Privacy Policy

Last updated: October 27, 2026.

Hmmlo is an app for practicing job interviews with AI interviewers, for iPhone, iPad, Android and the web at https://hmmlo.app. It is made by PALMS STUDIO LLC ("we", "us"), which is responsible for the personal data described here. Questions: hmmlo@palmstudio.app.

The short version

• In the phone apps, you don't need an account. On the website, you connect an account after payment to keep access. Your résumé, your interviews, your recordings and your notes are kept on your device. If you sign in, a copy of your résumé, your interview reports, your talking points and your settings is also kept with your account, so they're on every device you sign in on; you can turn this off. Your videos and recordings are never uploaded.
• Your camera video never leaves your device, including the few-second test call during setup. Your face is measured on the device, and only a few summary numbers (such as how much of the time you looked at the camera) go with your answers and are saved in their report.
• To run an interview, your voice, your answers and your résumé are processed by OpenAI on our behalf, only after you agree to it in the app. Under OpenAI's API terms, it is not used to train their models.
• Purchases go through Apple or Google in the app, and through Stripe on our website. RevenueCat tells us what you've bought, under a random App ID or your account ID, not your name. We never see your full card details.
• We don't show ads, the apps don't track you across other companies' apps or websites and contain no analytics or advertising tools, and we never sell your data or share it with employers.
• On our website only, and only if you accept cookies there, Google Analytics and LinkedIn's Insight Tag measure how people find and use the site and how our ads perform.
• You can have everything we keep about you deleted at any time.

What we process, and why

The first time you add a résumé or start an interview, before anything of yours is sent to OpenAI, the app tells you what is sent and asks you to agree. If you choose Not now, nothing is sent.

Your résumé

When you add a résumé (a file, or a photo of one), it is sent to our server and to OpenAI to read your role, level and experience and to plan your interview. It is kept on your device, with what was read from it and your interview plan, so you don't have to add it again. If you're signed in, the file, what was read from it and your plan are also kept with your account (see Account sync below). Otherwise we don't keep the file on our servers.

A job posting or a company

If you add a job posting, a link to one, or a company to research, it is sent to our server and to OpenAI to tailor your interview. For a link, our server fetches that public page. To research a company, or pay figures for a salary talk, OpenAI searches the web.

Your voice and your interviews

• The live interview. During an interview your device connects directly to OpenAI's realtime voice service, so the AI interviewer can hear you and answer; OpenAI also writes out what you say as you speak. Our server only opens the call, with a key that expires within minutes, and gives the interviewer your role, your questions and the country you're interviewing in.
• Each answer. The audio of each answer is also sent to our server and to OpenAI to write it out word for word. We don't keep the audio on our servers.
• Your analyses. Each transcript is sent to OpenAI with its question, your role and a few measures of your delivery (speaking pace, filler words, long pauses and the camera numbers below) to write notes and a score for the answer, and then the coach's debrief. The coach's spoken notes are made from their text by OpenAI's text-to-speech. A thank-you email, if you ask for one, is drafted the same way.
• Transcripts, notes, scores and debriefs are stored on your device. If you're signed in, each interview's report (its questions, transcripts, notes, scores and debrief) is also kept with your account (see Account sync below); the audio and video never are.

Your camera

Your video is recorded on your device so you can watch your answers back, and it stays there; the app keeps the videos of your most recent interviews and removes older ones. While you talk, how you look at the screen, smile and hold your head is measured on your device. Camera frames, video and face measurements never leave your device. Only summary numbers for each answer (the share of time you looked at the camera, how often you smiled, how steady you held your head) are sent with that answer for its notes, and saved in its report (with your account too, if you're signed in). They describe behavior, never emotions, and can't be used to identify you.

The test call. During setup, the app may ask for your camera for a 3-second test call that checks your camera and your light; you can skip it. About 4 seconds of video, without sound, is recorded and kept on your device. It is played back, muted, on the purchase screen, and deleted once you subscribe. It is never uploaded.

