Draft. Every statement here was written from ConvoScript's source code and is accurate as of this version, but the document has not been reviewed by a lawyer and the highlighted values have to be filled in. Both are required before ConvoScript charges anyone.
ConvoScript
Privacy Policy
Version 2026-08-14. Effective on publication.
The short version
- ConvoScript never stores audio - and it does send it. While an interview is running, your microphone and the shared tab are streamed to Deepgram, which converts them to text and sends the words back. The sound is held in memory for as long as that takes and is then gone. There is no recording, no file, and no way for anyone - including us - to play back an interview. We tell Deepgram not to keep it or train on it.
- Transcripts are text, and they are tiered. An interview run on Free keeps none at all - nothing is written down. Starter keeps 7 days. Pro and Season Pass keep them until you delete them. The window is fixed when the interview starts and a later plan change does not move it.
- Your resume goes to a language model to be turned into structured experience, and parts of it are sent with every answer request.
- There is no advertising and no cross-site tracking. ConvoScript sets one cookie, to keep you signed in. It does count its own product events - that setup finished, that an interview started - in its own database, with no third-party analytics service involved and nothing that follows you anywhere else.
- You can download or delete everything yourself, immediately, from Profile › Security.
Who we are
ConvoScript is operated by operator legal entity of registered address, the data controller for everything described here. Contact: support@convoscript.local.
What we collect, and why
Your account
Email address, display name, and a one-way hash of your password - never the password itself. If you sign in with Google we also store the account identifier Google gives us. We keep the date you joined, when you last signed in, and your plan. This is what lets you have an account at all.
Your devices
For each signed-in session: the browser's user agent string, the IP address it signed in from, and when it was created, last used, and expires. You can see this list and end any session on it. It exists so an account takeover is visible and reversible, and it is deleted when the session ends or expires.
Your resume and profile
The file you upload is kept, along with the text extracted from it and the structured profile a language model produces from that text - skills, roles, education, projects, and short talking points. Anything you add as "extra proof points" is kept with it. This is the material every suggested answer is built from.
Your interviews
The position, company, and job description you enter; when the interview started and ended; how long it ran; and the outcome, round label, and notes you record yourself. ConvoScript never infers how an interview went.
Transcripts and generated content
The text of what was said, labelled by speaker - which includes the words of whoever else was on the call - the questions ConvoScript detected, and the answers and reviews it produced.
Retention is decided when the interview starts, and never changes afterwards. Whatever your plan entitled that interview to is written down at the moment it begins. Upgrading later does not open an older interview that was never kept, and downgrading later does not shorten a window you were already promised. If you use a one-off interview credit on a Free account, that interview gets the credit's retention, not Free's.
On Free, none of it is written down at all. Not stored and hidden - not stored. The words exist in memory for the length of the call, because that is what an answer is generated from, and nothing reaches a disk: no transcript, no detected question, no answer text, and no review.
Consent records
For each interview, which version of the recording notice you accepted and when. This is kept because it is the record that you were told what was being captured.
Usage and cost
How many seconds of audio were streamed, how many tokens each model call used, and what we estimate that cost us. Used to run the business, spot abuse, and keep an eye on our own spending - never to profile you.
Product events
That a resume was submitted, whether it parsed, that setup was completed, that an interview started and how long it ran, how many answers it used, and whether someone opened the pricing page or pressed upgrade. Each one records the step, the plan, and a timestamp.
The details are counters and fixed labels, never your words. No company name, no job title, no question, no answer, no filename. It is how we find out that a step is broken - a resume format that never parses, an upgrade button nobody can complete - which is not something support tickets tell us in time. It stays in our own database; there is no analytics vendor.
Error reports
When something breaks in your browser or on our server we record the error message, where in the app it happened, and a stack trace. Accounts are identified by an internal id rather than an email address.
Before an error leaves our server we remove: everything after the ? in
a web address, because that is where a sign-in link would be; the body of the
request; cookies and authorisation headers; the local variables recorded at each
line of the stack; and any email address, sign-in link, or API key found anywhere
in the text. Error messages are also cut short, because a failing provider
sometimes quotes the request back to us and that request would contain your resume
or your conversation.
