PRIVACY POLICY

HUNT (gohunt.careers; shown as GoHunt on Google’s sign-in screen) is operated by Agentic Genie LLP, registered in India and based in Bengaluru, and we are the data controller for everything described here. HUNT helps you discover jobs and submit applications. To do that we store the information you give us (resume content, profile details, login emails for job boards) and use it on your behalf to score postings, tailor resumes, and submit applications. We give you your own HUNT email address for applications, so we do not need your personal inbox. We never sell your data and we don't share it with anyone outside the service providers we need to operate. We do not hand your data to an employer who asks for it either, as the terms say: only a court order or a law can make us.

• Account information: email address, password (hashed by our authentication provider), authentication tokens.
• Profile and resume data: name, phone number, location, country, citizenship, work authorization status, date of birth, gender, education, work history, projects, skills, portfolio links, and any text you enter into our onboarding wizard.
• Mail to your HUNT address: every email sent to the address HUNT gives you, as described in section 5.
• Resume files: PDFs/DOCX/TXT you upload, plus generated PDF resumes we produce, stored in private cloud storage.
• Job-portal credentials (only when you connect them): the email address (and, where required by the portal, a password) you use to sign into the job portal. Passwords are encrypted at rest with AES-256-GCM using a key held in our infrastructure secrets manager.
• Generated application-site accounts: when an application site requires an account, our agent may create one for you using the address you apply from (your HUNT address, unless you chose your own Gmail) and a generated password. These credentials are stored encrypted and are visible to you in Settings.
• Profile photo (optional): if you upload one, it is stored privately and attached only to application forms that require a photo.
• Email-provider access (only if you connect it): permission to read your inbox and to send mail from your address. Reading is used to detect interview invitations, link them to your application history, and retrieve one-time login codes some portals send during sign-in. Sending is used only for replies to recruiters about your own applications. By default every reply waits for you to review and approve it; if you turn on automatic replies, HUNT sends them for you under the limits described in "How We Use It".
• Interview practice recordings (only when you use voice mode): your spoken answer is sent to our language-model provider for transcription and discarded once transcribed. We store the text transcript, timing measurements and the feedback, never the audio. The interviewer’s voice is generated by the same provider from the question text. When you tell a strong "tell me about a time" story in practice, we also save it to Your stories: a short retelling written from your own transcript, which you can rename or delete at any time. Deleting a practice session does not delete the stories saved from it.
• Networking research: when you ask HUNT to find people at a company you are targeting, we search the public web and store what the search returns: names, job titles, employer, location, public profile links, the public career and education history shown on those profiles, and the topics of their recent public posts, along with the raw search result we read those from. We do not collect or store their email address or phone number. This is public professional information, held so we can draft an opener you send yourself. HUNT never contacts these people; you send every message by hand. We keep this data for 12 months from the last time it was looked up, then delete it. If you are one of these people and want your record removed, email us.
• Application activity: hunts you create, jobs scored, applications submitted, statuses, and per-application screening question answers (so we can reuse them on future applications).
• Usage data: if you allow analytics and advertising tools, Google Analytics, Google Ads, Microsoft Clarity and the Meta Pixel (Facebook) receive page, browser/device, and interaction data from public marketing pages so we can understand how the site is used and measure our ads. The Meta Pixel has no cookieless mode, so it is not loaded at all unless you allow it. If you do not allow them, Google's tags still send a basic signal with no cookies: your IP address, browser and device details and the page address, from public marketing pages and when you create an account or pay, so we can count the results of our advertising. Microsoft Clarity sets no cookies unless you allow it. These tools also run inside the signed-in app (not the admin area). There, Microsoft Clarity's recordings hide all text and form fields on screen, so your resume, your answers and your billing details are not in them; clicks, scrolls and page layout are. We do not intentionally send profile, resume, or application content to these providers.
• Ad click and conversion data: if you arrive from one of our Google ads and you allow it, we keep the click ID Google added to the ad’s link in a cookie and, once you finish creating your account, on your account. When you then sign up or pay, our servers tell Google Ads that it happened: the click ID, the time and, for a payment, the amount paid. We do not send your name, email address, phone number, resume or application content. A click ID is deleted after 90 days.

• To score job postings against your profile, tailor your resumes and render them as PDFs, and submit applications via our automated browser agent. Scoring and tailoring use an AI model provider.
• To detect interview invitations and follow-up emails in your inbox and surface them on your calendar.
• To draft replies to recruiters who email you about an application you submitted, and to send them from your address once you approve them (or automatically, if you turn that on). Automatic replies are only sent for a thread we can match to your own application, only to the sender’s own company domain, and never include your phone number, address, date of birth, visa status, salary expectations or the answers saved from your past applications.
• To pre-fill known answers to repeated screener questions across applications.
• To send transactional product emails: password resets, account updates, a notice when a site asks you to verify an account, and a notice when an application is paused waiting on your answers (at most one every six hours). These answer something you or the agent did, so they cannot be switched off without losing the application they are about. Separately, we send a twice-weekly digest of applications that have gone quiet; that one is not transactional, so it has an off switch in Settings → Notifications and a link to it in its own footer. No marketing emails.

