Privacy Policy
WhalePrep
Last Updated: June 29, 2026
1. Introduction
Welcome to WhalePrep (“we,” “our,” or “us”). This Privacy Policy explains how we collect, use, disclose, and protect your personal information when you use our mobile application WhalePrep (the “App”).
By downloading, installing, or using the App, you agree to the collection and use of information in accordance with this Privacy Policy. If you do not agree with our policies and practices, do not use the App.
2. Information We Collect
2.1 Account Information
When you create an account, we collect:
- Email address
- Full name
- Password (stored only as a secure hash; we never store or have access to your plaintext password)
- Authentication method (email, Google, or Apple sign-in)
If you sign in via Google or Apple, we receive your name and a unique identifier from the respective service. We do not receive your Google or Apple password.
2.2 Profile Information
During onboarding and app usage, you may provide:
- Professional role (e.g., Data Analyst, QA Engineer, Product Manager)
- Proficiency level (e.g., Junior, Middle, Senior)
- Profile photo (optional)
2.3 Resume / CV Data
You may optionally upload your resume or CV (PDF or DOCX format) to enable personalized interview practice. We extract the text content from your file and store it on our servers. The original binary file is not retained. The extracted text is sent to OpenAI’s API for analysis to generate a structured summary of your skills, experience, and achievements. This summary is then used to create personalized interview questions tailored to your background. You may store up to 5 resumes per account.
2.4 Audio Recordings and Transcripts
During interview practice sessions, the App records your voice responses using your device’s microphone. This audio is:
- Stored locally on your device in the app’s private storage
- Transcribed to text (using on-device speech recognition — Apple Speech Recognition on iOS or Android’s on-device speech recognizer — when available, or server-side transcription via OpenAI Whisper API)
- Uploaded to our servers for AI-powered analysis of your answers
Audio recordings are not stored on our servers. The uploaded audio is processed through OpenAI Whisper for transcription and then immediately discarded. Only the resulting text transcripts and analysis scores are stored on our servers linked to your account.
Recordings on your device are automatically deleted after 30 days of not being accessed (e.g., played back). If you listen to a recording, its retention period resets. All recordings and associated metadata are deleted when you log out or delete your account.
2.5 Interview Performance Data
For each practice session, we collect and store:
- Questions asked
- Your transcribed answers
- Performance scores (overall and per dimension: fluency, grammar, vocabulary, coherence, pronunciation)
- AI-generated feedback and improvement tips
- Session timestamps
2.6 Job Vacancy Data
If you use the custom interview feature, you may provide:
- Job posting links (URLs) or job description text
We analyze this content using AI to generate relevant interview questions. The extracted job details (title, company, key focus areas) are stored linked to your account.
2.7 Subscription and Purchase Information
We use Apple’s StoreKit (on iOS) and Google Play Billing (on Android) for in-app purchases. We do not collect or store your payment card information. Apple or Google handles all payment processing. We only receive:
- Subscription status (active, trial, expired)
- Plan type (monthly, quarterly, yearly)
- Transaction confirmation
2.8 Device and Technical Information
We collect limited device information for technical support purposes:
- Device model
- Operating system and version (iOS or Android)
- App version and build number
This information is collected only when you submit a support ticket.
2.9 Usage and Analytics Data
We use Mixpanel, a third-party analytics service, to understand how users interact with the App. We track:
- Screen views and navigation patterns
- Feature usage (interviews started, completed, abandoned)
- Onboarding progress
- Subscription-related events (paywall views, purchases, renewals, cancellations)
- Permission grant/denial (microphone, speech recognition, notifications)
Analytics events are linked to your user ID to provide aggregated insights. We do not sell analytics data to third parties.
2.10 Support Information
When you submit a support ticket, we collect:
- Your message topic and description
- Device and app version information
- Optionally, recent error information to help diagnose issues
2.11 Push Notification Data
If you grant notification permissions, we collect and store:
- Notification preferences (stored on your device)
- Last app open date (to schedule relevant reminders)
- A device push token, stored on our servers so we can deliver reminders and other notifications to your device
We deliver notifications in two ways: local notifications scheduled on your device, and remote push notifications sent from our servers through Firebase Cloud Messaging (FCM). On iOS, FCM delivers through the Apple Push Notification service (APNs). Your push token is used solely to deliver notifications to you; it is not used for advertising and is deleted when you log out or delete your account.
