Privacy Policy
Version 1.1 · Last updated: 24 August 2026
Hike is a career tool. That means we hold some of the most personal material you own: your resume, your work history, who you have talked to, and where you have applied. This policy explains exactly what we hold, why, and what you can make us do about it.
It is written to be read. If anything here is unclear, that is our problem, and you can tell us at tech@pintarlabs.io.
Contents
- The short version
- Who we are
- What we collect, why, and for how long
- Information about other people
- Artificial intelligence
- Who else sees your data
- Cookies and storage on your device
- The browser extension
- How long we keep things, and what deletion actually does
- Your rights
- Automated scoring
- Security
- Where your data is held
- Children
- Marketing
- Changes to this policy
- How to contact us
1. The short version
| What we collect | Why | Lawful basis (UK/EU) | How long |
|---|---|---|---|
| Your name, email, password | To make and secure your account | Performance of a contract | Until you delete your account |
| Your resume, work history, education, skills | It is the product. We cannot tailor a resume we do not have | Performance of a contract | Until you delete it, or your account |
| Career Profile, including optional date of birth and address | A durable record you reuse across documents | Performance of a contract | Until you delete it, or your account |
| Jobs you save, track, apply to, and your notes on them | To run your job tracker | Performance of a contract | Until you delete them, or your account |
| Contacts you add | To keep your networking in one place | Performance of a contract | Until you delete them, or your account |
| IP address and device description for signed-in sessions | So you can see and revoke your own logins | Legitimate interests (account security) | 7 days, or until you revoke the session |
| IP address, transiently, for rate limiting | To stop abuse | Legitimate interests (service integrity) | Not stored |
| Support messages you send us | To answer you | Legitimate interests (support) | Until resolved and no longer needed |
We do not use analytics, advertising pixels, session replay, or third party trackers of any kind. We do not sell your data. We do not share it with employers or recruiters. We do not use your data to train AI models.
2. Who we are
Hike ("Hike", "the Service") is operated by Muhammad Zohaib Ashraf, a sole trader trading as Hike ("we", "us", "our"), based in Karachi, Pakistan and contactable at tech@pintarlabs.io.
We are the controller of the personal data described in this policy.
Hike is the product; the name above is the person behind it. When this policy says "we", it means that person.
Polar sells paid plans, not us. When you buy a paid plan, Polar Software, Inc. sells it to you as the merchant of record and takes the payment through its own payment processor. Your card details are entered there and never reach us — we do not receive them, hold them, or have any way to see them. What Polar does with that data is governed by their privacy policy, not by this one. See section 6.
3. What we collect, why, and for how long
3.1 When you create an account
Your name, email address, and a password (which we store only as a bcrypt hash, never as text you or we could read). If you sign in with Google or LinkedIn instead, we receive your name, email address, and profile picture from them, and nothing else. We do not request access to your Gmail, your calendar, your files, or your LinkedIn connections, and we could not read them if we wanted to.
We send a six digit code to your email address and require it before your account becomes usable. This confirms the address is real and reachable.
3.2 When you onboard
What you are looking for, the role and seniority you are targeting, and the challenges you picked. If you upload a resume, we keep the file name and the text extracted from it.
3.3 Your Career Profile
Your name, headline, email, phone, location, and, if you choose to fill them in, your date of birth and postal address. Both of those are optional and neither is required to use Hike. We keep them because the Career Profile is a durable record you build once and reuse, and because in some countries a CV is conventionally expected to include them. Nothing is added to a document unless you put it there.
Also: your summary, links, skills, work experience, education, certifications, languages, and any extra sections you add.
3.4 Your documents
Master resumes, role specific resumes, job specific resumes, and cover letters, including everything in them and how you have styled them.
3.5 Your job search
Jobs you save, pass on, or track; their descriptions; the stage each one is at; your private notes; tasks; documents you attach; and the contacts and companies you record.
3.6 Automatically, when you use Hike
We collect very little here, and we want to be specific about it.
Our application logs record the request method, the URL path, and a request ID. They do not record your IP address, your request bodies, your resume text, or your authentication headers.
We do store your IP address and a description of your browser and operating system against each signed in session, so that the "Active sessions" screen can show you where you are logged in and let you sign devices out. Those records expire after seven days, or immediately when you revoke the session.
We also use your IP address transiently, in memory, to apply rate limits. It is not written anywhere.
4. Information about other people
Some of what you put into Hike is about someone else. We treat that carefully.
Contacts. When you add a recruiter or a colleague, we store what you typed: their name, title, company, and any email address, phone number, or LinkedIn URL you chose to record. This is your address book. We do not contact these people, and we do not add them to anything.
