Privacy policy

What CouchHire holds about you depends on which side of the marketplace you are on. In each case it is what the product needs to work.

If you list as a candidate we hold two separate things. Your identity -- your name, the email on your account and your current employer -- sits in a record of its own. Your listing is pseudonymous: a handle, your level and years, your skills, the role you want, your location preference, your working style, your Hire-Now and reserve prices, and a summary of your experience. Vetting adds a sealed record holding your background-check consent and any skills evidence you give us, and the resume you upload sits beside it, sealed the same way.

If you hire, we hold your company, the roles you open and the compensation bands on them, the bids you place and their move-by-move history, the candidates you shortlist, the panel interviews you ask a candidate to sit, and your subscription.

If you sit on the interview panel we hold your application -- your name, email, field, level and your own account of your career -- and then your panel record: field, level, availability, the interviews you ran, the feedback you wrote and the payouts we sent you.

If you open a support ticket we hold which page you filed it from, whether it is open or closed, and separately the text you wrote. That text is sealed, and it is the most sensitive thing you can type here, because nothing stops you typing your own name into it.

We also cache the five-variable score between a candidate and a role -- the scores and the coarse buckets behind them, nothing identifying -- so an employer's earlier shortlist ordering can still be explained.

For everyone we hold the account itself: your role, when you joined and the invitation you redeemed. Alongside it sit your email preference, the record of which version of each of these documents you accepted, and one row for every time you asked to download your data.

Two things are not ours to hold. Your sign-in credentials belong to Clerk and your payment details belong to Stripe. Section 8 says what that means for you.

Your identity is sealed. It lives in its own record behind a database policy rather than behind a setting in this application, and neither an employer nor a recruiter can read it.

An employer searching sees an anonymous listing: your handle, your level, your skills and your price. Not your name, not your email, and not where you work now.

To an employer, identity unlocks one way. You and an employer both accept the same offer, that mutual accept creates a match, and the match reveals you to that employer and to nobody else. Every reveal is recorded.

You are not searchable at all until an operator has approved your vetting. Vetted before anyone sees you is a rule the database enforces, not a convention we follow.

There is one exception, and it is deliberate. A CouchHire operator can open a sealed record through an audited door, and that includes your identity itself: an operator can read your name, your email and your employer without any match existing, by typing a reason first. The same door pattern covers your vetting record, a panel application and a support ticket you filed.

Each of those reads writes a row naming the operator and what was read, and every one but a support ticket also records the reason given at the time. Reading a support ticket records no reason, because the disclosure is the whole event and the ticket already says what was seen.

An operator can open your resume; each open is logged with the reason they gave.

Operators also hold a short list of powers over records, and every one of them writes a row to the operator action log before anything changes: deactivating a panelist and reactivating one, firing a full refund on an interview, force-cancelling an interview, releasing a hold on one, correcting a booked slot, correcting a candidate's pricing, correcting a role's compensation band, and reading, noting or closing a support ticket. Every mutating one records the reason the operator gave. Those rows are retained after an account closes.

Closing your account is one action with a different consequence for each kind of record. Here is every one of them, in the same words the privacy pane in your settings uses.

Deleted. Identity records, vetting records, your resume, and unfinished intake drafts are deleted outright. Your email preferences are deleted. A pre-launch waitlist signup is not tied to your account, so closure leaves it alone -- an operator removes it on request. Platform-wide settings and the register of published policy versions belong to the platform rather than to any account, so closure has nothing to remove there. One sign-in record sits outside the platform, and it is covered below.

Kept with your details cleared. Some records stay while their identifying details are cleared: the email on an invitation you redeemed, an operator's free-text vetting notes, and the name and email on a panel application. What was decided stays readable -- a panel application keeps its field, level and the applicant's own account of their career, because that is what the decision was made on.

Kept without your name. Listings, bids, matches, feedback and market reports stay on file -- they name a handle, not a person.

Kept on purpose. Audit records are kept: every operator read of a sealed identity or vetting record, every read of a panel application, every reveal to a matched employer, and one row per closure, written before anything is purged. An audit trail we could delete for you would not protect you.

Kept for tax and billing. We keep the payout ledger and the subscription record in our own database -- what was paid out to a panelist, and what a company was charged for which period. They are kept the way an invoice is, and either side may need to produce them long after an account is closed.

Held outside the platform. Your sign-in identity is held by Clerk, our sign-in provider. During the pilot an operator deletes that user after a closure runs, so closing your account does not remove it on its own. Card details, a panelist's payout account details and invoices live with Stripe rather than here; we keep only the references needed to talk to them, such as whether a panelist's payouts are enabled. Closing your account does not delete anything on Stripe's side -- Stripe keeps that data for as long as the law requires of a payment processor, and requests about it go to Stripe.

There are eight audit trails in all, and every one of them survives closure. Six are sealed: every operator read of an identity, of a vetting record and of a panel application, every reveal to a matched employer, every operator action against a panelist, an interview, a candidate, a role or a ticket, and one row per closure, written before anything is purged. Two sit beside them: the record that you were shown a specific version of a document and agreed to it, and the record of every request you made to download your data. An audit trail a user can delete is not an audit trail.