If you allow analytics and advertising tools, Google (Analytics and Ads), Microsoft Clarity and the Meta Pixel (Facebook) may use cookies or similar technologies to measure activity on public marketing pages and to measure our ads. Google's tags and, if you allowed it, the Meta Pixel also run on the sign-up and payment confirmation pages, to report that a sign-up, the end of sign-up setup (Meta Pixel only), or a payment happened. If you do not allow them, none of the cookies below that belong to them are set, but Google's tags still send the basic cookieless signal described above. These tools also run inside the signed-in app (not the admin area). There, Microsoft Clarity's recordings hide all text and form fields on screen, so your resume, your answers and your billing details are not in them; clicks, scrolls and page layout are.

Cookies we set

• sb-<project-ref>-auth-token (split into numbered parts such as sb-<project-ref>-auth-token.0 and .1 when the token is too large for one cookie). Set by our authentication provider’s browser SDK. Purpose: holds your signed-in session, meaning the access token and the refresh token that renews it. Without it every page load is anonymous and you would sign in again on each click. Lifetime: it lasts as long as your session keeps being refreshed, and it is cleared immediately when you sign out or delete your account. In production it carries the Secure flag, so it is only ever sent over HTTPS.
• sb-<project-ref>-auth-token-code-verifier. Set by the same SDK only during a Google sign-in. Purpose: the one-time PKCE value that proves the browser which started the sign-in is the one that finished it. Lifetime: deleted as soon as the sign-in round trip completes, normally within a minute.
• gh_first_touch. Set for up to one hour for a new visitor when the page has a referrer or campaign parameters. Purpose: carries the referrer host and campaign source, medium, and name to signup attribution. It contains no account identifier and is HttpOnly.
• gohunt_ad_click. Set for 90 days only if you arrive from one of our Google ads and have allowed analytics and advertising tools. Purpose: remembers the ad click ID so a sign-up or purchase can be reported to Google Ads after you have signed in. It holds the click ID and the time, and no account identifier. It is deleted when you turn the choice off.

The session, verification, first-touch and ad-click cookies above are the cookies HUNT sets directly. When you allow analytics and advertising tools, those providers may set their own cookies or similar identifiers as described in their privacy documentation. Our existing first-party page-view log is separate from those providers. The web fonts are served from our own domain, so loading a page sends no request to a font provider.

Cookies Google and Microsoft set (only after you allow)

These are the cookies we saw set in a real browser on 5 October 2026 after pressing ALLOW. The providers decide their names and lifetimes and can change them, so treat the lifetimes as approximate. None of them is set before you allow, or if you choose NO THANKS.

• _ga and _ga_<id> (Google Analytics, on our own domain, up to about 13 months). Purpose: tell visitors and visits apart so we can count them.
• _gcl_au and _gcl_aw (Google Ads, on our own domain, 90 days). Purpose: measure our ads: the second keeps the ad click ID from a Google ad you clicked.
• GCL_AW_P and IDE (Google, on google.com, googleadservices.com and doubleclick.net, 90 days to about 13 months). Purpose: advertising measurement and reporting a conversion to Google Ads.
• _fbp and _fbc (Meta Platforms, set on our own domain, up to 90 days). Purpose: let Meta recognise a returning browser, and an ad you clicked, to measure our ads. They are set only after you allow analytics and advertising tools, and deleted when you turn the choice off.
• MUID, MR, SM, ANONCHK, SRM_B and CLID (Microsoft Clarity and Microsoft, on clarity.ms and bing.com, from one session to about 13 months). Purpose: keep a Clarity recording together across a visit and recognise a returning browser.

Local storage (stays in your browser, never sent to us)

These are written by the app in your own browser and are never transmitted to our servers. They survive until you clear your browser’s site data.

• gohunt.analytics-consent – your choice to allow or reject analytics, so we can remember it in this browser.
• leadsboard:v2:<hunt id> – the filter and sort you last picked on that hunt’s board.
• cg:hunt-intro-dismissed – that you dismissed the “new here?” strip on a hunt page, so it does not come back.
• gohunt.interview.micDeviceId – which microphone you chose for interview practice, so we do not ask again.

Session storage (cleared when you close the tab)

• autoscore:<hunt id> – a timestamp that stops a board from re-triggering the same scan every time you open it.
• cg:tour-origin – the page to send you back to when the guided tour finishes.
• cg:taskBadge – the last counts shown on the APPLICATIONS badge, so it does not flash zero while it reloads.
• apply_prefs_dismissed – remembers that you dismissed the apply-preferences prompt, so it does not reappear for the rest of the session.

