Privacy Policy

1. Using Crackit without an account

Most of Crackit works with no account. Questions, flashcards, aptitude practice and your progress (streaks, scores, answers you mark) are stored only on your phone. We do not receive them. If you uninstall the app, or clear its storage, that local data is gone.

2. What we collect when you use the online features

The online Intro Coach and related features need a sign-in. When you use them we handle:

• Account details: your email address, name and sign-in identifier, held by our sign-in provider (Clerk).
• What you submit for coaching: your resume text, a job description if you paste one, the role you are practising for, and the transcript of what you said or typed in an answer, with simple speech statistics (duration, words per minute, filler-word count). This is sent to our server and on to AI providers (section 4) to write a script or score your answer.
• Resume files: if you upload a resume PDF or DOCX in the app, it is read by an AI provider to extract a profile (headline role, years of experience, skills). The extracted profile is saved to your account.
• Interview sessions: if you run an online mock interview, the questions, your answers, and the scores and feedback are saved to your account.
• Usage counters and plan: how many Intro Coach attempts you have used, and your plan and credit balance, so we can enforce free limits and fair use.
• Purchase records: the store, product and purchase token or receipt reference for something you bought, and a credit ledger. We never see your card or bank details.
• Technical data: IP address and request logs kept by our hosting and security layers, used for rate limiting, abuse prevention and debugging.

Microphone: the app asks for microphone access only when you start a spoken answer. Speech is converted to text by your phone's built-in speech recognition service (Google's on most Android phones, Apple's on iPhones), which may process the audio under its own privacy policy. Crackit does not upload or store the raw audio; the resulting text is what is sent for scoring.

We do not collect your precise location, contacts, photos or advertising identifier, and the app has no third-party advertising or analytics SDKs.

3. Why we use it

• To provide the features you asked for (scripts, scores, mock interviews, your saved profile).
• To enforce free-plan limits and unlock what you bought.
• To keep the service secure and prevent abuse.
• To fix bugs and improve question quality. We do not sell your data and we do not use your resume or answers to show you ads.

4. Who processes it for us

We share data only with service providers needed to run Crackit:

• Google (Gemini API) and Anthropic (Claude API): AI models that receive the resume, job description and answer text you submit, and uploaded resume files, to produce the result. We try Gemini first and fall back to Claude if it fails.
• Sarvam AI: turns the interviewer's question text into spoken audio for mock interviews. It receives the question text, not your answers.
• Clerk: sign-in and account identity.
• Supabase: database where account data, sessions and usage counters are stored.
• Vercel: hosts our website and API.
• Upstash (if enabled): short-lived request-rate counters keyed to your account identifier.
• Google Play and Apple App Store: process payments and subscriptions. We receive only purchase confirmations.

Each provider has its own privacy policy and terms, and we encourage you to read them. Some of these providers are located outside India, so your data may be processed in other countries. We may also disclose information if required by law or a valid legal request.

5. How long we keep it

• Local app data: until you clear it or uninstall the app.
• Account, profile, interview sessions and usage counters: until you delete your account (section 7), or until you ask us to delete them.
• Purchase and credit records: kept after account deletion for accounting, tax and dispute handling, for as long as the law requires. At deletion we remove the link to you (the records are re-labelled so they no longer identify you).
• Server request logs: kept by our hosting providers for a short operational period under their own schedules.

6. Security

Data travels over HTTPS. Access to the database is restricted to our server. Sign-in tokens are kept in your phone's secure storage (Keychain or Keystore). No system is perfectly secure; if we learn of a breach affecting you we will notify you and the authorities as the law requires.

7. Your choices and rights

Delete your account and data: in the app, open Profile and choose “Delete my account”. You can also follow the steps on our account deletion page, which also explains what we delete and what we keep.

Under India's Digital Personal Data Protection Act, 2023 and the Information Technology Act, 2000 (and, where they apply to you, laws of your own country), you can ask us to give you access to the personal data we hold, correct it, erase it, or withdraw your consent, and you can raise a grievance with us. Contact us at our support email (to be published here before launch). We aim to reply within 30 days. If you are not satisfied you may approach the Data Protection Board of India once it is operational, or your local regulator.

Using only the offline parts of the app requires no consent from us because we receive no personal data from them.

8. Children

Crackit is for people aged 13 and over and is not directed at children. If you are under 18 you should use it with a parent or guardian's awareness, and the sign-in and paid features are for those who can legally enter the agreement. We do not knowingly collect personal data from children under 13. If you believe a child has given us data, contact us and we will delete it.

9. Changes

We will update this page when the app's data practices change and change the date at the top. For significant changes we will also tell you in the app.

10. Contact and grievance

Questions, requests and grievances: our support email (to be published here before launch).