Privacy Policy

Last updated 21 October 2026

1. Who we are

CandidThread is run from New Zealand and is responsible for your personal information under the New Zealand Privacy Act 2020. Contact us about privacy at support@candidthread.com.

2. What we collect

• Your account: name, email address and a scrambled (hashed) version of your password. If you sign in with Google, your Google account’s name and email.
• What you add: resumes and CVs (including uploaded files), stories, jobs and job descriptions, cover letters, practice and mock-interview answers, interview recordings and voice memos with their transcripts, interview notes, and what you tell the career interview and the story coach.
• Video practice answers: in a one-way video mock interview, your camera records each answer in your browser and the video is stored in your account; only you can watch it. While you record, your browser measures where your face is in the picture, which way you’re looking and how bright it is, to give feedback on how you come across on camera. That happens on your device: images of your face and the points it measures are never sent to us or saved — only totals such as “looking at the camera 78% of the time”. We don’t analyse facial expressions or emotions, and we don’t use your videos to train AI. To turn an answer into text, only its sound is sent to our speech service. If you choose “Check my background”, one still picture is sent to our AI provider for that check and isn’t kept.
• What CandidThread learns about you: short notes it keeps to personalise its help (your goals, strengths, things to work on). They’re listed under About me → Memory, each with where it came from.
• Usage: how much of each monthly allowance you’ve used, and a record of each AI request (which feature, its size and timing). That record doesn’t hold a copy of what was sent.
• Technical: your IP address and browser for each sign-in session, the country your connection comes from, and your device’s time zone and language, which we use to show dates and prices where you are.
• Free tools (no account): what you paste into a free tool is sent to the AI to produce your result and isn’t saved. We keep the same record of the AI request as above, with the country your connection comes from. A one-way scrambled form of your IP address is kept for up to two days to limit each tool to 3 uses a day, and on those AI request records for 30 days, so we can see how the tools are used and spot abuse.
• Free mock interview (no account): a spoken answer is sent to us, turned into text by our speech-to-text provider and then deleted; we keep only the text. The text of your answers, the job ad and resume you pasted, the questions and the report are kept for 30 days under a long random address only you have, then deleted. You can delete them sooner from the report. If you save the report to an account, it becomes part of that account. If you pay to unlock a report, Stripe handles the payment and we keep its payment reference and the email address the receipt went to, with the report.
• Payments: if you buy Pro, Stripe collects your card and billing details. We keep only Stripe’s reference for you and your plan’s status, dates and currency.

What you add can include information about other people, such as interviewers’ voices in a recording or referees in a resume. Please include only what your applications need, and record people only with their agreement.

3. How we use it

• To run CandidThread for you: store your work, tailor drafts, run mock interviews, transcribe recordings.
• To send you emails about your account, such as password resets. We don’t send marketing email.
• To count usage against your plan and handle payments.
• To keep the service secure, fix problems and control costs.

We don’t sell your information, show ads, or put advertising trackers on the site. We count visits with cookie-free analytics (section 7). We don’t train AI on your content, and we ask the AI services we use not to keep it or train on it (section 4).

4. Who processes it for us

These services handle your information on our behalf, only to do the job described. Because they’re in several countries, your information leaves New Zealand. We choose services with comparable privacy protections. They’re listed by type; email us if you’d like the names of the current providers.

We may also disclose information if the law requires it, or to protect someone’s safety. If CandidThread is ever sold or transferred, your information would move with it under this policy, and we’d tell you first.

5. How long we keep it

• Your account and content: until you delete them or your account.
• Resumes, stories, jobs, questions and files you delete: removed for good after 30 days, so you can restore them in the meantime.
• Data exports: available for 7 days, then removed for good 30 days later. Edit history: 90 days.
• Video practice answers: deleted automatically after 14 days on Free, or after the time you choose on Pro (30 days, 90 days or a year). You can delete any of them sooner, or all at once from Account; they’re removed straight away, not kept for 30 days. The transcript and feedback stay until you delete the interview or your account.
• AI request records: 13 months, for costs and reliability. When you delete your account they’re kept without any link to you.
• Deleting your account removes everything from the live service straight away, including files. Copies in nightly backups are overwritten within 8 weeks.

6. Your choices and rights

• See and export: Account → Export my data downloads everything in one file.
• Correct or delete: edit or delete anything in the app, including what CandidThread has learned about you (About me → Memory). Delete your account from Account.
• Ask us: for anything else, including access to or correction of your information, email support@candidthread.com. We’ll reply within 20 working days.
• Complain: if you aren’t happy with how we’ve handled your information, you can complain to the Office of the Privacy Commissioner in New Zealand, or to the data protection authority where you live.

If you’re in the European Union or the United Kingdom, you also have the rights the GDPR gives you, such as to access, correct, delete, export or object to the use of your information. We rely on our agreement with you (the Terms) to process it, and on your choice to add it.

7. Cookies and browser storage

We use only our own cookies: one that keeps you signed in, one that holds an invite code while you sign up, and one set on your first visit that remembers how you found us: the name of the site that linked to us (not the page address), the first page you opened, and a tag from our own links. It lasts 90 days. If you create an account it’s saved with the account, so we know which places send people who sign up; if you don’t sign up, we don’t keep it. The app also keeps a few things in your browser, such as unsaved drafts and view preferences. There are no advertising or third-party tracking cookies.

We count visits with cookie-free analytics: our network provider’s page-visit counter and Plausible Analytics. They receive the page address, the referring site and any campaign tag in the link, your browser, operating system, device type and country. Plausible also counts clicks on links to other sites, file downloads, that a form was submitted (never what you typed) and, when you create an account, that a sign-up happened and whether it was by email or Google, without your name or email. Neither sets cookies, stores anything in your browser or follows you to other sites. Your IP address is used only to look up the country and, mixed with a secret that changes every day, to count unique visitors; it isn’t stored. Blocking them doesn’t affect the service.

8. The browser extension

The Chrome extension reads a job page only when you open it on that page to save the job, and sends that job to your account. While it’s connected, when you open a job on one of the job sites it knows (such as LinkedIn or SEEK), it asks your account whether that job is already saved, sending the site’s name and the job’s number, so the button can show a tick. It doesn’t read or send other pages or your browsing history.

When you choose “Fill this application” on a job application form, the extension reads the form on that page: its questions and their choices. It fills the form from your application details and resume in your account, and sends your account the questions it doesn’t recognise and the open questions you ask it to draft answers for. Your answers to voluntary questions about gender, ethnicity, veteran status and disability are kept in the extension on your computer and never sent to us. When you record the application, the extension sends the answers you gave to the open questions, so you can see them later. It never submits a form for you.

9. Security

The site is served only over HTTPS. Passwords are hashed. Each account’s data is kept separate in the database. Backups are made and checked every night, with a copy kept off-site. Only authorised administrators can reach the servers. If a breach puts your information at risk, we’ll tell you and the Privacy Commissioner as the law requires.

10. Children

CandidThread isn’t for anyone under 16, and we don’t knowingly collect their information.

11. Changes

We’ll update this policy when what we do changes, and change the date at the top. For a change that matters, we’ll email you or tell you in the app first.