Privacy Policy

1. Information We Collect

We collect information you provide directly: name, email, resume PDF, job preferences, and writing style samples. We also collect activity data such as which jobs you applied to, application timestamps, and per-platform application counts.

When you arrive from a link or an ad, we record the campaign details in that link (for example utm_source, a referral code, or an ad click ID such as fbclid or gclid). If the link has none, we record only the name of the website you came from (for example google.com), never the page you were on. We store this with your account when you sign up, together with the advertising cookie IDs described in section 6.

To find where our website breaks or confuses people, we keep session recordings of how pages respond to your clicks, scrolling and page changes, and error reports when a page fails. All text on the page and everything you type is hidden before the recording leaves your browser, and images from your account, such as submission screenshots, are not recorded. A recording is linked to your account by a random internal ID, never by your name or email, and is deleted after 30 days.

HireDrop works only in the United States. To keep it that way, when you set up your account or start a campaign we check which country your internet connection comes from. We look this up on our own server: your IP address is not stored and not sent to anyone. IP geolocation by DB-IP.

Our free ATS resume checker works without an account. The resume PDF you check there, and the job posting if you paste one, are read to produce your result; the posting is sent to our AI provider (Anthropic) to pick out its keywords and is not stored. We keep the PDF and its result for 48 hours so you can download your report or move the PDF into an account without uploading it again, then delete them. You can delete them right away with the “Delete now” link under your result. To download the report you give your name, email and country. We keep them to know who uses the checker, we don't send you emails because of them, and we delete them when you ask or when you delete your HireDrop account. Your IP address is used to limit how many checks one connection can run and to suggest your country in that form; it is held in memory and not stored.

If you are authorized to work in the US but are outside the country, you can ask us for access. That request (your name, date of birth, where you are now, your US state and LinkedIn if you give them, and whether you live abroad or are travelling) is read only by our team to decide it. It is never sent to employers, and it is deleted with your account. If we approve someone who lives abroad, their country and city become the location we give employers, and their job search is set to remote jobs.

2. How We Use Your Information

Your data is used to: find matching jobs, generate personalized cover letters via the Anthropic Claude API, submit applications on your behalf, and surface usage statistics in your dashboard, and measure which of our ads bring people who sign up and subscribe (section 6).

We do not sell your personal data for money. Ad measurement may count as “sharing” personal information under California law — you can opt out on our Your Privacy Choices page (section 7).

3. The HireDrop Chrome Extension

The HireDrop Chrome extension runs on the job sites it applies on — indeed.com, ziprecruiter.com, greenhouse.io (job-boards.greenhouse.io and boards.greenhouse.io, including their .eu versions), jobs.lever.co, and ashbyhq.com — and on the HireDrop dashboard (hiredrop.io). On those job sites it reads job titles, company names, and form fields, then uses your stored profile to autofill the application; it submits an application only after you explicitly start a campaign in the extension popup or on the dashboard.

If you turn on the optional “Tracking pop-up” (Chrome asks for your permission first), the extension also shows a small status pill on other websites you visit. The pill only displays your own campaign progress: it reads nothing from those pages and sends nothing about them. You can turn it off in the popup or at chrome://extensions at any time.

When an application step cannot be completed, the extension records a short diagnostic in your activity log — the step's web address, button labels, headings, and error messages shown on the form, with email addresses and phone numbers masked — so we can fix the problem. It never records the values you or your profile entered into the form.

The extension stores your Supabase session token in chrome.storage.local so it can authenticate API requests; this token never leaves your browser except when calling the HireDrop backend. Cached profile data is stored for 5 minutes to reduce API load. No data is shared with any third party other than the HireDrop backend, the Anthropic API (cover letters), and Supabase (storage).

HireDrop is not affiliated with Indeed. Users are solely responsible for ensuring their use of automation tools complies with Indeed's terms of service and any other platform's terms they apply on.

4. Data Storage & Security

Your data is stored in Supabase with row-level security so each user can only access their own rows. Resume PDFs are stored in a private Supabase Storage bucket keyed by your user ID and downloaded only by the backend during application submissions. All transport is HTTPS.

