Privacy Policy

1. Who is responsible

Third Stone Software LLC, a Minnesota limited liability company, operates Rolehike and is the data controller for the personal data described here. Contact: support@rolehike.com.

2. What we keep

• Account — your name, email address, password (stored only as a salted hash), two-step sign-in and passkey details, time zone, and the browsers signed in (named by browser and operating system).
• Your search — your profile and career history, resumes, cover letters, stories, answers, jobs and their history, notes, people and companies, interviews and debriefs, offers, goals, and the job matches scans find for you.
• Connected mail, if you turn it on — only messages matched to a job you track, and of those only the sender, subject and a short snippet, as suggestions you confirm. The rest of your mailbox is read and left alone. Mailbox passwords and Google tokens are stored encrypted.
• Billing — your plan and Paddle’s subscription and customer identifiers. Card details go to Paddle, never to us.
• Security and operations — sign-in and account-security events with IP addresses (kept 90 days), records of AI requests (kept 90 days, without their content), and error reports that never include what you typed.

3. How we use it

To provide the Service you asked for: tracking, scoring matches, drafting documents, reminders and the emails and notifications you turn on, and to keep accounts secure. We don’t sell personal data, use it for advertising, or build profiles of you for anyone else. Our legal bases are performing our contract with you, our legitimate interest in keeping the Service secure, and your consent for optional connections (mailbox, Google, notifications) and for analytics cookies on our public pages, which you can withdraw at any time.

4. Who else handles it

• Anthropic (Claude) — writes drafts and reviews. It receives the material a request needs (for a tailored resume: your resume, profile and the posting) and, under its commercial terms, doesn’t train models on it. Your mailbox never goes to the AI.
• Akamai (Linode) — hosts the servers and database, in the United States.
• Amazon Web Services (SES) — delivers our email; it processes your email address and the message.
• Paddle — payments, as merchant of record and an independent controller for checkout; it publishes its own privacy policy.
• Google — only if you connect Gmail or Calendar: Gmail is read as described above and interviews are added to your calendar.
• Your mail provider — only if you connect a mailbox: read-only, over an encrypted connection.
• Google Analytics — only on our public pages (home, features, pricing, contact and the legal pages), only if you accept the cookie banner, never on the sign-in or sign-up pages or once you’re signed in, and never if your browser sends Global Privacy Control. It sets cookies (_ga, _ga_…) and receives the page’s address, your browser’s details and an approximate location from your IP address, kept for 2 months. Change your choice under Cookie settings at the bottom of any public page.
• Cloudflare Turnstile — when switched on, checks for bots on sign-up and some sign-in and recovery pages.
• Have I Been Pwned — when you choose a password, the first 5 characters of its hash are sent to check it against known breaches; the password itself never leaves us.
• Browser push services (Google, Apple, Mozilla, Microsoft) — carry the notifications you turn on, encrypted so they can’t read them.
• Job boards and company career sites — receive the search terms and locations scans use, and requests for postings you import; never your name or contact details.
• Your browser’s speech service — if you answer a mock interview out loud, your browser turns speech into text (in Chrome and Edge, through Google’s or Microsoft’s service). We never receive a recording.

5. Sharing you choose

Nothing in your account is visible to anyone else unless you share it: a resume link for feedback (which expires and can be stopped), the parts of your search you share with a coach, or a calendar feed link. Rolehike support can see your account only if you approve a request, read-only, for the hours you choose; you can end it at any time, and each view is recorded on your account.

6. How long we keep it

Your data stays while your account exists. You can set clean-up rules under Account (closed jobs, old matches, mail suggestions), and matches nobody saved are removed after 60 days. Deleting your account removes your data at once; copies in our database backups are gone as those roll over, within about two weeks.

7. Your rights

You can see and correct your data in the app, download all of it (Account → Your data), and delete your account. Depending on where you live you may also have rights to object to or restrict processing and to complain to your data-protection authority. For anything you can’t do in the app, write to support@rolehike.com.

8. Security

Connections are encrypted; secrets (two-step sign-in keys, mailbox passwords, Google tokens) are encrypted at rest; the app runs in locked-down containers with a database login that can only read and write rows. New sign-ins from an unfamiliar browser are emailed to you.

9. Children

Rolehike isn’t for anyone under 16, and we don’t knowingly keep their data.

10. Changes

If we change how we handle personal data in a material way, we’ll tell you by email or in the app before it takes effect.