Privacy Policy
Last updated 24 October 2026Australia
What WorkHunt collects, who it goes to, and how to get it back or deleted.
Who we are
WorkHunt (https://workhunt.ai) runs this service from Australia. Privacy questions go to support@workhunt.ai.
What we collect
- Account information: name, email, and login identifier.
- Resume data: work history, education, skills, and other content you enter or upload.
- Job descriptions and chat: text you paste for analysis and messages with our AI assistant.
- Usage data: which features you use, and error logs. Logs never contain resume content.
- Payment data: handled by Stripe. We never see or store your full card number.
- Analytics, only if you accept it: page views and interactions on this site and in the WorkHunt app, through Google Analytics and Microsoft Clarity. Google Analytics also receives an account identifier and your plan tier, so repeat visits can be told apart. This site and the app also measure our advertising with the Meta Pixel, TikTok Pixel, OpenAI Ads Pixel, and AppLovin Pixel.
How we use it
- To run the features you use, and to improve them.
- To take payments and manage your subscription.
- To email you about your account and changes to the service.
- To meet our legal obligations and enforce our terms.
AI processing
WorkHunt's features run on a third-party AI model, not on software we host. When you tailor a resume, analyse a job, write a cover letter, chat with the assistant, or prepare for an interview, what that feature needs is sent to our AI provider: your resume (work history, education, contact details, and anything else in it), the job description, and your messages.
Requests go to OpenRouter, which passes them to the model we have chosen, currently Google (Gemini). Every request is sent with data collection disabled, so it can only reach providers that neither keep your content nor train on it. Your resume and job-search content is not used to train AI models, ours or anyone else's.
AI output can be wrong, so check anything before you send it to an employer. As our Terms say, leave out government ID numbers, medical records, and bank details unless the role genuinely needs them.
Third parties & storage
We do not sell your personal information. These providers run parts of the service, and each receives only what its job needs:
| Provider | Purpose | What it receives |
|---|---|---|
| OpenRouter, and the model provider it routes to (currently Google) | AI processing | Resume content, job descriptions, chat messages, cover letters, and interview-prep transcripts |
| Firebase (Google) | Sign-in and account identity | Email address and authentication tokens |
| Stripe | Payments and subscriptions | Name, email, payment details, subscription status |
| Amazon Web Services (S3), in Sydney, Australia | File storage | Resume files you upload (PDF, DOCX) |
| Neon, in Sydney, Australia | Application database | Your account record and everything you save in the app |
| Resend | Transactional email | Email address and display name |
| Fly.io, in Sydney, Australia, and a managed cache provider | API hosting and caching | Request traffic, plus short-lived technical data such as download links and usage counters |
| Cloudflare | DNS, content delivery, bot protection, cookieless traffic analytics | Request metadata such as IP address and browser details. Cloudflare Web Analytics also collects cookieless traffic metrics on the marketing site; it sets no cookies and is not gated by the consent banner. See our Cookie Policy. |
| Our monitoring provider | Error and performance monitoring | API traces, metrics, and logs. Resume content is excluded. |
| Google Analytics | Product analytics, in the app and on the marketing site | Page views, interactions, account identifier, plan tier - only if you accept analytics |
| Microsoft Clarity | Session recordings and heatmaps, in the app and on the marketing site | Page interactions - only if you accept analytics |
| Meta Pixel (Meta Platforms) | Advertising measurement, in the app and on the marketing site | Page views and interactions - only if you accept analytics |
| TikTok Pixel (ByteDance) | Advertising measurement, in the app and on the marketing site | Page views and interactions - only if you accept analytics |
| OpenAI Ads Pixel | ChatGPT-ads conversion measurement, in the app and on the marketing site | Page views, conversions, page origin, and an ad-click identifier; depending on the tag settings, SHA-256-hashed contact information - only if you accept analytics |
| AppLovin Pixel (AppLovin) | Advertising measurement, in the app and on the marketing site | Page views, sign-ups, logins and subscriptions, with an account identifier; AppLovin also matches its cookie with Google's advertising cookie - only if you accept analytics |
When you paste a job posting link, our server fetches that page, and pay insights come from public salary data. Our server makes those requests, and they do not identify you.
Where your data is stored
Everything you save is encrypted and stored in Sydney, Australia: our application servers, our database, and the storage for resumes you upload. Uploaded files are never public; the app reaches them only through short-lived links it issues to you.
Several providers above are overseas, mostly in the United States. When a feature uses one of them (AI processing, sign-in, payments, or email), the data it needs is processed outside Australia.
Browser extension
This policy also covers the WorkHunt extension for Chrome and Firefox. It checks the pages you visit, on your device, for signs of a job post, so it can offer a "Tailor resume" pill; that check sends nothing anywhere. It reads a page's job details or application form fields only when you act: click the pill, press Alt+G or Alt+R, use the popup, or right-click selected text.
- Sign-in: on app.workhunt.ai only, it reads the session the web app has saved, so you stay signed in. It never reads cookies or sign-ins from other sites.
- Sent to WorkHunt: job descriptions you choose to tailor for (with the page address and tab title), and requests for your own resumes, cover letters, and sessions. Firebase refreshes your sign-in. Your resume files download from our file storage through short-lived links.
- Kept on your device: your sign-in session, autofill profile, the job and document you picked, and your preferences. Signing out clears the session, and removing the extension deletes all of it.
- Not sent: form contents, browsing history, or the pages you visit. Autofill puts your details into the form, and they reach the employer only when you submit it.
- The extension has no analytics, advertising, or tracking code. It does not sell your data or use it for advertising or credit decisions. Our use of data the extension receives follows the Chrome Web Store User Data Policy, including its Limited Use requirements.
ChatGPT & Claude
You can connect your WorkHunt account to ChatGPT (OpenAI) or Claude (Anthropic). You sign in and approve the connection on WorkHunt's own consent screen; the assistant never sees your password.
- What the assistant can do: list and read your resumes, cover letters, interview prep and tracked applications; tailor a resume, write a cover letter or interview prep (these use your plan's AI allowance); add applications and change their status. It cannot delete anything or see your password.
- What we receive: the requests the assistant makes for you, including any job posting text it sends to tailor for. We store what those requests create (tailored resumes, cover letters, interview prep, applications) in your account, like anything you make in the app, and process it as described above.
- What we send back: the results of those requests, which the assistant's provider then handles under its own privacy policy. We do not receive your other conversations.
- Connection records: we keep which assistant you approved, when, and a hashed refresh token. Access lasts an hour at a time and renews for up to 30 days of inactivity. Disconnect any time from the assistant's connector settings; deleting your account ends every connection.
Your rights
- See and correct your data.
- Export or delete your account from Settings.
- Withdraw analytics consent at any time.
In Australia you have rights under the Privacy Act 1988 (Cth) and the Australian Privacy Principles, including the right to complain to the Office of the Australian Information Commissioner (OAIC). Users in the EEA and UK may have further rights under GDPR and UK GDPR, and users in New Zealand under the Privacy Act 2020 (NZ). To use any of them, email support@workhunt.ai.
Retention & security
We keep your data while your account is open. Deleting your account takes effect immediately: your account record and its resumes, job descriptions, chat sessions, and cover letters are erased, and your sign-in is removed from our authentication provider. We keep only what tax or legal obligations require: billing records at Stripe, and audit entries noting that an account was cancelled or deleted.
One known gap: a resume file you delete in WorkHunt before deleting your account can stay in our file storage (Amazon S3, Sydney), with nothing pointing to it, until scheduled maintenance removes it. We are fixing this.
We use HTTPS, encrypted storage, and least-privilege access.