Your answers to our first questions

Your field and level, where you are in the process, what worries you most, and when your interview is or how often you want to practice are kept on your device. The field, level, stage, worry and roughly when your interview is are sent with your requests, so the interview and the coaching fit you. The exact day of your interview and your weekly goal are not sent with your requests. If you're signed in, these answers (including the exact day and your weekly goal), your interview language, your country and the camera-cues switch are also kept with your account, so your other devices know them.

Purchases and your App ID

When the app first starts, RevenueCat, our purchase service, gives it a random App ID. You can see it at the bottom of the app's menu. Your purchases and subscription status are linked to that App ID, not to your name:

• Apple or Google tells RevenueCat what you bought. We never see your payment details.
• On our website, Firebase creates a temporary guest account when you first arrive. You can complete payment without choosing a sign-in method. Stripe takes the payment through RevenueCat Web Billing, and RevenueCat links it to that guest account ID. After payment, you connect Google, Apple or email to keep access. Linking a new account preserves that ID; moving a purchase to an existing account requires authentication and server verification. We keep the purchase and claim record while this is completed. If you lose browser access before connecting an account, contact support with your receipt; a payment is never established from an email address alone. Stripe receives your card details, your email address and your billing country and postal code, and uses them to take the payment, send your receipt, calculate tax and prevent fraud. We see the purchase, its amount and the last digits of the card, never the full card number.
• Our server asks RevenueCat whether your subscription is active and which extras you bought.
• Our server records how much of your allowance you've used (interview minutes each day, and extra interviews used) under a scrambled form of your App ID, in Google Firebase. The record holds no name, email or content; interviews appear only as random IDs. To know when your day starts, the app sends your time zone.
• If you buy talking points for a résumé, our server records which résumé that purchase opened, under a scrambled form of your App ID or account ID, in Google Firebase. The résumé is recorded only as codes worked out from its file (one-way fingerprints): they can't be turned back into the file or anything in it. This is what lets a purchase open on your other devices, when you sign in there and add the same résumé file. The talking points themselves, and your practice of them, stay on the device that made them, unless you're signed in: then they're also kept with your account (see Account sync below), without the coach's recorded voice.

An account, if you want one

In the phone apps, you don't need an account. On the website, a temporary guest account secures checkout and a connected account is required after payment. If you sign in with Apple, Google or an email address (for example, to use your subscription on another device), we receive an account ID and, if you allow it, your email address and name. With Apple you can hide your real address. Your App ID then becomes your account ID, so your purchases follow you. Accounts are run on Google Firebase, where we keep an account record and a count of your interviews, and, unless you turn it off, the synced copy of your practice described next.

Account sync

If you're signed in with Apple, Google or an email address, Hmmlo keeps a copy of your practice with your account, so it's on every iPhone, iPad, Android device and browser you sign in on. This is on by default when you sign in. If you haven't signed in, or you use the website as a guest, everything stays on your device as before.

• What is kept: your résumé file (as you added it: PDF, Word, text or photo), what was read from it (such as your name, role, level, experience and skills) and the plan made for it (stage, language, any job posting or company you added, keywords); each interview's report (the questions, the transcript of each answer, the delivery and camera summary numbers measured on your device, the scores, the coach's notes and summary); your talking points and your last "Now you say it" result for each question; and your settings (your answers to our first questions, including the day of your interview and your weekly goal, when you gave them, your interview language, your country and the camera-cues switch).
• What is never uploaded: the video and audio of your answers, the test call's video, the coach's recorded voice clips, and an interview while it is still in progress. They stay on the device that recorded them.
• Why: so your résumé, reports, talking points, rehearsal results and settings are on every device you sign in on, and you don't have to add your résumé again.
• Where: in Google Firebase's database (Google Cloud Firestore), in the europe-west3 region (Frankfurt, Germany). The résumé file is stored there too; there is no public link to it or to anything else.
• Security: encrypted in transit, and encrypted at rest by Google. Apps and browsers can't reach this data directly; only our server can, and only for the account that is signed in, after checking that account's sign-in token.
• How long: until you delete it. When you delete a report, a résumé or a set of talking points, it is deleted from your account too, and your other devices remove it.
• Turning it off: in the app, open the menu, then Privacy & data, and turn on Keep my practice on this device only. This deletes the copy kept with your account at once; each of your devices keeps what it already has and stops syncing. Turning it off again sends what the device has.
• Deleting it: delete an item, use Delete all my practice in Your progress (this deletes it from this device and your account), turn on the switch above, or delete your account. Each deletes the copy in our database at once. Google completes deletion from its own systems on its own schedule.

