Privacy Policy
What we collect, how we use and protect it, and your rights
2026/10/12
Last updated: October 12, 2026
Hush ("we" / "us" / "our") respects and protects your privacy. This Privacy Policy ("Policy") explains how we collect, use, store and share your personal information when you use the Hush website and the Hush desktop apps for macOS and Windows (together, the "Service"), and the rights you have under applicable law.
Please read this Policy carefully before using the Service. By using the Service, you confirm that you have read and agree to this Policy. We may update this Policy from time to time and will give notice of material changes as described in Section 13.
1. Data Controller
The data controller for the Service is:
- Operator: Zhang Peng, an individual sole trader operating under the laws of the People's Republic of China
- Website: https://hushinterview.com
- Privacy contact: support@hushinterview.com
- Data Protection Officer (DPO): Not applicable
2. Information We Collect
2.1 Information You Provide
- Account information: name, email address and password. Passwords are stored as hashes; we never see them in plain text.
- Interview profile and resume: the target role, summary and project experience you enter. When you upload a resume, we extract its text and use AI to organize it into structured fields. We keep the extracted text, the organized fields, the original file name and the file size. We do not keep the resume file itself.
- Knowledge base documents: documents you upload to a knowledge base. Your browser uploads them directly to Alibaba Cloud Model Studio (Bailian), which parses, stores and indexes them; our database keeps only each document's name, type, size and processing status. If you share a knowledge base, we record the share code and the accounts that join it.
- Screenshots: images you capture in the desktop app and submit for analysis.
- Payment information: transaction amounts and payment status. We do not store full card numbers; card data is handled by our payment processor (see Section 5).
- Top-up records: the top-up codes you redeem and when you redeemed them.
- Communications: emails and feedback you send to support.
2.2 Information We Collect Automatically
- Sign-in sessions: IP address, the user agent of your browser or desktop app, and the session's expiry.
- Time ledger: each deduction, refund and top-up of time, with metadata such as the feature used, model name, image count and resume file name.
- Usage records: the feature, model, status, duration, error code and time deducted for each AI request. Usage records never contain your screenshots, audio, transcribed text or AI answers.
- Log data: access logs that our hosting provider, Cloudflare, records for each request, including request time, path and errors.
2.3 What We Do Not Keep
- Screenshots are used only while handling your request: they are sent to the AI model, the answer is returned to you, and the images are discarded. They are not written to our database or storage.
- Real-time audio never passes through our servers: the desktop app connects directly to Alibaba Cloud. We do not keep the transcribed text or AI answers either.
- Resume files: we keep only the extracted text and organized fields (see 2.1).
2.4 What the Desktop Apps Keep on Your Device
The desktop apps store your sign-in token (in the macOS Keychain or Windows Credential Manager) and app settings on your device. Screenshots and audio are processed in memory and never written to disk. The Windows app keeps a local status log that contains no screenshots, audio or answers. The desktop apps do not upload device names, telemetry or crash reports.
3. How We Use Your Information
| Purpose | Legal basis |
|---|---|
| Providing and maintaining the Service, including sending your screenshots, real-time audio, resume and knowledge base content to AI models for processing | Performance of contract |
| Billing, top-ups and payment processing | Performance of contract |
| Customer support | Performance of contract / Legitimate interests |
| Service notices (billing, security, policy updates) | Legitimate interests |
| Security and fraud prevention (such as sign-in sessions, rate limits and captchas) | Legitimate interests |
| Product improvement and analytics (using only content-free usage records) | Legitimate interests |
| Legal compliance | Legal obligation |
During real-time voice sessions, your interview profile and resume are sent to the AI model as context so that suggested answers fit your experience.
We may aggregate or de-identify data for statistical analysis; such data cannot identify you. We do not use your content to train AI models. We do not currently send marketing messages (see Section 9).
4. Cookies & Tracking Technologies
| Type | Purpose | Can be disabled |
|---|---|---|
| Strictly necessary | Keeping you signed in | No |
| Functional | Remembering your language, theme and sidebar preferences | Yes |
| Analytics | Not used | — |
| Marketing | Not used | — |
We do not currently use any third-party analytics tools or advertising trackers. The cookie names and lifetimes are listed in our Cookie Policy. You can delete or block cookies in your browser settings, but blocking strictly necessary cookies will prevent you from signing in.
5. Sharing & Disclosure
We do not sell your personal information, including "selling" as defined by applicable law such as the CCPA. We share your information only in the following cases:
- Service providers: we rely on the following providers, which process your information only as needed to provide their services:
- Alibaba Cloud (mainland China, Beijing region): AI models process your screenshots, real-time audio, resume and knowledge base searches; Alibaba Cloud Model Studio (Bailian) stores and indexes your knowledge base documents.
- Cloudflare: hosting for the website and APIs, the database, vector search and request logs.
