Privacy Policy

Last updated: 17 October 2026

This policy explains what personal data Hardmode ("we", "us") collects when you use hardmode.lol and the Hardmode web application (the "Service"), why we collect it, who we share it with, and the choices and rights you have. Hardmode is based in India and is the data fiduciary (data controller) for the personal data described here.

The short version:

• We collect what we need to run your mock interviews and your account, including your CV if you choose to add one.
• Your interview content is sent to third-party AI model providers to generate the interviewer's responses and your feedback. Hardmode doesn't train AI models on your data. Those providers handle it under their own terms, which may allow them to use it, including to improve their models (see section 3).
• Session recordings stay on your device. They're made in your browser for you to download; we never upload or keep them.
• We don't sell your personal data, and we don't use it for advertising.
• You can delete your CV, individual sessions, job postings and plans, or your whole account at any time, and download a copy of your data from the app.

1. Data we collect

Data you give us

• Account data: your email address, name, and login details (your password is stored only as a secure hash). If you sign in with Google, we receive your basic profile from it (such as name and email). We also keep a list of your signed-in devices so you can see and sign them out.
• Your CV (optional): the file or text you upload, and the details in it, such as work history, education, skills, and projects. We read the file into text and structured sections, which you can review and correct, and delete the uploaded file as soon as it's been read. The CV is used to personalise interview plans and the questions AI interviewers ask you.
• Job postings: URLs you submit and the job description text we retrieve or you paste.
• Interview content: your voice during sessions (streamed live, not stored by us), transcripts, code you write and the output when you run it, scratchpad notes and diagrams, custom questions and briefs, and take-home submissions (a public repository link or an uploaded zip).
• Camera (optional): if you turn on your webcam, the video is used only for your own session recording, in your browser. It isn't sent to us or to any AI provider.
• Background you choose to share: for example, your experience level, target role, or details you give for a negotiation practice scenario.
• Support messages: anything you send us by email or through the app.

Data generated when you use the Service

• Session output: interview plans, AI interviewer responses, and feedback.
• Progress data: derived from your sessions, such as sessions completed, time practised, difficulty levels completed, and recurring focus areas from your feedback. It's shown on your dashboard and isn't used to score or rank you.
• Account activity: credit balance and history, purchases, sessions started and completed, and the notice about how a session is charged that you acknowledge before it starts.
• Technical data: IP address, browser and device type, and logs of requests and errors (logs don't contain your interview or CV content). We use these to keep the Service secure and working.
• Abuse-prevention data: the result of a bot-protection check when you sign up, request a sign-in code, or reset your password; usage counts used for rate limits; and, after your email is verified, a one-way hash of your email address used to make sure free sign-up credits are given only once per address (see section 8).

Data from payments

Payments are handled by Dodo Payments, our merchant of record. We don't receive or store your full card details. Dodo Payments shares with us what we need to manage your purchase: for example, your name, email, country, the plan bought, and payment status.

2. How we use your data

We use personal data to:

• provide the Service: create your account, read job postings, compare them with your CV, build interview plans, run personalised sessions, generate feedback, and show your progress;
• process payments and manage credits and subscriptions;
• support you when you contact us;
• keep the Service secure: prevent fraud and abuse (for example, bot sign-ups, repeated free-credit claims, and payment disputes), enforce usage limits and our Terms, and debug problems;
• improve the Service using aggregated or de-identified usage information (for example, which round types are used most, or where sessions fail);
• communicate with you about your account, purchases, and important changes. We'll only send product news or marketing emails if you've opted in, and you can unsubscribe at any time;
• meet legal obligations, such as tax and accounting record-keeping.

We process your data on the basis of your consent (which you give when you create an account and use the Service, and can withdraw at any time), to perform our contract with you, to meet legal obligations, and for legitimate uses permitted by law, such as security.

3. AI processing

To run an interview, we send relevant parts of your interview content (such as your live audio, transcript, code, the job description, and, unless you switch it off for that session, your CV) to third-party AI model and speech providers. They generate the interviewer's or candidate's next response, convert speech to text and back, and write your feedback.