What we do not collect
- Audio. Not the interviewer's, not yours. Nothing is recorded or written to disk at any point.
- Video, screenshots, or anything on the shared tab other than its audio.
- Payment details. No payment processor is connected yet; when one is, it will handle card data and we still will not see it.
- Advertising identifiers, tracking pixels, third-party analytics scripts, or any cross-site profile. The page loads no code from anyone but us, which is enforced by the browser and not only by our intentions.
- Anything from your browser beyond the page itself - no history, no other tabs, no extensions.
Cookies and local storage
One cookie keeps you signed in (convoscript_session), and a short-lived second
one exists only during a Google sign-in (convoscript_oauth_state). Both are
strictly necessary, which is why there is no cookie banner to click.
Your theme and sidebar preferences are stored in your browser and never sent to us.
Who else sees your data
We use these processors, and no others:
| Processor | What it receives | Why |
|---|---|---|
| Deepgram United States |
The live audio streams while the interview is running, and up to 24 vocabulary hints - the job title, the company, your skills, and your past employers - so it spells technical words correctly. Contact details and your own name are removed before those hints are sent. | Speech to text. Two streams - your microphone and the shared tab - which is what gives each speaker their own label. We send an opt-out flag on every stream, so Deepgram does not retain the audio or train on it. |
| Anthropic United States |
Your resume text, job description, proof points, and the running transcript of the interview | Extracting your profile, suggesting answers, and writing post-interview reviews. Sent through their API, which is not used to train models. |
| Resend United States |
Your email address and the message being sent. No resume, interview, or transcript content is ever emailed. | Confirmation, password reset, and account notices. No marketing. |
| Google United States |
Only what you authorise, and only if you choose "Continue with Google" | Sign-in. |
| Sentry Region set per project |
Error type, stack trace, and your account id. Addresses, request bodies, query strings, cookies, and the variables recorded at each line of the stack are removed before an event is sent. | Knowing that something is broken. Errors reach it through our server rather than from your browser, so no Sentry code runs on the page. |
We do not sell your data, share it with advertisers, or use it to train anyone's model. Check each provider's own terms for how long they hold what we send.
Transfers. All of the processors above are in the United States, so using ConvoScript means your data is processed there. The transfer mechanism and data-processing terms for each have to be recorded here before ConvoScript is open to the public.
Not yet connected. A payment processor or Merchant of Record will receive your email address and payment details directly when billing is switched on; card numbers never reach ConvoScript. A hosting provider, managed database, and object storage will be added when ConvoScript runs somewhere other than a single machine. This list will name each of them before the change, not after it.
How long we keep things
| Data | Kept |
|---|---|
| Account, resume, profile | Until you delete the account |
| Interview record (company, role, date, outcome) | Until you delete it |
| Conversation content - interview run on Free | Never written down |
| Conversation content - interview run on Starter | 7 days from the end of that interview, then deleted automatically |
| Conversation content - interview run on Pro or Season Pass | Until you delete it |
| Conversation content - interview run on a one-off credit | 7 days from the end of that interview |
| Post-interview review | Deleted with the conversation it was written from |
| Signed-in sessions | 14 days, or until you sign the device out |
| Password reset links | 1 hour, or until used |
| Confirmation links | 48 hours, or until used |
| Product events (counters and labels only) | Kept, with your id removed when you delete your account |
| Payment and invoice records | Kept for the period tax and accounting law requires, once billing exists |
| Error reports | Held by Sentry under their retention period |
"Conversation content" means all of it. The transcript, the questions ConvoScript detected, the answers it suggested, the review it wrote, and any error message that quoted them. They are the same words under different names, and they expire and are deleted together - never one without the others.
Deleting an interview keeps one thing. The words, questions, answers, review, company, role, job description, and your own notes are all erased. What stays is a dated, empty row: an interview happened, it lasted this long, this is how you said it went. Interview allowances are counted from those rows, and without them anyone could reset their allowance by deleting their history. It is removed when you delete your account.