5. Third-Party Services

We use Supabase (auth + Postgres + Storage), Anthropic Claude (cover letter generation), Google OAuth (optional sign-in), Vercel (website hosting and cookieless, aggregate analytics), PostHog (the session recordings and error reports described in section 1), Resend (transactional email such as password resets), Stripe (payment processing when you purchase a subscription), Meta and Google (advertising measurement, see section 6), and the job platforms and application systems you apply through (Indeed, ZipRecruiter, and company applicant-tracking systems such as Greenhouse, Lever, and Ashby). We share with each only the data needed for its function.

Voice input in the Drop chat is optional. When you press the microphone button, your browser's built-in speech recognition turns your speech into text in the message field. To do this, your browser may send the audio to the speech service it uses (Google for Chrome and most Chromium browsers, Apple for Safari and every browser on iPhone and iPad, Microsoft for Edge) under that company's privacy policy. HireDrop never receives or stores the audio: only the text you choose to send reaches us.

6. Advertising and Ad Measurement

We advertise HireDrop on Meta (Facebook and Instagram) and Google Search. To learn which ads bring people who sign up and buy, our public pages — the home page, guides, comparisons, FAQ, affiliate page, and the sign-up and log-in pages — load the Meta Pixel and the Google Ads tag. These tags set cookies on our site and send Meta and Google the page you viewed, the ad click ID in the link you arrived from, and technical data such as your IP address and browser type.

The tags are not loaded in the product dashboard or onboarding, which hold your resume and applications. Two events can still come from there. When you create an account, the first page you see afterwards reports that a sign-up happened, tagged with a random internal ID so it is never counted twice; it carries no name, email, or other account content. And if a tag is already running in your browser tab because you came from one of our public pages, starting a Stripe checkout reports that a checkout began and the plan price.

If you arrived from a Meta ad, our server also reports two later events to Meta through the Meta Conversions API: your first application and a purchase (with its amount). These reports include your email address in hashed (SHA-256) form, the Meta cookie IDs (_fbp/_fbc), and your browser's user-agent string, so Meta can match them to the ad. We never send your resume, job preferences, the jobs you applied to, cover letters, or application answers to any advertising platform.

Meta and Google use this information under their own terms and privacy policies (Meta, Google) to measure and deliver ads.

7. Your Privacy Choices (California and other U.S. states)

Under the California Consumer Privacy Act as amended by the CPRA, letting ad platforms use this information for cross-context behavioral advertising can count as “sharing” your personal information, even though no money changes hands. You can opt out at any time on our Your Privacy Choices page: the tags stop loading in that browser, and if you are signed in when you opt out, our server stops reporting your account's conversions too.

We honor Global Privacy Control automatically. If your browser sends a GPC signal, we treat it as an opt-out and the advertising tags do not load. We will not treat you differently for exercising any of these choices.

8. Your Rights

You can view and update your personal data at any time through your account settings. To delete your account and personal data, email support@hiredrop.io from your account email address. We will erase your profile, resume, application history, and stored sessions within 30 days, except where retention is required by law (for example, billing records).

9. Signing In With Google

Signing in with Google is optional; you can always use an email and password instead. If you choose it, Google shares with HireDrop only your basic profile: your name, email address, profile picture, and Google account ID (the openid, email, and profile scopes). We do not request access to Gmail, Google Drive, Google Calendar, contacts, or any other Google data.

We use this information to create your HireDrop account and sign you in, and to pre-fill your name during onboarding, where you can change it. Your email address then serves as your account email, the same as if you had typed it in: for messages you request, such as password resets, and in hashed form for the ad measurement described in section 6, which you can opt out of (section 7). We do not use your profile picture.

We do not sell data received from Google, do not use it to train AI models, and do not share it with anyone other than the service providers that run HireDrop (Supabase stores your account). HireDrop's use of information received from Google APIs adheres to the Google API Services User Data Policy.

You can disconnect HireDrop from your Google account at any time at myaccount.google.com/connections; to delete the data itself, follow section 8.

10. Contact

Questions about this privacy policy or about data we hold on you: support@hiredrop.io.