Hintglass
Last updated
Privacy policy
Hintglass is built so that we never receive your interviews. Audio stays on your Mac, and the text the app sends goes only to the AI provider you choose. This page explains what goes where and the little we receive.
Who we are
Hintglass is made and sold by NOW_JSS4S PTE. LTD. (Singapore UEN 202420668K), 100D Pasir Panjang Road, #05-03 Meissa, Singapore 118520 (“we”, “us”). We are responsible for the personal data described here, as the “organisation” under Singapore’s Personal Data Protection Act 2012 (PDPA) and, for users in the EU and the UK, the “controller” under the GDPR.
Support and data protection requests, including for our Data Protection Officer: support@hintglass.app.
What stays on your Mac
- Audio. Both sides of the call are transcribed on your Mac by Apple’s on-device speech recognition. Audio is never sent anywhere, and Hintglass does not save it.
- Saved sessions. If you turn on Save transcript (off by default), questions, answers and related files are saved to a folder on your Mac. Delete all saved sessions removes them.
- Profiles are files on your Mac. Their text is sent to your AI provider during a session (see below).
- Keys and licence. Your AI provider and search keys, your licence key and licence details are kept in your Mac’s Keychain. Each key is sent only to its own service.
We never receive your audio, transcripts, prompts, answers, profile, resume or job posting files, screenshots, search queries or AI and search keys.
What goes to the AI provider you choose
Hintglass has no AI service of its own. You connect an AI provider with your own account and key, and the app sends to that provider, directly from your Mac:
- when you ask for an answer: the conversation so far as text, your profile and Hintglass’s answer instructions;
- on some providers, the same kind of text in the background during a session, so the next answer starts faster. These requests happen even if you never ask for an answer, and your provider may count them toward your usage;
- for a code answer: one screenshot of the window in front of you (never a Hintglass window);
- for a search answer: up to three search results. The interviewer’s latest words also go, as a search query, to the search service you chose;
- when you create a profile from files: the text of the resume and job posting you choose.
These services handle this under your own account and their own terms and privacy policies. We do not receive it and cannot see or delete it. If you run a local model with Ollama on your Mac, AI requests do not leave your Mac.
What we receive
Payment (Stripe)
Checkout runs on Stripe. You give Stripe your name, email address, billing address and payment details. Stripe processes the payment and tax and keeps these details in our Stripe account, where we can see them for billing, tax, refunds, disputes and support. We never see your full card number.
Our licence server stores only Stripe reference ids (checkout session, customer, subscription), a one-way hash of your licence key (never the key itself), the subscription status, whether the purchase is a test or live one, timestamps, and the ids and types of Stripe notifications so each is handled once.
Licence server
The app contacts our licence server to activate a Mac, at the start of each paid session, to deactivate a Mac and to open Manage subscription. Depending on the request, it sends your licence key, a random install id the app created on that Mac or the activation id the server gave it, and the app’s version. The server stores the install id with timestamps (created, last seen, deactivated). No request carries interview content, transcripts, prompts, profiles or provider details. The free session does not contact our server.
Update check
Once a day, or when you ask, the app asks our server whether an update exists. The request carries the app’s name and version and the version of its updater (Sparkle). No hardware or system profile is sent.
The waitlist
Until Hintglass launches, this website has a waitlist form. It sends what you type to forms.nowjss4s.com, a form service that NOW_JSS4S PTE. LTD. runs on Cloudflare for its own websites.
Cloudflare Turnstile checks that a person, not a script, is sending the form. It runs in your browser, and Cloudflare processes signals such as your IP address and browser details to tell people from bots, as its Turnstile Privacy Addendum describes. Our form service also passes your IP address to Turnstile, with the check’s token, to check you are human.
Once the check passes, the service stores five things: the product (Hintglass), your email address, your name if you gave one, your country as Cloudflare reports it for your connection, and the time you signed up. It does not save your IP address with your entry. Signing up again with the same address stores nothing new. We also get an email at our own inbox with the same details. Cloudflare keeps the service’s logs for a few days, and those logs may include your IP address; we use them only to find faults.
We use your email address, and your name if you gave it, for one thing: to send you one email when Hintglass launches. Nothing else.
Your entry is not deleted automatically. To be taken off the list, or with any question about it, email support@hintglass.app from the address you signed up with, and we delete it.
