Hireply privacy policy
In short: You sign in to Hireply with Google on our website. Hireply reads the LinkedIn conversation you have open only when you ask it to draft replies, when you send a reply (if learning is on), or when you save the conversation to your board. Drafting and learning don't store your conversations; saving one stores it on your board until you delete it. We don't sell data, show ads, or send messages on your behalf.
Who we are
Hireply is a Chrome extension that suggests replies to recruiter messages on LinkedIn, with a website where you sign in and keep a board of your opportunities. It is developed by Oleh Hnapovskyi. Contact: oleh.hnapovskyi@gmail.com.
What data Hireply handles and why
| Data | When | Why | Where it goes |
|---|---|---|---|
| Your Google account's email address and name (and the profile picture link Google provides) | When you sign in on our website | To create and identify your Hireply account | Supabase (authentication), kept until you delete your account |
| A one-way hash (SHA-256) of your email address | When your account is created | So the free replies are given once per email, even if an account is deleted and created again | Our database (Supabase). Kept after account deletion; it can't be turned back into your address. |
| Device tokens that connect the extension to your account: a hash of each token, the device label, and when it was created and last used | When you connect the extension, and when it calls our server | To know which account a request comes from without the extension holding your Google sign-in | Our database (Supabase). Disconnect a device on the website at any time. |
| Reply balance and the promo codes you redeemed | When you generate replies or redeem a code | Free replies and promo credits | Our database (Supabase, EU region) |
| Text and sender names of the messages in the LinkedIn conversation you have open (up to the last 20) | When you click "Generate AI replies" | To draft three reply suggestions | Our server, then Google Gemini API. Not stored. |
| The note you type next to the button | Same as above | To tailor the suggestions | Our server, then Google Gemini API. Not stored. |
| "About me": files you upload (CV and up to 4 more: PDF, Word, text), notes and call transcripts you add, and what is derived from them: their text, passages, short facts about you, and numeric embeddings of those | Only when you add them on the website (or choose to save notes from "Update with AI", or your connected AI app adds them). Settings you once typed in the extension's popup are moved here once. | So replies and cards can use facts about you (for example your notice period) when a recruiter asks | Our database and file storage (Supabase, EU region). The text is sent to Google Gemini API to read files, pick out facts and compute embeddings; the facts closest to a recruiter's latest message are sent with it when you generate replies. Deleting a file or note deletes everything derived from it. |
| Text and screenshots you paste into "Update with AI" on a card | Only when you use it | To propose changes to that card | Our server, then Google Gemini API. Not stored unless you choose to save the notes to About me. |
| A usage log of AI actions (which kind, a weight, when) | Each time Hireply calls the AI for you | Daily and monthly fair-use limits, shown on your account page | Our database (Supabase, EU region) |
| AI apps you connect (MCP): the app's name and callback address, hashes of its access tokens, what you allowed (read only, or read and change), and a log of which tools it used and when | Only when you connect an AI app (such as Claude or ChatGPT) and approve it on our website | So that app can read your board and search your About me, and, only if you allowed it, add notes or move cards | Our database (Supabase, EU region). What the app reads goes to that app's provider under its own terms. Disconnect it on your account page at any time. |
| The reply you send in that conversation, with the conversation text and the suggestions shown | When you send a reply, only if "Learn from my replies" is on | To update your learned profile | Our server, then Google Gemini API. The conversation isn't stored; the recruiter's latest message and your reply are kept as one of your last 12 examples (below). |
| Opportunity cards: the recruiter's name, LinkedIn profile link and headline, a snapshot of the conversation's messages (up to the last 20 each time), and details extracted from them (company, role, salary, work mode, location, next step, a short summary), plus anything you add on the board | Only for conversations you save to your board, and when you update a saved one | To keep your board of opportunities up to date | Our database (Supabase, EU region). New messages and the card's details are sent to Google Gemini API to extract the details; your own notes on the board are not. |
| How you reply: the learned profile, your last 12 example replies (each with the recruiter message it answered), the learning switch and simple counts | When you send a reply with learning on, or edit the profile on your About me page | To write suggestions in your voice | Our database (Supabase, EU region). The profile and the closest examples are sent to Google Gemini API with each draft request. An AI app you connect can read them. |
| Extension settings (your account email, the device token, the first-run tour) | Continuously | To keep you signed in | Only in your browser (Chrome extension storage) |
| Your IP address | With each request | Abuse prevention: limiting failed sign-in attempts. Other request limits are per account. | Our server and our rate-limit store (Upstash Redis), as short-lived counters |
| Feedback message and, optionally, your email | Only when you send feedback | To read and answer feedback | Formspree |
Hireply only runs on linkedin.com and on our website. It doesn't read your browsing history, other websites, passwords, or LinkedIn conversations you don't open, and it never sends messages for you: you choose a suggestion and send it yourself.
Service providers
- Google signs you in (Google Sign-In) and, through the Gemini API, generates the suggestions, profile updates and card details. Google processes the text under the Gemini API Additional Terms of Service.
- Supabase runs our sign-in and database (EU region): your account, device tokens, balance and board (Supabase privacy policy).
- Vercel hosts our server and website (Vercel privacy policy).
- Upstash stores short-lived rate-limit counters (Upstash privacy policy).
- Formspree receives feedback you choose to send (Formspree privacy policy).
Retention
- Conversation text and notes used to draft replies or learn are processed in memory to answer the request and are not stored by Hireply. Your last 12 example replies are kept until you reset them or delete your account.
- Conversations you save to your board, and their cards, are kept until you delete the card or your account.
- About me files, notes and what is derived from them are kept until you delete them or your account.
- The AI usage log and the AI-app access log are kept until you delete your account.
- Your account, device tokens and balance are kept until you delete your account. The email hash is kept after that, only to prevent repeated free trials.
- Rate-limit counters expire on their own, within a day.
- Server logs may briefly keep technical details (timestamps, errors, the last 4 characters of an API key) but not message content.
- Data in your browser stays until you sign out or uninstall the extension.
Your choices
- Turn off "Learn from my replies" in the extension or on your About me page to stop sending your sent replies for learning.
- View, edit or reset your learned profile and examples on your About me page.
- Edit or delete any card on your board.
- Delete any file, note or fact on your About me page.
- Disconnect an AI app on your account page; it loses access at once.
- Disconnect a device, or delete your account, on the Hireply website. Deleting your account removes your account, device tokens, balance, redeemed codes, board and learned profile at once; only the email hash described above remains.
- Uninstall the extension to remove all locally stored data.
- Email us with any privacy question or request.
What we don't do
- We don't sell or rent your data, or transfer it for advertising, credit or lending purposes.
- We don't use your data for anything other than providing and improving Hireply's single purpose: helping you answer recruiters and keep track of your opportunities.
- We don't let humans read your conversations or your board, except when you include them in feedback you send us.
The use of information Hireply receives complies with the Chrome Web Store User Data Policy, including the Limited Use requirements.
Children
Hireply is meant for job seekers and isn't directed at children under 16.
Changes
We'll update this page if Hireply's data practices change, with a new "Last updated" date.