Privacy Policy
What we collect, why, and who ever sees it.
This document describes what the system genuinely does, and it is awaiting formal legal review.
This policy explains how IncognitoH handles personal data. The short version: we collect what the service needs to work, we separate the parts that identify you from the parts that make you findable, and we do not disclose your identity to anyone without you approving that specific disclosure.
What we collect
- Account data — the email address or phone number you register with, and your role. Passwords are handled by our identity provider and are never stored by us in a recoverable form.
- Identity data — your name and contact details, your LinkedIn profile, your employment history, and the original resume file you upload.
- Profile data — location, work authorisation and visa status, years of experience, job status, salary expectations, target roles, your profile summary, and the professional detail you add for recruiters.
- Community content — posts, comments, photos, reactions and follows, attached to your posting alias or, where you chose it, to your real name.
- Invitation data — the email addresses you enter to invite someone, and whether an invitation was opened or led to a sign-up.
- Challenge data — your answers, scores and leaderboard position, recorded against your posting alias.
- Usage data — sign-in events, connection requests and outcomes, messages sent through a connection, and, for recruiter accounts, the credit ledger showing what was spent and on what.
- Technical data — IP address, browser type, and an approximate location derived from your connection, used for security and to set sensible defaults.
Why we use it
- To operate your account and keep it secure.
- To make your profile findable by recruiters, without identifying you.
- To generate profile summaries and rank you against roles.
- To pass on the specific details you choose to release.
- To run the community feed, and to check content before it is published.
- To send the invitations you ask us to send, on your behalf.
- To detect and investigate abuse of the service.
- To meet legal obligations.
How your identity is kept separate
Identity data is stored apart from searchable profile data, under separate encryption, and the services that serve recruiter search hold no permission to read it. Resume text is redacted before it is analysed or summarised, so identifying details do not enter the searchable data in the first place. Your posting alias is stored so that it cannot be joined to your profile. This is described in more detail on the anonymity page.
When someone invites you
If a member invites you, we receive the email address they entered and send one invitation, plus at most a small number of reminders if they ask us to resend. We use that address for nothing else, we do not add it to any marketing list, and we do not sell or share it. Reply to the invitation or write to privacy@incognitoh.com and we will delete the address and stop any further mail. Otherwise it is removed once the invitation has run its course.
Who we share it with
We do not sell personal data, and we do not share it for advertising.
- Recruiters — only the fields you explicitly release, only to the recruiter you released them to.
- Other members — anything you publish in the feed, and your alias and score on a challenge leaderboard.
- Service providers — cloud hosting, identity management, and email delivery, acting on our instructions and bound to protect it.
- Authorities — where we are legally required to, and where we can, after telling you.
AI processing
Profile summaries, role extraction, interview preparation, news summaries and the automated content checks on the feed all use models running inside our own cloud account. Your resume is not sent to a third-party AI service and is not used to train any publicly available model.
How long we keep it
Profile and identity data are kept while your account is active. Deleting your candidature removes them, along with your uploaded file. Posts and comments stay published until you delete them, because they are not part of the profile being removed. News stories are removed after a week and notifications after ninety days. Limited records may be retained where we are required to keep them, such as security logs.
Your rights
You can access, correct, export, or delete your data, and object to or restrict some processing. Most of this you can do yourself from your profile and Settings; for anything else, contact privacy@incognitoh.com. See "Your data and your rights" for the detail.
International transfers
Our infrastructure is hosted in the United States. If you are elsewhere, your data is transferred and processed there under appropriate safeguards.
Changes and contact
We will post any update here and, where the change is significant, tell you directly. Questions go to privacy@incognitoh.com.