Anonymous analytics

• Onboarding steps. While you go through the first questions, we record which screens were shown and which listed option you picked on each (never a date or anything you type), with your platform and the app's language. They are kept under a random ID made for that one run, not linked to your device, your App ID, your account or you. We use them only to see where the first steps are unclear.
• "Where did you hear about us?" If you answer this once-only question, we store the answer on its own, with no identifier.
• Usage counts. For each request we record which feature was used and how much processing it took (for example tokens or seconds of audio), with a scrambled install ID and the interview's random ID, so we know what the service costs. No content is recorded.

Technical data

When the app talks to our server, our host receives your IP address and basic request details, which we use to deliver the service and keep it secure. To stop abuse, we count requests per day under a scrambled form of your App ID, account ID or IP address; the counts hold no content, are kept for a limited time and are removed in routine cleanup, at most 90 days after the day they count. With requests to OpenAI we send a scrambled install ID, so OpenAI can detect abuse; it doesn't identify you. The app also asks our server for updates to the app, sending only its version numbers and platform.

Notifications

If you allow them, the app schedules its notifications on your device: practice reminders, tips and offers, and daily tips if you turn those on. Reminders to subscribe stop for good once you subscribe. They aren't sent from our server, and nothing about them is sent to us. Turn them off anytime in the app or in your device's settings.

Our website: optional analytics and advertising measurement

Our website (the front page at https://hmmlo.app and the web version of Hmmlo at https://hmmlo.app/app) uses necessary browser storage to restore your guest account, purchase and account-connection progress. Declining optional measurement does not erase or prevent your purchase or account access.

We also keep daily totals of page views, onboarding steps and checkout/account-connection actions, including visits that decline optional measurement. These counters use no analytics cookies, account or session IDs, advertising click IDs, campaign tags, IP addresses, device fingerprints or free text. The counter endpoint immediately increments a daily total; it does not store an individual event or connect visits. It cannot tell us who visited, how many unique people visited, or which individual dropped out. These totals are not sent to Google, LinkedIn or Meta. Hosting services may separately process technical request information to deliver and secure the website, as described below.

The website asks whether you allow Google Analytics, the LinkedIn Insight Tag and, when configured, Meta Pixel and Conversions API, with Accept and Decline as equal choices. Advertising scripts do not load before you answer or if you decline. Adding Meta requires a new acceptance from visitors who previously accepted only Google and LinkedIn. Only if you accept:

• Google Analytics sets Google Analytics cookies and receives the pages and screens of the website you view, coarse steps such as starting and finishing the first questions, creating an account (only whether it's new and whether it's Apple, Google or email), starting a checkout or a purchase on the website (the plan or extra, the price, the currency and the purchase's reference), and starting or finishing an interview and opening its report, with your browser and device details, your approximate location from your IP address, and the ad campaign tags in the link you came by (such as utm_source, li_fat_id or gclid). It never receives your name, your email address, your account ID, your résumé or anything you say or type. We use it to see how people find and use the website and how our ads perform; Google Signals and ad personalisation are off.
• The LinkedIn Insight Tag sets LinkedIn cookies and sends LinkedIn the page you visited, your browser and device details, your IP address and the time, and, when you create an account or buy on the website, that this happened, so LinkedIn can report how our ads perform and show them to people like you. If you're signed in to LinkedIn, LinkedIn can link the visit to your LinkedIn account; we only ever see totals, never who you are.