Analytics choice

Analytics is optional. The prompt on public marketing pages lets you allow or decline it, and the "Cookie choices" link in the footer lets you withdraw or change that choice later. Rejecting analytics does not affect sign-in or product functionality. The necessary authentication cookies remain in use either way.

You can clear or block all of it in your browser settings. If you block the session cookie you will not be able to stay signed in, because that cookie is the sign-in.

We use a small set of trusted infrastructure providers (sub-processors) to operate the service, each under data processing terms consistent with this policy. Each provider only receives the data they need to perform their specific function:

• Cloud hosting and database — holds your account, profile data and uploaded resumes in private storage with row-level access controls, and serves the web application.
• AI model providers — used for resume parsing, resume tailoring, job scoring, interview transcription and voice, and drafting your application answers and recruiter replies. Prompts include your profile and the job description. Some requests reach a model through a routing service, which passes them to that model’s provider on the same terms. We do not opt into training-on-prompt programs.
• Web search provider — used to find company pages, people at a target company and their public posts. Receives the company, role and location being searched. It also receives up to two school names and one past employer from your own profile, because searching for alumni and former colleagues is what finds people likely to reply to you. It never receives your resume, your contact details or the rest of your profile.
• Application and research workers — run the browser automation that submits applications on your behalf, on our cloud hosting. Each receives a short-lived signed URL to your tailored resume and profile fields scoped to the single application. The people-search worker receives up to five school names, up to five past employers and up to five skills from your profile to build its queries, never your resume file or your contact details.
• Your email provider — only if you connect an email account. OAuth tokens are stored encrypted. The scopes requested are reading your mail and sending mail from your address, as described in "What We Collect" and in section 6 below.
• Inbound email (Cloudflare) — receives mail sent to HUNT addresses and holds a raw copy for up to 14 days before it reaches us. Amazon Web Services sends the short notices we email you and the replies you write in your Inbox.
• Email delivery — delivers the product emails described above. Receives your email address and the message content.
• Payments (Razorpay) — only if you buy a paid plan. Razorpay processes the payment itself, so your card number, UPI PIN or bank login go to Razorpay, never to us. We send it the plan, the amount, your email, and the name and state for your invoice, which we take from your profile (the state from your location, or Karnataka when it names none); we get back the payment ID, its status and amount, which we keep to run your plan and issue your tax invoice.
• CAPTCHA solving — used only when an application site presents a CAPTCHA during an apply you authorized. Receives the CAPTCHA challenge from the page, not your personal data.
• Website analytics and ad measurement (Google Analytics, Google Ads, Microsoft Clarity and the Meta Pixel) — with your permission they use cookies and receive usage and technical data from public marketing pages to measure site activity and our ads. Without it, Google's tags receive only the basic cookieless signal described above and Microsoft Clarity sets no cookies. These tools also run inside the signed-in app (not the admin area). There, Microsoft Clarity's recordings hide all text and form fields on screen, so your resume, your answers and your billing details are not in them; clicks, scrolls and page layout are. Separately, for someone who arrived from one of our Google ads and allowed it, our servers send Google Ads the ad click ID, the time of a sign-up or purchase and, for a purchase, the amount paid.

We do not sell, rent, or share your data with advertisers, data brokers, or any party outside the operational role above. Telling Google Ads that a sign-up or purchase came from its ad, as described above, is part of measuring our own advertising, not a sale of your data. A current list of named sub-processors, or a copy of our data processing agreement (DPA) terms, is available on request to info@gohunt.careers.

The rules for using the service are in our Terms of Service.

Every HUNT account gets its own email address on our mail domain (for example firstname.lastname@privateneutron.com), so that applying for you does not need access to your personal inbox. Unless you choose to apply from a Gmail you connect, this address goes on your applications, on the resume we send, and on any account we create for you on an employer’s site.

• What we process: every email sent to your HUNT address, including the sender, subject, body and attachments.
• Why: to read the one-time codes and verification links job sites send during an application, to recognise interview invitations, offers, rejections and recruiter replies and keep your applications up to date, to show you everything in your Inbox, and to forward the mail you asked for to your own email.
• AI classification: message content goes to our AI model provider only to sort job-related mail, under terms that forbid training on it.
• Notices: when an interview invite, a test, an offer or a recruiter’s message arrives, we email your account address a short notice from HUNT’s own address saying so, with a link to it in your Inbox. A notice contains nothing from the email itself: not the sender, the company or the text. We send none for mail that fails sender checks, and none for rejections. Your mail is read and answered in your Inbox.
• Sending: we send email from your HUNT address only when you reply to a message in your Inbox, and only to the person who sent it. Your replies are kept with the message.
• Storage: messages are kept in your account while it exists. Before mail reaches us, our email provider holds a raw copy for up to 14 days, so nothing is lost if we are briefly unavailable; it is then deleted. That includes mail sent to an address with no account behind it, which reaches no one and is deleted on the same schedule.
• Humans do not read it, with the same four exceptions as for Gmail in section 6.