- Waffo Pancake: payment processing. Payment card data is processed exclusively by our PCI-DSS-compliant payment processor, Waffo Pancake, and is never stored on our servers.
- Knowledge bases you share: once you share a knowledge base, people who join it can search its content during screenshot analysis.
- Legal and regulatory requirements: when required by law, court order or a lawful request from a competent authority.
- Business transfers: in a merger, acquisition or similar transaction, we will notify you in advance and make sure the recipient continues to protect your information.
- With your consent: for other purposes, with your explicit prior consent.
6. Data Security
- Encryption in transit: TLS / HTTPS across the site.
- Secure storage: passwords are hashed; the desktop apps keep their sign-in token in the system Keychain or Credential Manager.
- Access control: least-privilege access; administrator actions on accounts are recorded in an audit log.
- Real-time voice connects to Alibaba Cloud with a temporary key that is valid for 20 seconds; our permanent keys are never sent to the apps.
If a security incident affects your rights, we will notify you and the relevant regulators as required by law within 72 hours of becoming aware of it. Please keep your account credentials safe and do not share them.
7. Data Retention
| Data type | Retention period | Action at expiry |
|---|---|---|
| Account information | While your account exists; deleted immediately when you delete your account | Deletion |
| Interview profile and resume text | While your account exists; replaced when you upload a new resume, deleted immediately when you delete your account | Deletion |
| Knowledge base documents (including copies in Alibaba Cloud Bailian) | Until you delete the document, the knowledge base or your account | Deletion |
| Time ledger and top-up records | While your account exists; deleted with your account | Deletion |
| Payment transaction records | Kept by Waffo Pancake under its legal and tax obligations | Per its policy |
| Sign-in sessions (IP address, user agent) | A session is deleted when you sign out; all are deleted when you delete your account | Deletion |
| Usage records (no content) | While your account exists; unlinked from your account when you delete it and kept only as anonymous statistics | De-identification |
| Records of administrator actions on your account | Up to 3 years | Deletion |
| Support emails | Up to 2 years after the matter is resolved | Deletion |
| Cloudflare request logs | Up to 7 days | Automatic deletion |
| Screenshots, real-time audio | Not kept | — |
To delete your resume text while keeping your account, email us.
8. Your Data Rights
You can delete your account at any time under Settings → Security on the website, and edit your profile, interview profile and knowledge bases on their respective pages. To exercise any of the other rights below, email support@hushinterview.com; we will respond within 30 calendar days.
| Right | Description |
|---|---|
| Right to be informed | Know what data we collect and how we use it |
| Right of access | Obtain a copy of your personal information |
| Right to rectification | Correct inaccurate or incomplete information |
| Right to erasure | Request deletion of your data in certain circumstances |
| Right to restrict processing | Pause processing in certain circumstances |
| Right to data portability | Receive your data in a machine-readable format |
| Right to object | Object to processing based on legitimate interests or for marketing |
| Right to withdraw consent | Withdraw consent you have given for processing |
If you believe we have not handled your request properly, you may complain to the data protection authority where you live.
9. Marketing Communications & Opt-out
We do not currently send marketing emails or text messages. If we start, we will do so only with your consent, every marketing email will include an unsubscribe link, and you can also contact us to opt out at any time. Opting out does not affect essential service notices such as billing and security alerts.
10. International Data Transfers
Our service providers are located in mainland China (Alibaba Cloud, Beijing region) and on Cloudflare's global network. If you are outside mainland China, your information will be transferred to these locations for processing. We protect cross-border transfers by:
- Using only providers that process data as needed to provide their services and are bound by confidentiality and security obligations.
- Where applicable law requires it, entering into data processing agreements with safeguards such as Standard Contractual Clauses.
11. Children's Privacy
The Service is intended for users aged 18 and over. We do not knowingly collect information from anyone under 18. If you believe a minor has provided us with information, please contact us immediately and we will delete it promptly.
12. Third-party Links & Services
The Service may contain links to, or integrate with, third-party services. This Policy applies only to information we collect directly. We are not responsible for third parties' data practices and recommend that you review their policies before using them.
13. Changes to This Policy
For material changes, we will give at least 15 days' notice through a notice on the website or by email to your registered address, and update the "Last updated" date at the top of this page. Continued use after the effective date constitutes acceptance.
14. Contact Us
- Privacy contact: support@hushinterview.com
- Customer support: support@hushinterview.com
- Operator: Zhang Peng (individual sole trader, People's Republic of China)
- Response time: we reply within 2 business days
Version History
- 2.0 (October 12, 2026): rewritten to match how we actually process data, adding the data controller, what we collect and how long we keep it, our service providers, cookies, international transfers, children's privacy and how to exercise your rights.
- 1.0 (February 15, 2026): first published.
Zhang Peng · Hush · https://hushinterview.com