• Meta Pixel and Conversions API measure public web page visits, clicking Start, completing onboarding, viewing a plan, starting checkout and a server-verified first paid subscription. Meta may use these events to measure, deliver and improve ads and build advertising audiences. The Pixel sets advertising cookies (`_fbp` and, after an actual Meta ad click, `_fbc`); its requests also expose your IP address and browser information to Meta. Server events use only consented browser/ad-click identifiers, browser user agent, event identifier and time, and for a purchase the plan, amount and currency. We do not send email addresses, account IDs, IP addresses, interview answers, résumé content or recordings through our Conversions API. These identifiers are pseudonymous, not anonymous: Meta may associate them with a Meta account. Automatic advanced matching and automatic form/button-event collection are disabled.

While you accept, the first and latest campaign tags are kept in your browser for up to 30 days, and the checkout source is saved with the purchase. Our web funnel records page visits, step exits, checkout and account-connection events with random event, session and run identifiers and your guest or connected account ID. We use these records to measure campaign and page performance. Advertising event parameters never contain your account ID, email, résumé, answers or video. Our detailed web funnel records have a 90-day retention target; these are separate from purchase records needed to provide the service. Server-confirmed first paid web subscriptions may also be sent to LinkedIn through its Conversions API, using the consented LinkedIn click identifier, transaction event identifier, time, value and currency. Renewals and extras are recorded separately and are not first-purchase advertising conversions. Declining measurement stops these advertising events. Advertising tags are not loaded on the separate account-connection, interview workspace or owner-report pages. None of these website measurement tools runs in the iPhone, iPad or Android apps. You can change your choice anytime with Cookie settings at the bottom of the front page or in the menu of the web version; declining removes accessible analytics and Meta advertising cookies and stops new advertising events. Browser purchase and server purchase events share the same transaction event identifier to prevent double counting. Our server sends only first paid web subscriptions as acquisition conversions; test payments, renewals and extras are excluded.

Our newsletter, if you subscribe

If you subscribe to our interview-tips emails on the website, we keep your email address, your language, the page you subscribed on, when you agreed and which version of the consent wording you agreed to, to send them. We send a confirmation email first and only add you once you confirm. Every email has an unsubscribe link; unsubscribing deletes your address from the list. We never share it with employers or sell it.

Emails to support

Your address and what you write, used only to help you.

Who processes data for us

Each of these providers works on our behalf and gets only what it needs:

• RevenueCat (RevenueCat, Inc., USA) runs purchases and subscriptions, in the app and on our website (RevenueCat Web Billing). It receives your App ID or account ID, your purchase records from Apple, Google or Stripe, your email address for a purchase on our website, and basic device and app details (such as the operating system, the app version, and your store's country and currency).
• OpenAI (OpenAI, USA) provides the AI: the live voice interviewer (Realtime API), the transcription of your answers (Whisper and GPT transcription models), reading your résumé, planning your questions, scoring your answers, the coach's debrief and the thank-you email (GPT models), the coach's voice (text-to-speech), and web research on a company, a role's most-asked questions and pay figures (web search). Under OpenAI's API terms, data sent through the API is not used to train their models. OpenAI may keep it for up to 30 days to detect and prevent abuse, then deletes it, unless the law requires it to keep it longer.
• Stripe (Stripe, Inc., USA, and Stripe Payments Europe, Ltd. for customers in the EEA, UK and Switzerland) processes payments made on our website, through RevenueCat Web Billing. It receives your card details, email address, billing country and postal code, and the purchase. Stripe is also responsible on its own for some of this data, for example to prevent fraud and meet financial rules; see stripe.com/privacy.
• Apple sells and bills subscriptions and extras in the App Store, and runs Sign in with Apple if you use it.
• Google runs Sign in with Google if you use it, and sells and bills purchases in Google Play where Hmmlo is offered there.
• Google Firebase (Google LLC, USA and EU) runs sign-in for accounts, and its database (Google Cloud Firestore, in the europe-west3 region, Frankfurt, Germany) holds the account records, the allowance record for each App ID and, for signed-in people who haven't turned it off, the synced copy of their résumé and practice (see Account sync). Google encrypts it at rest.
• Google Analytics (Google Ireland Limited for visitors in the EEA, UK and Switzerland; Google LLC, USA, elsewhere) measures the use of our website, only if you accept it there, never in the apps. It keeps this data for at most 14 months.
• LinkedIn (LinkedIn Ireland Unlimited Company for visitors in the EEA, UK and Switzerland; LinkedIn Corporation, USA, elsewhere) runs the Insight Tag on our website, only if you accept it there, never in the apps. LinkedIn removes the direct identifiers it receives within 7 days and deletes the rest within 180 days.
• Meta (the applicable Meta Platforms company) provides optional advertising measurement on the website through Meta Pixel and Conversions API. See Meta Privacy Policy for how Meta processes this information. It is never loaded in the phone apps.
• Resend (Plus Five Five, Inc., USA) sends our newsletter emails, including the confirmation email. It receives your email address and the email's content. The subscriber list itself is kept in Google Firebase (above).
• Vercel (Vercel Inc., USA) hosts our website and server. Its storage (Vercel Blob) holds the anonymous usage counts, onboarding steps and survey answers, and the question banks for each role, which contain nothing about you.

