Privacy Policy
Last updated 28 September 2026
The short version. We keep what you put in so CandidThread can help you apply, and send it to a small number of services that do the work (AI, transcription, email, payments). We don’t sell it, don’t show ads, don’t use analytics trackers, and don’t let it be used to train AI. You can export or delete everything at any time.
1. Who we are
CandidThread is run from New Zealand and is responsible for your personal information under the New Zealand Privacy Act 2020. Contact us about privacy at [email protected].
2. What we collect
- Your account: name, email address and a scrambled (hashed) version of your password. If you sign in with Google, your Google account’s name and email.
- What you add: resumes and CVs (including uploaded files), stories, jobs and job descriptions, cover letters, practice and mock-interview answers, interview recordings and voice memos with their transcripts, interview notes, and what you tell the career interview and the story coach.
- What CandidThread learns about you: short notes it keeps to personalise its help (your goals, strengths, things to work on). They’re listed under About me → Memory, each with where it came from.
- Usage: how much of each monthly allowance you’ve used, and a record of each AI request (which feature, model, size, cost, timing). That record doesn’t hold a copy of what was sent.
- Technical: your IP address and browser for each sign-in session, the country your connection comes from, and your device’s time zone and language, which we use to show dates and prices where you are.
- Payments: if you buy Pro, Stripe collects your card and billing details. We keep only Stripe’s reference for you and your plan’s status, dates and currency.
What you add can include information about other people, such as interviewers’ voices in a recording or referees in a resume. Please include only what your applications need, and record people only with their agreement.
3. How we use it
- To run CandidThread for you: store your work, tailor drafts, run mock interviews, transcribe recordings.
- To send you emails about your account, such as password resets. We don’t send marketing email.
- To count usage against your plan and handle payments.
- To keep the service secure, fix problems and control costs.
We don’t sell your information, show ads, or put advertising or analytics trackers on the site. We don’t train AI on your content, and we ask the AI services we use not to keep it or train on it (section 4).
4. Who processes it for us
These services handle your information on our behalf, only to do the job described. Because they’re in several countries, your information leaves New Zealand. We choose services with comparable privacy protections.
| Service | What for | Where |
|---|---|---|
| Hetzner | The server that runs CandidThread and stores your data and files | Finland |
| Cloudflare | Carries traffic to the site; keeps an off-site copy of the nightly backups | Worldwide network; backups in Oceania |
| OpenRouter, and the AI model hosts it routes to | Writing and checking drafts, feedback, questions. Requests go only to hosts that don’t store prompts or train on them. | Mainly the United States |
| Groq | Transcribing recordings, voice memos and spoken answers | United States |
| Microsoft Azure | Reading text aloud, such as your practice answers (the text only) | Australia |
| Resend | Sending account emails | Japan and the United States |
| Stripe | Payments for Pro | United States and elsewhere |
| Sign-in, only if you choose “Continue with Google” | United States |
We may also disclose information if the law requires it, or to protect someone’s safety. If CandidThread is ever sold or transferred, your information would move with it under this policy, and we’d tell you first.
5. How long we keep it
- Your account and content: until you delete them or your account.
- Resumes, stories, jobs, questions and files you delete: removed for good after 30 days, so you can restore them in the meantime.
- Data exports: available for 7 days, then removed for good 30 days later. Edit history: 90 days.
- AI request records: 13 months, for costs and reliability. When you delete your account they’re kept without any link to you.
- Deleting your account removes everything from the live service straight away, including files. Copies in nightly backups are overwritten within 8 weeks.
6. Your choices and rights
- See and export: Account → Export my data downloads everything in one file.
- Correct or delete: edit or delete anything in the app, including what CandidThread has learned about you (About me → Memory). Delete your account from Account.
- Ask us: for anything else, including access to or correction of your information, email [email protected]. We’ll reply within 20 working days.
- Complain: if you aren’t happy with how we’ve handled your information, you can complain to the Office of the Privacy Commissioner in New Zealand, or to the data protection authority where you live.
If you’re in the European Union or the United Kingdom, you also have the rights the GDPR gives you, such as to access, correct, delete, export or object to the use of your information. We rely on our agreement with you (the Terms) to process it, and on your choice to add it.
7. Cookies and browser storage
We use only the cookies the service needs: one that keeps you signed in, and one that holds an invite code while you sign up. The app also keeps a few things in your browser, such as unsaved drafts and view preferences. There are no advertising or analytics cookies, so there’s nothing to opt out of.
8. The browser extension
The Chrome extension reads a job page only when you open it on that page to save the job, and sends that job to your account. It doesn’t read your browsing history or other pages.
9. Security
The site is served only over HTTPS. Passwords are hashed. Each account’s data is kept separate in the database. Backups are made and checked every night, with a copy kept off-site. Only the person running CandidThread can reach the server. If a breach puts your information at risk, we’ll tell you and the Privacy Commissioner as the law requires.
10. Children
CandidThread isn’t for anyone under 16, and we don’t knowingly collect their information.
11. Changes
We’ll update this policy when what we do changes, and change the date at the top. For a change that matters, we’ll email you or tell you in the app first.