Website analytics
We count visits to this website with Cloudflare Web Analytics. It uses no cookies: Cloudflare says it uses no client-side state, such as cookies or local storage, does not fingerprint visitors by their IP address or browser, and does not collect or use visitors’ personal data. We see only totals, such as page views and how fast pages load, never a record of one visitor.
Website, IP addresses and logs
Our pages set no cookies of their own and run no tracking: the only measurement is the cookie-free analytics above. Cloudflare hosts our website, our form service and our licence server. Every request comes from an IP address; our licence server’s code does not store it, and uses it only briefly as a key to limit how many requests one address can make. Our form service passes it to Turnstile and does not save it with your entry, though Cloudflare’s logs of that service may include it, as above. Our licence server’s log lines record only technical details, such as event names, Stripe event ids and types, outcomes, error types and the route, and never an IP address, licence key, name or email address.
Once the home page has shown you the waitlist card, or you have joined the waitlist, it keeps a note of that in your browser’s session storage, so the card does not appear again in that tab until you close it; that note never leaves your browser.
If you email us, we receive your address and your message and use them to answer you. We send no marketing email, apart from the one launch email to the people on the waitlist. After a purchase, we email your licence key to the address you gave Stripe, sent through our Google Workspace account; our licence server does not store the address. A copy of that email, with your address and licence key, is kept in our Google Workspace mailbox. Stripe may send you receipts and payment notices.
Legal bases
Under the GDPR we rely on:
- consent: the waitlist and its one launch email, which you can withdraw at any time by emailing us;
- contract: selling the subscription, issuing and checking your licence, delivering updates and support;
- legal obligation: tax and accounting records;
- legitimate interests: security, rate limiting, preventing licence-key abuse and handling payment disputes.
Under the PDPA, we use personal data only for these purposes, with your consent (including the consent you give by buying and using a subscription) or where the law allows it. You can withdraw consent by emailing us; we will then no longer be able to provide your licence. We do no advertising, profiling or automated decision-making about you.
Service providers and transfers
Stripe (payments, tax and the customer portal), Cloudflare (website, website analytics, the waitlist form, its database and Turnstile, licence server and updates), our email hosting provider (support mailbox, waitlist notifications and licence key emails) and, when we send the launch email, the email delivery service we send it with process data for us; we do not sell personal data or share it with anyone else unless the law requires it. These providers operate worldwide, including in the United States, and where the law requires it we rely on safeguards such as the Standard Contractual Clauses and keep data protected to a standard comparable to the PDPA.
How long we keep data
- Licence, activation and Stripe notification records on our server are not deleted automatically. We keep them while your licence exists and afterwards for support, refunds and disputes, and delete them when you ask, except what the law requires us to keep.
- Copies of licence key emails in our Google Workspace mailbox are not deleted automatically. We keep them while your licence exists and afterwards for support, refunds and disputes, and delete them when you ask.
- Waitlist entries are not deleted automatically. We delete yours when you ask.
- Billing records in Stripe are kept as long as tax and accounting law requires.
- Support emails are kept as long as we need them to help you, and deleted on request.
- Data on your Mac stays there until you delete it.
Security
All connections to our server use HTTPS. Our licence server stores only a hash of your licence key (the copy of your key email is in our Google Workspace mailbox, as above), licence tokens and updates are cryptographically signed and checked by the app, and your keys stay in your Mac’s Keychain. If a breach affects your personal data, we will tell you and the authorities where the law requires it.
Your rights
Depending on where you live, you can ask us to give you a copy of your personal data, correct it, delete it, restrict or object to its use, or send it to you in a portable format, and you can withdraw consent. Email support@hintglass.app. Our licence server holds no names or email addresses, so we may ask for your licence key or Stripe receipt to find your licence records. Deleting your licence records ends your licence, so cancel your subscription first. We cannot access what your AI provider or search service holds; ask them directly.
You can also complain to a data protection authority: the Personal Data Protection Commission in Singapore, your local authority in the EU, or the Information Commissioner’s Office in the UK.
Children
Hintglass is not meant for children, and you must be 18 or older to buy a subscription. If you think we hold a child’s data, email us and we will delete it.
Changes
We will post any change on this page and update its “Last updated” date. If a change materially affects how we handle your data, we will announce it here before it takes effect and, where the law requires, tell you directly.