- Security, abuse prevention, the 30-day abuse record and error logs: legitimate interests (KVKK Article 5/2-f; GDPR Article 6(1)(f)).
- Anonymous usage measurement that is not linked to your account: legitimate interests (KVKK Article 5/2-f; GDPR Article 6(1)(f)); you can disable it in Profile → “Share usage data”.
Information and purposes
| Information | Use and storage |
|---|---|
| CV text, a selected CV PDF and an optional job advertisement | Extract your profile and tailor questions and answer outlines. Text and the extracted profile are stored in your account. If on-device PDF extraction fails, the PDF is sent for text extraction. Hirecue does not store the PDF in its server database or file storage; a selected copy can remain in the device cache. |
| Practice answers: text or microphone recordings | Audio is sent for transcription and coaching. Completed practice recordings are kept on your device with the saved report. The server stores the transcript, filler-word analysis, questions and reports, not the audio file. |
| Live conversation audio, text, translations and suggestions | Audio is processed in short uploaded segments or, where available, a direct transcription connection. Temporary uploaded segments are deleted by the app after processing or stopping. Conversation text and suggestions remain in the live screen's memory; Hirecue does not save them as account history. A report you submit can retain the excerpt you choose to report. |
| Account and sign-in information | An account identifier, anonymous session or the identity details supplied through Apple, Google or email support sign-in and recovery. Session credentials and local report/profile caches are held on the device. An Apple refresh token obtained for Hirecue is held on the server to revoke that authorization on deletion. |
| Purchase and usage information | The app account identifier, product, purchase/renewal status and expiry are used to verify Pro access. Usage counters, operation/session times, safety decisions and restrictions enforce limits and protect the service. Hirecue does not receive your full payment-card details. |
| Reports and support requests | The reported excerpt, category and reason are stored for investigation. If you email us, we process your message, contact details and any information you choose to include to handle the request. |
Do not upload identity documents, financial credentials, health details or unnecessary sensitive information. Remove contact details and third-party information from a CV unless needed and you have authority to provide it. Microphone access is requested when you use audio features. Hirecue does not activate the camera.
Service providers and transfers
- Supabase: account authentication, database and server functions. The configured project region is EU/Ireland (eu-west-1). This does not mean every downstream provider processes data only in the EU.
- OpenAI: CV/profile and interview text processing, content checks, translation, suggestions and audio transcription; an unextractable PDF can also be sent for extraction.
- Google Gemini: paid text-to-speech processing of generated interview and follow-up questions, which can reflect CV/job context. Audio replies are returned to the app; a user-specific server memory cache lasts up to five minutes.
- RevenueCat: subscription verification linked to your app account identifier. Apple and Google: sign-in and store payments under their respective terms.
Only information needed for a requested feature is sent to its providers. International transfers rely on the providers’ data-processing agreements and EU Standard Contractual Clauses. Provider security, abuse-monitoring, retention and any legally required records follow the applicable provider arrangements; “not saved by Hirecue” is not a promise of zero provider logging or immediate worldwide erasure. See Supabase privacy, OpenAI privacy, Gemini API terms and RevenueCat privacy.
Crash reports and usage analytics
Sentry (EU region) processes crashes and technical error reports. The app disables sending default personal information (sendDefaultPii:false) and filters user fields, request bodies and free-form error messages. Screenshots, session replay and ordinary breadcrumbs are disabled. Technical app-version/code-stack and network information may be processed; this is not a promise that a provider receives no network metadata.
PostHog (EU server: eu.i.posthog.com) measures anonymous product-use events with a device-generated identifier that is not linked to your account. It does not use account identification (identify). Events exclude CVs, conversations, answers, recordings and email; only allowlisted event/category/duration fields are sent. Session replay and automatic event collection are disabled. Turn off “Share usage data” in Profile to stop usage measurement. This switch is separate from Sentry technical error reporting.
These integrations are disabled in demo mode and when provider configuration is absent. Hosting, sign-in, AI and payment providers may separately process request times and IP addresses. See Sentry privacy and PostHog privacy.
How long information remains
Saved CV/profile text, preparation packs, practice transcripts, reports and account records have no fixed automatic expiry in the current service. They remain until removed through the app or account deletion. Replacing a CV does not automatically remove all earlier generated content. Live text has no persistent transcript history; leaving the live screen releases that screen's in-memory content. Copying text to your clipboard or sharing it creates a copy under your control.
Local practice recordings remain with the saved practice/report until the app's account-cleanup action removes its referenced recordings or you clear the app's device data. Cache files, device backups and copies you exported may need separate removal. Deleting server data from the web cannot erase files on an offline device.
Account deletion removes Hirecue account data, including content, reports, purchase mirrors and app-specific Apple tokens. A separate pseudonymous anti-abuse record keeps a secret-peppered hash of the account identifier and quota/restriction summaries for 30 days. It contains no raw account identifier, CV, transcript or audio and is not fully anonymous: it can recognise the same account returning. After the 30-day retention period it is no longer used for restoration and is physically removed by hourly scheduled cleanup. Store transaction records and other providers' required records are separate.
Your choices and rights
You can decline microphone permission, use written practice answers, remove a CV or request account deletion. Deletion and subscription cancellation are separate: cancel recurring billing in the store as well. Where a sign-in identity is shared with another Dode Yazılım app, only Hirecue data is removed and the shared identity remains for that other app; anonymous identities or identities without another app's footprint are deleted. An Apple token issued to Hirecue is revoked when available. No Hirecue token means there is no app-specific token to revoke.
Depending on the law that applies to you, you may request information about processing, access, correction, erasure, restriction, portability or object to processing; you may withdraw consent where processing relies on it and contact your competent data-protection authority. The processing grounds are set out in “Legal grounds and collection” above. This notice does not replace a separate consent that applicable law requires. Email iletisim@dodeyazilim.com with a minimal account reference; we may verify ownership. We respond within 30 days. Do not send a password, sign-in code, CV or recording for verification.
Age, safety and changes
People under 13 may not use Hirecue. The age limit is declared through the App Store age declaration and Google Play IARC rating; the app does not separately verify age using a date of birth or identity document. You must also meet the local age for using this service or obtain any legally required guardian authorization. AI coaching can be inaccurate; review it before use. Only process conversations with the necessary permissions and follow interview/employer rules. Material changes to data practices will be reflected in an updated notice. Contact us if a child's data has been submitted.