Our providers are in the United States, so your data may be processed there. The synced copy of your résumé and practice is stored in the EU (Frankfurt, Germany). Where the law requires it, these transfers are covered by the European Commission's Standard Contractual Clauses or an equivalent safeguard.

Why we may use it

If you're in the European Economic Area or the United Kingdom, we rely on:

• providing the service you asked for (the contract with you): your résumé, your interviews and analyses, your purchases and your account, and keeping your practice with your account when you're signed in;
• our legitimate interests in keeping Hmmlo working, secure, affordable and easy to start: the anonymous analytics, usage counts, technical data and abuse checks;
• your consent for the microphone, the camera, notifications, and Google Analytics, the LinkedIn Insight Tag and Meta advertising measurement on our website, and our newsletter, which you can withdraw at any time in your device's settings (for the website's tools, with Cookie settings on the website; for the newsletter, with the unsubscribe link in any of its emails);
• legal obligations, for the purchase records the law requires.

How long we keep it

• On your device (résumé, interviews, recordings, notes, your first answers and settings): until you delete them or the app. Videos older than your most recent interviews are removed automatically, and the test-call clip is deleted once you subscribe.
• Résumés, job postings and audio sent for a request: not kept on our servers. They are used for the request and then discarded. This is separate from account sync, below.
• The synced copy with your account (résumé file, reports, talking points, rehearsal results and settings, if you're signed in): until you delete the item, use Delete all my practice, turn on Keep my practice on this device only, or delete your account. Each deletes it from our database at once; Google completes deletion from its systems on its own schedule. A deleted item leaves only a marker (its name, the time and "deleted") so your other devices remove it too; markers hold no content and go with your account.
• At OpenAI: up to 30 days, as above.
• The allowance record for your App ID: its day-by-day details are trimmed to the last 14 days each time it is updated. The record itself, with the totals of extras used, is kept while it's needed to count your subscription and extras, and is deleted at the latest 24 months after your last use, or sooner if you delete your account or ask us to delete it.
• Talking-points purchase record (which résumé fingerprints a purchase opened): while you use Hmmlo; deleted with your account, or when you ask us to delete what we keep for your App ID.
• Your account record: until you delete your account.
• Purchase records: RevenueCat keeps them for us while you use Hmmlo. When you delete your account in the app or ask us to delete your data, we delete your customer record at RevenueCat too. Apple, Google and Stripe keep their own records under their own policies; for a purchase on our website, payment records are kept as long as tax and accounting law requires.
• Phone-app usage counts, onboarding steps and survey answers: they hold no content and nothing that identifies you, and we keep them as long as they help us understand costs and improve Hmmlo.
• Web funnel records: contain the pseudonymous identifiers and consented attribution described above. They are separate from phone-app analytics. Purchase and account-connection records are retained for access, support and required accounting; contact us to request deletion of linked web records.
• Daily request counts: a limited time; they are removed in routine cleanup, at most 90 days after the day they count.
• Server logs: a short time set by our host, used for security and fixing problems.
• Newsletter address: until you unsubscribe; unconfirmed sign-ups are deleted after 30 days.
• Support emails: as long as needed to help you; you can ask us to delete them at any time.