If you stop using HUNT or cancel a paid plan, your address keeps receiving mail and forwarding it to you for as long as your account exists, because resumes and job-site accounts carry it for months. Deleting your account closes the address: see section 7.

Connecting a Gmail account is optional. You need it only if you want HUNT to apply from your own Gmail address instead of your HUNT address (section 5): job portals such as Workday and Greenhouse email one-time codes and verification links during an application, and HUNT then has to read them in your Gmail to finish it. Connecting grants exactly two Google scopes and nothing else:

• Read your mail (gmail.readonly) — so we can spot interview invitations, recruiter replies and rejections and keep your application history current, and read the one-time codes some job portals email during sign-in.
• Send mail as you (gmail.send) — used only to reply to a recruiter about an application you submitted. Every reply waits for you to approve it unless you turn on automatic replies in Settings, and an automatic reply is only ever sent to a thread we matched to your own application, at the sender’s own company domain.

HUNT’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

• We use this data only to provide the features described above, which are visible in the product.
• We do not use it for advertising, and we never sell it.
• We do not use it to train AI models. Message content goes to our AI model provider only to classify job-related mail and to draft the replies you asked for, under terms that forbid training on it.
• We do not let humans read your mail, with four exceptions: you ask us to look at a specific message; a security investigation makes it necessary; the law requires it; or the data has been aggregated and anonymised so no message or person can be identified.
• We transfer it to no one else except as this policy describes.

You can disconnect Gmail at any time in Settings → Integrations, which revokes our token with Google immediately, or revoke it yourself from your Google Account permissions page. Disconnecting stops all syncing at once. Messages already synced stay in HUNT so your application history is not left with holes in it; deleting your account removes them with everything else.

Your data is retained while your account is active. You can delete individual resumes, applications, hunts, and stories from the app at any time.

To delete everything, use Settings → Delete account. This is self-serve and takes effect immediately — there is no request to submit and no waiting period. It removes your account and every record attached to it: profile and career tracks, uploaded resumes and generated documents, applications and hunts, saved application answers, stored credentials, and synced email metadata. Files in storage are deleted alongside the database records rather than left behind.

If you have connected Gmail, we also revoke HUNT’s access token with Google as part of the deletion, so the grant does not outlive the account.

Deleting your account also closes your HUNT address and deletes every message it received. Mail sent to it afterwards reaches no one (our email provider’s raw copy is deleted within 14 days), and we never give the address to anyone else. Accounts the agent created for you on employer sites with that address stay on those sites (we cannot delete them), but they can no longer receive email, including password resets, so change the email on them first; Settings → Generated accounts lists them.

Your networking targets, the shortlists you picked and the openers you drafted are attached to your account and go with it. The underlying research about those people is shared across everyone who targets the same company, so it is not attached to any one account; it is deleted on the 12-month schedule described above instead.

Deletion is permanent and cannot be reversed. Job listings themselves are not personal data and remain in our shared listings pool; they contain nothing about you. We may retain a minimal record where the law requires it, such as evidence of OAuth disclosures.

Payments are the main such record. Indian GST law requires us to keep tax invoices and the payments behind them for several years (currently 72 months from the relevant annual return). So when you delete your account, your payment records are kept, detached from the deleted account: the plan, amount, dates, payment ID and the billing name, email and state on the invoice. They are used only for tax, accounting and handling disputes about a payment. The full notifications Razorpay sends us about a payment, which can include your contact details, are cut down to those same fields after 180 days.

If you are in the EEA, UK, or California, you have the right to access, correct, export, or delete your personal data. Deletion you can exercise yourself at any time via Settings → Delete account; for access, correction or export, contact info@gohunt.careers and we will fulfill the request within applicable legal timeframes. We rely on your consent for OAuth integrations and on legitimate interest for the operational data needed to run your account.

We store secrets (job-portal passwords, accounts our agent creates for you, OAuth tokens) encrypted at rest with AES-256-GCM. Service-to-service calls between our app and the application agent are signed with HMAC-SHA256 and verified with constant-time comparison. Database access is enforced by row-level security policies. No security model is perfect — if you discover a vulnerability, email info@gohunt.careers and we will respond.

HUNT is not intended for users under 16. We do not knowingly collect data from anyone under 16.

We will update this page when material changes happen. The "Last updated" date at the top reflects the latest revision. Continued use after a change constitutes acceptance.

Questions or requests: info@gohunt.careers.