• Hardmode doesn't train AI models on your data.
• Our providers process your content under their own terms. Those terms may allow a provider to keep your content for a period and to use it, including to improve or train their models. We don't control that use, and deleting data in Hardmode doesn't delete copies a provider holds under its terms.
• Because of this, don't put anything in a session or CV that you wouldn't want processed by a third party, such as confidential employer information or other people's personal data. You can practise without a CV, or switch it off for any session.
• AI output can be wrong. Feedback is generated automatically and isn't a human assessment of you, and we don't use it to make decisions with legal or similarly significant effects on you.

4. Session recordings

You can record a session (the screen, your audio, and your webcam if it's on) and download the recording when the session ends. Recording happens entirely in your browser: we never upload or store recordings, and we can't recover one you didn't download. Once downloaded, the file is yours to keep and protect.

5. Fetching job postings

When you submit a job posting URL, we fetch the public page using a third-party web content retrieval service. Only the URL and the page content are processed; we don't send them your account details.

5a. Running code

When you run code in a live coding session, the code and any input you give it are sent to a third-party code execution service, which runs it in an isolated sandbox with no network access and returns the output. We don't send it your account details.

5b. Take-home submissions

If you submit a public GitHub repository, we download a copy of it; if you upload a zip, it's stored temporarily. We extract the text files needed for the review (dropping dependencies, binaries, and environment files such as .env). The uploaded zip and the extracted code are deleted once the feedback for your review call has been written, or when the brief expires or is cancelled. Your session history keeps the brief, the transcript, the feedback (including any code it quotes), and the list of file names.

6. Who we share data with

We share personal data only with:

• Service providers that help us run the Service: cloud hosting, databases, and file storage; web content retrieval; code execution; email delivery; bot protection; rate limiting; error monitoring and alerting; and customer support tools. They may use your data only to provide services to us.
• AI model and speech providers, which process interview content under their own terms, as described in section 3.
• Dodo Payments, to process payments as our merchant of record.
• Authorities or others when required by law, or when needed to protect the rights, safety, or property of our users, the public, or Hardmode.
• A buyer or successor, if Hardmode is involved in a merger, acquisition, or sale of assets. We'll tell you before your data becomes subject to a different privacy policy.

We don't sell or rent personal data, and we don't share it with advertisers.

7. International transfers

Our service providers may process data in countries other than India or your own country, including the United States and the European Union. Where we transfer data, we do so as permitted by applicable law and use contractual safeguards with our providers.

8. How long we keep data

When you delete your account, we delete or de-identify your personal data within 30 days, including from backups, except records we must keep by law and the email hash described above. Content already sent to AI providers is kept or deleted under their terms (section 3).

9. Security

We use reasonable technical and organisational measures to protect personal data, including encryption in transit, access controls, and limiting access to people and providers who need it. No system is perfectly secure; if we become aware of a breach affecting your personal data, we'll notify you and the relevant authorities as the law requires.

10. Your rights and choices

Depending on where you live, and including under India's Digital Personal Data Protection Act, 2023, you have the right to:

• access the personal data we hold about you and how it's processed, including by downloading a copy from the app (the download link works once and expires after 24 hours);
• correct or update inaccurate data;
• erase your data, by deleting your CV, sessions, job postings, plans, or account in the app, or by asking us;
• withdraw consent at any time (this doesn't affect processing that already happened, but we may not be able to provide the Service without it);
• object to or restrict certain processing, and receive a copy of your data in a portable format, where applicable law gives you these rights;
• nominate someone to exercise your rights if you die or become incapacitated;
• raise a grievance with us, and if you're not satisfied, complain to the data protection authority where you live (in India, the Data Protection Board of India).

To exercise these rights, email [email protected] from the address on your account. We may need to verify your identity. We'll respond within 30 days.

11. Cookies

The marketing site (hardmode.lol) doesn't use advertising or tracking cookies. The web application uses essential cookies needed to keep you signed in (for up to a year, renewed while you use it, unless you sign out) and to secure your session. Bot protection on sign-up and sign-in doesn't use tracking cookies. If we ever add optional analytics or other non-essential cookies, we'll update this policy and ask for your consent where the law requires it.

12. Children

The Service is for adults. We don't knowingly collect data from anyone under 18. If you believe a child has given us personal data, contact us and we'll delete it.

13. Changes to this policy

We'll update this policy when our practices change. If the changes are material, we'll notify you by email or in the app before they take effect. The "last updated" date above shows when it last changed.

14. Contact and grievance officer

For any privacy question, request, or grievance, contact our grievance officer at [email protected]. We aim to acknowledge requests within 48 hours.