3. How We Use Your Information
We use the collected information for the following purposes:
| Purpose | Data Used |
|---|
| Provide interview practice sessions | Audio recordings, transcripts, profile data |
| Generate personalized questions | Resume/CV data, role, level, job vacancy data |
| Analyze and score your answers | Transcripts, audio files |
| Display your progress and statistics | Interview scores, history, timestamps |
| Manage your account | Email, name, authentication tokens |
| Process subscriptions | Subscription status from Apple |
| Send practice reminders | Notification preferences, last open date |
| Improve the App | Aggregated analytics data |
| Provide technical support | Device info, support ticket content |
| Prevent fraud and abuse | Authentication tokens, account activity |
4. Third-Party Services
We share data with the following third-party service providers, solely for the purposes described:
4.1 OpenAI
- Data shared: Your audio recordings (for transcription only — not retained by our servers), transcribed answers, interview questions, extracted resume/CV text, and job vacancy descriptions
- Purpose: Speech-to-text transcription (Whisper API); AI-powered answer analysis, scoring, and feedback generation; resume analysis and personalized question generation; job posting analysis for custom interview preparation
- Privacy Policy: https://openai.com/privacy
4.2 ElevenLabs
4.3 Microsoft Azure Speech Services
4.4 SendGrid (Twilio)
4.5 Mixpanel
4.6 Google Sign-In
4.7 Apple
- Data shared: Authentication tokens (Sign in with Apple), purchase transactions (StoreKit), subscription status notifications (App Store Server Notifications), device push token (Apple Push Notification service)
- Purpose: Account authentication, subscription management, push notification delivery on iOS
- Privacy Policy: https://www.apple.com/legal/privacy
4.8 Google Play Billing
- Data shared: Purchase transactions and subscription status (via Google Play Billing and Real-time Developer Notifications)
- Purpose: In-app purchases and subscription management on Android
- Privacy Policy: https://policies.google.com/privacy
4.9 Firebase Cloud Messaging (Google)
- Data shared: Device push token and notification payloads
- Purpose: Delivery of remote push notifications (reminders and service messages) on iOS and Android
- Privacy Policy: https://firebase.google.com/support/privacy
We do not sell your personal information to any third party.
5. Data Storage and Security
5.1 Where Your Data Is Stored
- On your device: Audio recordings (auto-deleted after 30 days of inactivity), personal information and authentication tokens (encrypted in the iOS Keychain on iOS, or in the Android Keystore / encrypted storage on Android), profile photo (encrypted with platform data-protection), app preferences
- On our servers: Account information, interview attempts, transcripts, scores, extracted resume text, job vacancies, support tickets, subscription event history
5.2 Security Measures
We implement appropriate technical and organizational measures to protect your data:
- Passwords are hashed using bcrypt before storage
- Personal information (name, email) and authentication tokens are stored in the iOS Keychain on iOS and in the Android Keystore / encrypted storage on Android (hardware-backed where available)
- Profile photos are stored with platform data-protection encryption
- All data transmission uses HTTPS/TLS encryption
- Refresh tokens are stored as SHA-256 hashes on our servers
- Access tokens expire after a short period and are automatically refreshed
- All API endpoints that access personal data require user authentication via Bearer token
- App Store Server Notifications (iOS) are cryptographically verified using Apple’s root certificates, and Google Play Real-time Developer Notifications (Android) are verified, before processing
- Rate limiting is applied to prevent abuse (see Section 5.4)
5.3 Data Retention
We retain your data for as long as your account is active. Audio recordings on your device are automatically deleted after 30 days of inactivity. Password reset codes expire after 10 minutes.
When you delete your account:
- Your personal information (name, email, profile) is permanently deleted
- Your interview history, transcripts, and scores are permanently deleted
- Your uploaded resumes and extracted text are permanently deleted
- Your job vacancies and associated questions are permanently deleted
- Audio recordings and tracking metadata are deleted from your device
- Support tickets are retained in anonymized form for analytics — your email is replaced with an anonymous identifier and your user ID is removed. Ticket content (topic, message) is preserved but can no longer be linked to your identity.
