Privacy Policy
Last updated 21 August 2026
This explains what Hired Aura does with your information. It describes how the application is actually built, not what we might do in future — where something stays on your computer, we say so, and where it leaves, we say exactly where it goes.
Surefire Studios is the data controller. Contact: [email protected].
Your resume, your session history, and your API keys stay on your computer. We never store them on our servers and we never see them. What does leave your machine is the text sent to AI providers to generate an answer, and audio sent for transcription — because there is no way to provide those features otherwise.
We do not sell your data. We do not use your content to train AI models. Our own database holds your email, your subscription status, and counts — never the content of an interview.
What stays on your computer
The desktop application stores the following locally, in your operating system user profile. None of it is transmitted to us:
| Data | How it is stored |
|---|---|
| Your resume — the file's text and the structured version | Local application storage, unencrypted |
| Job descriptions, company notes, interview settings | Local application storage, unencrypted |
| Live transcripts, while a session runs | Held in memory only, and discarded when the session ends. |
| Session history — the questions asked, the answers shown, and practice scores | Saved to disk on your computer so you can review past sessions. On by default, capped at the 100 most recent. Turn it off in Settings → History, which also deletes everything already saved. Individual sessions can be deleted separately. |
| Your own API keys, if you use bring-your-own-key mode | Encrypted by your operating system (DPAPI on Windows, Keychain on macOS) and tied to your OS user account |
| Your sign-in token | Same OS-encrypted storage. Short-lived access tokens are held in memory only and never written to disk. |
You can see the exact folder, and open it, from Settings → About in the application. Deleting that folder removes everything listed above.
What we store on our servers
If you create an account, our database holds:
- your email address;
- your subscription status, plan, and billing period, mirrored from Stripe;
- a Stripe customer reference;
- session records — that a session started, whether it was live or practice, and when. Not what was said. The content lives only in the local history described above.
- usage records — which model was used and how many tokens it consumed, so we can meter your plan. Not the prompts, and not the responses.
- hashed sign-in credentials — we store only a one-way hash of your refresh token, never the token itself.
We do not store the content of any interview: no transcripts, no questions, no answers, no screenshots, no resume text. Our servers pass that material through to the AI provider and keep only the counts.
What is sent to third parties, and when
| Provider | What is sent | When |
|---|---|---|
| OpenAI | Your resume text, the job description, the interview question, recent conversation context, and — if you use screen reading — the screenshot you captured | Each time an answer is generated, a resume is imported, or you scan the screen |
| Deepgram | Audio from your microphone, and in live mode your computer's audio output, which includes other meeting participants' voices | While a session is actively listening |
| Stripe | Your email and payment details, which you enter on Stripe's own hosted page | At checkout and on each renewal |
| Supabase | Hosts our database and authentication. Sees what is listed in the section above. | Continuously |
| Cloudflare | Hosts hiredaura.com and serves it through its network. Standard web request logs, including IP address. | When you visit the website |
These providers process data under their own privacy policies and retention periods, which we do not control. If you use bring-your-own-key mode, requests go directly from your computer to OpenAI and Deepgram using your own accounts, and our servers are not involved at all.
In live mode, the audio sent for transcription includes the interviewer and anyone else on the call. They have not agreed to this policy and may not know it is happening. Laws in many places require the consent of every participant before a conversation is recorded or transcribed.
Obtaining that consent is your responsibility, not ours. Practice mode transcribes only your own microphone and involves no one else.
Analytics and tracking
The website uses no advertising trackers, no third-party analytics, and no cookies beyond what is needed to keep you signed in.
The desktop application has crash reporting turned off by default. If you turn it on, it sends a crash dump and the app version — never transcripts, resumes, screenshots, prompts, or keys. You can turn it back off at any time; it takes effect at the next launch.
Why we are allowed to process this
Where the UK GDPR or EU GDPR applies, our lawful bases are: performance of a contract for anything needed to deliver the Service you paid for; legitimate interests for security, fraud prevention, and metering; consent for crash reporting, which you may withdraw at any time; and legal obligation for keeping billing records.
How long we keep it
- Account and subscription records — while your account exists, then up to 30 days.
- Session and usage counts — 24 months, for billing accuracy and abuse investigation.
- Billing records — as long as tax and accounting law requires, typically 6–7 years.
- Expired sign-in tokens — purged automatically every day.
- Session history — on your computer, until you delete it or it falls out of the 100-session cap. We cannot delete it for you, because we cannot see it.
Your rights
Depending on where you live, you may have the right to access, correct, delete, export, or restrict our processing of your personal data, and to object to it. To exercise any of these, email [email protected]. We will respond within 30 days.
You can delete most of your data yourself: Settings → About → Open data folder in the application removes everything held locally, and deleting your account removes the server-side records listed above. Anonymous usage counts may be retained for billing integrity.
If you are in the UK or EU and think we have handled your data improperly, you may complain to your local supervisory authority.
International transfers
Our infrastructure and our providers are located in the United States. If you use the Service from outside the US, your data is transferred there. Where required, these transfers rely on Standard Contractual Clauses or an equivalent safeguard offered by the provider.
Security
Credentials are encrypted at rest by your operating system and are never transmitted to us in readable form. Our database enforces row-level access control so one account cannot read another's records. All traffic uses TLS.
No system is perfectly secure. If we become aware of a breach affecting your personal data, we will notify you and any relevant regulator as the law requires.
Children
The Service is not for anyone under 18, and we do not knowingly collect data from children. If you believe a child has given us data, contact us and we will delete it.
Changes
We may update this policy. For material changes we will give notice by email or in the application before they take effect. The date at the top always reflects the current version.