Deleting your data

• If you haven't signed in: deleting the app removes everything on your device. To delete what we keep for your App ID (your allowance record, any talking-points purchase record and your customer record at RevenueCat), write to hmmlo@palmstudio.app with your App ID, which is at the bottom of the app's menu (tap it to copy). We'll delete it within 30 days and confirm by email.
• If you have an account: in the app, open the menu, tap Account, then Delete account. This deletes your account and what we keep for it on our servers (the synced copy of your résumé and practice included), your customer record at RevenueCat (for the account and the App IDs the app used on that device), and wipes the app's data on that device. You can also write to hmmlo@palmstudio.app from the address you signed in with, and we'll delete it, with your customer record at RevenueCat, within 30 days and confirm by email.
• Only your synced practice, keeping your account: turn on Keep my practice on this device only in the menu under Privacy & data, or use Delete all my practice in Your progress. Either deletes the copy kept with your account at once.
• Anonymous phone-app usage counts, onboarding steps and survey answers cannot be picked out by account. Web funnel records linked to your account can be located for a deletion request.
• Extras you haven't used are lost when your data is deleted.
• Deleting your data or your account does not cancel a subscription. Cancel it in your App Store or Google Play account settings, or, for one bought on our website, from the website version's menu (Your plan) before you delete your account.

See how to delete your data.

Your rights

Depending on where you live, you have rights over your personal data. Under the GDPR (European Economic Area and United Kingdom) you can ask to see, correct, export or delete it, to restrict how we use it or object to it, and to withdraw a consent you gave. You can also complain to your local data protection authority.

If you live in California, the CCPA gives you the right to know what personal information we collect, use and disclose, and to have it deleted or corrected, without being treated differently for asking. In the last 12 months we have collected identifiers (your App ID, an account ID and email if you sign in, your IP address), purchase records, audio of your voice, professional information and contact details from your résumé, transcripts of your answers, notes and scores about your answers, and usage information, from you and your device, for the purposes above. We don't sell personal information. With your permission, the website shares limited advertising activity with LinkedIn as described above; this may be considered sharing for cross-context behavioral advertising under California law. You can decline or withdraw that permission in Cookie settings. We use sensitive personal information only to provide Hmmlo.

To use any of these rights, write to hmmlo@palmstudio.app. To find your records we may ask for your App ID or the address you signed in with. You can also ask someone to act for you. We'll answer within the time the law gives us: one month under the GDPR, 45 days under the CCPA.

Children

Hmmlo is not meant for anyone under 16, and we don't knowingly collect data from children under 16. If you believe a child has used Hmmlo, write to hmmlo@palmstudio.app and we'll delete their data.

Security

Everything between the app, our server and our providers is encrypted in transit. Our keys stay on our server; the live call uses a key that expires within minutes. Our databases can't be reached from apps directly, only through our server. What's on your device is kept in the app's own storage, so keep your device locked with a passcode. No system is perfectly secure; if a breach affects your data, we'll tell you as the law requires.

Subscriptions and auto-renewal

Interviews in Hmmlo need a subscription. In the app, subscriptions are sold and billed by Apple (or by Google, where Hmmlo is offered in Google Play) and renew automatically unless you cancel at least 24 hours before the current period ends; you can manage or cancel them in your App Store or Google Play account settings. On our website they are billed by us, processed by Stripe, and renew automatically until you cancel, which you can do at any time from the website version's menu (Your plan); you keep access until the end of the period you've paid for. Our Terms of Use (EULA) describe the plans, prices, extras and refunds.

Changes

If we change this policy, we'll update the date at the top, and tell you in the app if the change matters.

Contact

PALMS STUDIO LLC · hmmlo@palmstudio.app