Referrals. If you invite someone by email, we store the address you typed so we can send that one invitation and attribute the referral. If instead somebody finds you through a shared referral link, we deliberately store no name and no email address for them at all. This is by design: a referral link posted publicly must never turn anyone's Referrals page, or their data export, into a harvested list of strangers' addresses.
Support requests. Anyone can write to us through the logged out support form, including people without an account. We store the address they typed and their message. We never join those records to any account, because there is nothing proving the person who typed an address owns it.
Where UK or EU law applies, our lawful basis for holding information about these third parties is our legitimate interest, and yours, in you being able to run your own job search. If you are one of these people and you would like us to remove your details, write to tech@pintarlabs.io and we will.
5. Artificial intelligence
This is the part of Hike that deserves the most detail, so here is all of it.
5.1 Which AI providers we use
Two, both based in the United States:
- OpenAI, for reading an uploaded resume, analysing how well you match a job, reading a job posting from a screenshot, and drafting answers to application questions.
- Anthropic, for writing cover letters, tailoring a resume to a job, and rewriting individual lines.
5.2 What we actually send them
For most features, we send your name, your professional summary, your skills, your work history, and your education. We do not send your email address, your phone number, your postal address, or your date of birth. That limit is built into the code that assembles these requests.
There is one exception, and it is an important one. When you upload a resume for the first time, we send the whole document's text to OpenAI so it can be read into structured fields. A resume usually contains your contact details, so those are included in that one request. There is no way to parse a document without reading it.
5.3 Retention and training
We use both providers under their standard commercial API terms. Under those terms, content sent through the API is not used to train their models, and is retained only for a limited period for abuse monitoring before being deleted. Their own policies are linked from our subprocessor list.
We do not train any AI model on your data, and we do not permit anyone else to.
5.4 What AI output is worth
Everything Hike generates is a draft. It can be wrong, it can be generic, and it can state things about your experience that are not accurate. Read it before you send it to anybody. Nothing Hike produces is professional, legal, or career advice, and using it is no guarantee of an interview or a job.
6. Who else sees your data
We share personal data with the following service providers, and no one else. Full details are in the subprocessor list.
| Who | What they get | Where |
|---|---|---|
| Amazon Web Services | Hosting, database, and any files you upload | Canada (Montreal, ca-central-1) |
| OpenAI | The AI requests described in section 5 | United States |
| Anthropic | The AI requests described in section 5 | United States |
| Resend | Your email address, to deliver sign in and verification emails | United States |
| Polar | Your email address and the plan you bought, if you buy a paid plan | United States |
| Google, LinkedIn | Only if you choose to sign in with them | United States |
Polar is different from the others in this table. The rest are processors acting on our instructions. Polar is the merchant of record: it sells the plan to you in its own right, and it decides how it handles the payment data it collects rather than doing so on our instructions. Card details are collected by Polar's own payment processor and never reach us. Polar uses that data to take the payment, manage the subscription, issue invoices and refunds, and meet its own tax obligations. See Polar's privacy policy.
We do not share your data with employers, recruiters, job boards, advertisers, or data brokers. Nothing in Hike sends your resume anywhere on your behalf.
We may disclose data if we are legally required to, or to protect someone's safety, and we will tell you unless we are prohibited from doing so.
7. Cookies and storage on your device
Two cookies. That is the entire list.
| Name | What it does | How long |
|---|---|---|
ca_session | Tells the app you are signed in so it knows which page to show. It is not a password and cannot be used to access your account | 7 days |
ca_referral | Remembers which referral link brought you here, so the person who invited you gets credit | 30 days |
We also store your sign in tokens and some preferences in your browser's local storage. Full detail, including every key by name, is in the Cookie Policy.
There are no analytics cookies, no advertising cookies, and no third party cookies at all, which is why you have not been asked to accept any.
8. The browser extension
The Hike browser extension asks permission to run on every website. That warning sounds broader than what it does, so here is what actually happens.
On a normal page, the extension runs a small script that checks the site against your list of hidden sites and asks for the Hike panel to be shown. It does not read the page.
When you open the panel on a job posting, it reads that posting: title, company, location, salary, and the description. That is information about the job, not about you, and it is only sent to us if you save the job.
On LinkedIn, if you use the Profile Optimizer, the extension reads your own profile only, using your existing LinkedIn session, and mostly reads counts rather than content: whether you have a photo, your headline, and how many roles, skills and certifications you have listed. That result never leaves your device. It is stored in the extension and nowhere else. We never read anyone else's profile.