- Account deletion feedback (if provided) is retained in anonymized form for product improvement
5.4 Rate Limiting
To protect our service and prevent abuse, we apply rate limits to API requests. Limits are applied per authenticated user. If you exceed a rate limit, you will receive a temporary error and can retry after a short wait. Rate limits do not result in account suspension or data loss.
6. Your Rights and Choices
6.1 Access and Control
You can:
- View your profile information and interview history within the App
- Update your profile, role, and level at any time
- Delete individual interview attempts from your history
- Delete your account entirely from the Profile settings
6.2 Account Deletion
You can delete your account at any time through the App (Profile > Delete Account). This will permanently remove your personal data from our servers as described in Section 5.3.
6.3 Permissions
You can revoke the following permissions at any time through your device’s Settings:
- Microphone access — required for interview practice
- Speech recognition — required for real-time transcription
- Notifications — optional practice reminders
6.4 Analytics Opt-Out
Mixpanel respects your device’s ad-tracking / personalization limits (such as “Limit Ad Tracking” on iOS or opting out of Ads Personalization on Android). You may also contact us to request removal of your analytics data.
7. Rights for Users in the European Economic Area (GDPR)
If you are located in the European Economic Area (EEA), you have additional rights under the General Data Protection Regulation (GDPR):
- Right of access — request a copy of your personal data
- Right to rectification — request correction of inaccurate data
- Right to erasure — request deletion of your data
- Right to restriction — request limitation of processing
- Right to data portability — receive your data in a structured format
- Right to object — object to processing based on legitimate interests
- Right to withdraw consent — withdraw consent at any time
Legal basis for processing:
| Processing Activity | Legal Basis |
|---|
| Account creation and management | Performance of contract |
| Interview practice and analysis | Performance of contract |
| Subscription management | Performance of contract |
| Analytics and product improvement | Legitimate interest |
| Push notifications | Consent |
| Resume processing | Consent |
To exercise any of these rights, contact us at the email address provided in Section 11.
8. Rights for California Residents (CCPA)
If you are a California resident, you have the right to:
- Know what personal information we collect and how it is used
- Delete your personal information
- Opt-out of the sale of personal information (we do not sell personal information)
- Non-discrimination for exercising your privacy rights
To exercise these rights, contact us at the email address provided in Section 11.
9. Children’s Privacy
The App is not intended for children under the age of 13 (or under 16 in the EEA). We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us and we will promptly delete it.
10. Changes to This Privacy Policy
We may update this Privacy Policy from time to time. We will notify you of material changes by:
- Posting the updated policy within the App
- Updating the “Last Updated” date at the top of this document
Your continued use of the App after changes are posted constitutes your acceptance of the revised Privacy Policy.
11. Contact Us
If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at:
Email: whaleprep.app@proton.me
12. Apple App Store Disclosure
In accordance with Apple’s App Store requirements, the following data types are collected by this App:
Data Linked to You:
- Contact Info (email address, name)
- Photos or Videos (profile photo)
- Audio Data (interview voice recordings)
- Other User Content (interview transcripts, resumes, job vacancy data)
- Customer Support (support ticket content)
- Identifiers (user ID)
- Purchases (subscription history)
- Usage Data (product interaction, analytics events)
Data Not Linked to You:
We do not collect any data that is not linked to your identity.
Data Used for Tracking:
We do not use your data for tracking. We use Mixpanel for first-party analytics only. No data is shared with third-party advertisers or data brokers. The App does not use an advertising identifier.
13. Google Play Data Safety Disclosure
For our Android app, the equivalent disclosure is provided through the Google Play “Data safety” section on our Play Store listing. Consistent with the practices described above, the App collects the data types listed in Section 12 to operate the service, encrypts data in transit, does not use an advertising identifier, and does not share or sell personal data with third-party advertisers or data brokers. You can request deletion of your data in-app (Profile > Delete Account) or by contacting us.