Security and privacy
Your job search is personal. We treat it that way.
Every sentence on this page is true of the code today and matches our Privacy Policy, which it quotes.
The short version
- We keep what you give Hirelit so it can find jobs, fill applications and track them for you: your profile, your resume, your answers and your applications. We do not sell it, rent it or use it for advertising.
- To write and judge text, we send the parts a task needs (for example your resume and a job posting) to an AI provider: the one whose key you add, or ours.
- Gmail and LinkedIn are optional. If you connect Gmail, we read only emails about your applications and store the subject, sender, date and a short snippet, never the full message. If you connect LinkedIn, your LinkedIn sign-in is kept on our server so it can search and apply there for you.
- Your data is stored in the United States. You can download a copy of everything or delete your account at any time in Settings > Privacy and data.
- Questions or requests: support@innomactic.com.
What we never do
- Sell or rent your data, or use it for advertising
- Use your data to train AI models
- Use your answers to fill anyone else's applications
- Store the body of an email, or send email from your Gmail
- Press Submit on your phone or in your browser
- Solve a captcha or sign in for you
How it is protected
Everything travels over HTTPS. AI keys, your Gmail token and other access tokens are encrypted with AES-256-GCM and never sent back to any app.
Every request is checked against your account, and each person's data is kept separate from everyone else's.
Its connection to your account is stored only as a fingerprint (a hash). Ordinary browsing sends nothing to Hirelit.
Every change runs dependency audits and secret scanning, and known vulnerabilities are fixed within a set time.
Where your data lives, and who handles it
Stored and processed in the United States. We share it only with the providers below, only to run Hirelit:
- Fly.io hosts our server and database in its Ashburn, Virginia (USA) region.
- Vercel hosts the web app's pages (they contain no personal data until you sign in).
- Clerk runs sign-in and holds your email address and sign-in details.
- Stripe processes payments and holds your billing details, if you subscribe.
- Google provides Gmail access, if you connect it, and the Gemini API.
- AI providers (Anthropic, Google, OpenAI, OpenRouter or the one you choose) process the text described in "AI providers".
- An email delivery service, if email notifications are set up, delivers our emails to you.
Your AI, your data
With your own key, requests go to your provider under your agreement with them. Without one, they go to ours. Either way, each task sends only what it needs: for example your resume and a job posting to score a job, or a question and your saved answers to draft an answer.
Connected accounts
We ask Google for read-only access. We look only at messages from application systems or employers you applied to, never open attachments, and store the subject, sender, date and snippet. Disconnecting revokes our access.
When you press Connect LinkedIn, only linkedin.com cookies are sent to our server, to search and fill Easy Apply for you. We never see your password.
The extension and the app
The extension acts only on pages Hirelit opened and on known application systems, and on other forms only if you switch on Offer on every site. Ordinary browsing sends nothing to Hirelit. The Android app fills forms in its own browser, on your phone.
Your controls
- Download everything in Settings > Privacy and data, including the resume you uploaded.
- Delete your account: we cancel any subscription, revoke Gmail, delete your LinkedIn browser profile and every row of your data, then your sign-in.
- Backups are replaced after 5 days. We do not restore deleted accounts from them.
- Short-lived data is deleted on a schedule. See every retention period.
This website
Report a security problem
Write to support@innomactic.com. Our contact details for security researchers are also at /.well-known/security.txt. We answer privacy requests within 30 days.