The extension fills application forms. It never submits them. Every field it fills is marked as a draft for you to review. You press the button.
9. How long we keep things, and what deletion actually does
| Data | Kept for |
|---|---|
| Everything in your account | Until you delete it, or until you delete your account |
| A deleted account | 30 days, then permanently erased |
| Sign in sessions | 7 days |
| Sign in and verification codes | 15 minutes |
| Server request logs | A short operational window. They contain no personal data (see 3.6) |
| Database backups | Held on a rolling schedule by our hosting provider. A deletion is complete in the live database immediately, and works its way out of backups as they roll over |
When you delete your account, we immediately mark it deleted and sign you out everywhere. You have 30 days to change your mind. After that, an automated job running once a day permanently deletes your account record, everything connected to it, and every file you uploaded to our storage. This is a real deletion, not a flag.
Two things survive, deliberately and without your identity attached: a support request you sent us stays so we can finish answering it, and if you referred somebody who earned a reward, that record stays so their reward is not reversed.
Anything already sent to an AI provider is subject to their retention, described in section 5.3.
10. Your rights
Wherever you live, you can:
- See your data. Settings → Account and security → Your data downloads everything we hold about you as a structured file. It is generated live from the database, so it is complete by construction.
- Correct it. Every field is editable in the app.
- Delete it. Settings → Account and security → Delete account. See section 9 for exactly what that does.
- Take it elsewhere. The export is machine readable.
- Object or complain. Write to tech@pintarlabs.io.
If you are in the UK or EU, you also have the right to restrict processing, to object to processing based on legitimate interests, and to complain to your data protection authority.
If you are in California, Virginia, Colorado, Connecticut, Texas, or another US state with a privacy law, you have the right to know, delete, correct, and to opt out of sale or sharing. We do not sell or share personal information as those laws define it, and we do not process it for targeted advertising or profiling that produces legal effects. There is nothing to opt out of, but if that ever changes, this policy will change first.
We answer requests within 30 days. We will not charge you or treat you differently for making one.
11. Automated scoring
Hike calculates a few numbers about you: how well your resume matches a job, an ATS score on a tailored resume, and a Career Profile completeness percentage.
These are advisory only. They are shown to you, they are not shown to employers, and nothing about your account, your price, or your access depends on them. No decision with a legal or similarly significant effect is made about you automatically.
12. Security
We use HTTPS everywhere. Passwords are hashed with bcrypt. Sign in tokens, password reset codes and download tickets are stored only as hashes, so reading our database does not yield anything usable. Signing out revokes access immediately rather than waiting for a token to expire. We rate limit by IP address, and we block requests that try to make our server fetch internal addresses.
More detail is in our Security page.
No system is perfectly secure. If you find a vulnerability, please tell us at tech@pintarlabs.io before telling anyone else.
13. Where your data is held
Your account, your documents and your uploaded files are stored in Canada. Our servers, database and file storage are hosted by Amazon Web Services in their Montreal region (ca-central-1).
This means that if you are in the United States, Pakistan, or anywhere else, your data is held in Canada rather than in your own country. Canada has a national privacy law (PIPEDA) that applies to how it is handled there.
Some processing happens elsewhere. Our AI providers (OpenAI and Anthropic) and our email provider (Resend) operate in the United States, so the specific data described in section 5 and your email address are sent there.
Hike is offered primarily to people in the United States and Pakistan. If you use it from the UK or EU, your data leaves your region as described above; we are not currently established there and do not target those markets.
14. Children
Hike is for people aged 18 and over. It is not designed for children, we do not knowingly collect data from anyone under 18, and you may not use Hike if you are younger than that.
If we learn that we hold data about someone under 18, we delete it. If you believe a child has given us information, write to tech@pintarlabs.io.
15. Marketing
We currently send only the emails you need in order to use Hike: verification codes, password resets, and referral invitations you asked us to send.
We do not send marketing email. If we ever start, we will ask you first, and every message will carry a working unsubscribe link that we honour promptly.
16. Changes to this policy
We will update this policy as Hike changes. The version number and date at the top always tell you which version you are reading.
If we make a change that materially affects your rights or what we do with your data, we will tell you by email and in the app at least 30 days before it takes effect, so that you can object, export your data, or close your account first. Minor corrections take effect when published.
17. How to contact us
Privacy and data requests: tech@pintarlabs.io Security issues: tech@pintarlabs.io Place of business: Karachi, Pakistan
We publish the city rather than a street address, because Hike is run by one person and that address is a home. Email reaches us faster in any case, and we answer every request that arrives there. If you need a postal address for a formal notice, ask and we will give you one.