Market reports cannot be deleted. The database grants no delete on that table to any role the product runs as, so a report that was published is never removed. An operator can regenerate one for a period, and doing that replaces what the report said rather than keeping the earlier version beside it. Reports are built from aggregate pseudonymous signal and name a handle, never a person.

One consequence is worth stating rather than leaving you to find. Closure does not reach the body of a support message you wrote. That text is sealed and reachable only through the audited operator door, but the ticket still points back at the account that filed it -- so a message you typed your own name into outlives the deletion of your identity record.

A background check is part of vetting. A CouchHire operator runs it. There is no outside screening service in this product, so nothing about you is sent to one.

Nothing runs until you grant consent. On the last step of the onboarding form, the box you tick reads:

I consent to a background check as part of vetting.

Consenting is required to finish signing up: the form will not submit with that box clear. Two rules sit behind that, enforced in two different places, and the difference is worth stating. A listing is not searchable until vetting is approved, and the database enforces that. Consent is enforced in the signup form, and separately the operator's tool refuses to run a check on an account that has not granted it. Accounts made before consent became a condition of signing up may still be without it; their dashboard says so and offers it again:

The background check is waiting on your consent. Nothing runs until you grant it.

The result is sealed with the rest of your vetting record. An operator reads it to decide your vetting; no employer and no recruiter ever sees it. Closing your account deletes that record outright, and your resume with it.

A panel interview is a live video session with a neutral VP-level expert in your field. Both sides join under a platform pseudonym, and you are told exactly this at booking, before you pay:

You meet in a private CouchHire room. You join under your handle; your interviewer appears as their level and field only.

Names and employers are withheld -- faces and voices are visible by design.

Full refund until 24 hours before your interview.

CouchHire does not record the session. No recording is made at our end and we hold none, so there is nothing here to keep or to hand to anyone.

What your interviewer writes afterwards -- an overall rating, per-criterion scores and a short summary -- attaches to your listing, and employers see it only if you turn sharing on. They always see your interviewer as a VP-level peer in a field, never by name.

There is no analytics in CouchHire. No Google Analytics, no Segment, no PostHog, no Plausible, no Mixpanel -- no product analytics of any kind, ours or anyone else's. Nothing in this product reports what you did to anyone.

Signing in sets Clerk's session cookies, and they are the only cookies this product sets. Outside production it will read one named dev_token if somebody has placed it by hand, which is how our own end-to-end tests switch identity. It is never set by the product and never read in production.

Stripe sets its own cookies on its own domain while you are on its hosted checkout page. Those are Stripe's, they are governed by Stripe's policy, and they cannot be read from here.

You can download your own data from the privacy pane in your settings. The file is JSON, it is built at the moment you ask for it, and you can ask up to three times in twenty-four hours.

What is in it depends on your role, the same way section 1 does. A candidate gets their sealed identity record, their profile, their bids and their history, their matches, their interviews and the feedback written for them, their market reports and any unfinished signup draft. An employer or a recruiter gets their open roles, their bids and their history, their matches, their shortlists and the panel interviews they asked a candidate to sit. A panelist gets their panel record, their availability and their payouts.

Everyone gets their notification preference, their acceptance records and their own request history, and anyone on a subscription gets that too. An account with no sealed identity record -- which is every employer, recruiter and operator, because only candidates have one -- is told so in the file rather than left to wonder. Where a record names somebody else, they appear as the handle, company or peer description the product already shows you on screen.

Some records are left out, and the file lists every one of them in its own not-included section rather than leaving you to notice. Two different reasons sit behind that list.

The first is that the record is not yours to have. The free text other people wrote to you, the audit trail of who read your identity, and our providers' internal references are all left out on principle.

The second is plainer, and we would rather say it than imply otherwise. The record belongs in your download and there is no self-service path to it yet. Your background-check record, the support tickets you filed and the text in them, your account row and the invitation behind it, the step-by-step trail behind decisions about you, and -- if you sit on the panel -- your application, the interviews you ran and the feedback you wrote all sit behind a sealed door or an operator-only grant in this release. A record being yours is not the same as there being a button for it. Ask support and an operator will pull them for you.

You can download your data and close your account whether or not you have accepted the current terms. If you decline them CouchHire pauses for you, nothing is deleted, and those two things still work.

Closing is one way. It is refused while we still owe you a payout or you have an interview on the calendar. Otherwise it runs immediately, and nothing about it can be undone.

Your sign-in identity is held by Clerk. During the pilot, deleting the Clerk user behind a closed account is an operator step taken after closure runs rather than something closure does itself.

Card details, a panelist's payout account details and invoices live with Stripe. This database holds only the references needed to talk to Stripe: a panelist's connected account id and whether their payouts are enabled, and a company's customer and subscription ids.

Closing your CouchHire account does not delete anything on Stripe's side. Stripe keeps that data for as long as the law requires of a payment processor, and a request about it goes to Stripe rather than to us.