Backups. Deleted data is removed from live systems straight away. Encrypted backups are kept for up to 30 days and then destroyed on a fixed schedule. If a backup is ever restored, deletions recorded before the restore are re-applied before the service accepts traffic, so deleted accounts and content are not brought back.
Deleting your account
Profile › Security › Delete account. You confirm by typing your email address and your password. It happens immediately, there is no grace period, and it cannot be undone. It removes your account, resumes and their files, every interview including deleted ones, transcripts, answers, reviews, credits, devices, and outstanding links. We email you to confirm it happened.
Uploaded files are removed as part of the same request. If our storage cannot be reached at that moment, the deletion is queued and retried until it succeeds - it is not logged and forgotten. We also sweep periodically for stored files whose record is already gone and remove those too.
Two things survive, with your name taken off them. We keep the record of what your usage cost us - seconds of audio, model tokens, and an estimated figure - with the link to you removed. It is what tells us that a given day cost a given amount, and we would have no way to run the business or check a provider invoice without it.
The same is true of product events. "Someone completed setup on the 9th" stays; which someone does not. They are counters and fixed labels with no content in them, so once your id is gone there is nothing left that points at you. Neither can be traced back to you.
And one marker, if you used the free interview. When a free interview is used, we keep a one-way marker derived from the verified email address so the same address cannot claim it twice. The marker is not reversible, is stored separately from your account, and contains no readable address and nothing from your resume, transcripts, or interviews. It stays after the account is deleted, for as long as the free offer exists. If an account is deleted before it ever used its free interview, that address stays eligible.
It is used for that one purpose and nothing else - never for marketing, profiling, analytics, fraud scoring, or linking accounts to one another. No part of ConvoScript can list it or search it by address; the only question it can answer is "has this one address, which you already gave me, been used?". The key that produces it is held outside the database, so a copy of the table alone cannot be turned back into a list of addresses. When the free offer ends, the table is dropped and the keys destroyed, because there is nothing else it could be used for.
Payments, when they exist. Card numbers will never reach ConvoScript - checkout is hosted by the payment processor. What we will keep is the record of a transaction: amount, tax, date, product, and the outcome of any refund or dispute. Those records survive account deletion with the link to your account removed, because tax law requires them and a dispute can be raised after an account is gone. A refund or dispute arriving later is processed against that record and never recreates an account, restores access, or brings back deleted content.
The free interview is per address, not per person
The free interview is one per verified email address, not one per person. Someone with several addresses can verify more than one. We do not try to work out whether two addresses belong to the same person, because guessing wrong would block people from an interview they are entitled to.
That means we do not fold addresses together. a.b@example.com and
ab@example.com are two accounts here, and so are
me@example.com and me+work@example.com. Capitalisation is
the one exception, because every mail provider treats it as the same mailbox.
Repeated signups are limited by rate and risk checks on the signup itself, and by ceilings on what we will spend, rather than by trying to identify who you are.
Your rights
Depending on where you live you may have the right to access, correct, export, delete, or restrict the use of your data, and to object to it or complain to a regulator.
- Access and correction: your profile, history, and transcripts are all visible and editable in the app.
- Export: self-serve, at Profile › Security › Download your data. It is generated on the spot and contains your account, your profile, every resume you uploaded, and every interview whose conversation content is still inside its retention window. It does not resurrect content that has expired or been deleted, and it does not include password hashes or sign-in tokens, which are credentials rather than a record about you.
- Deletion: self-serve, as above.
Our legal basis, where that concept applies, is the contract between us for running the service, and our legitimate interest in keeping it secure and knowing what it costs.
Security
Passwords are stored as PBKDF2-SHA256 hashes with a per-account salt. Sign-in cookies are HTTP-only, so page scripts cannot read them, and every state-changing request carries a CSRF token. Reset and confirmation links are stored only as hashes, expire, and work once. Sign-in, reset, and confirmation are all rate limited.
No system is perfectly secure. If you find a problem, email us before telling anyone else and we will fix it.
Children
ConvoScript is not for anyone under 18, and we do not knowingly keep their data.
Changes
The version and date at the top change whenever this document does. We will email you before a material change takes effect.