Privacy Policy

1. Who we are

QA Hunt ("QA Hunt", "we", "us") is a job portal for software testing professionals, operated from India and available as the Android app com.qahunt.app and the website qahunt.com. This policy explains what personal data we collect when you use QA Hunt, why, and what you can do about it.

QA Hunt is a candidate-only service: it helps you find and apply to QA, software testing, SDET and related jobs. We do not sell personal data. To advertise QA Hunt itself on Facebook and Instagram, we measure visits and app activity with Meta's tools (the Meta Pixel on the website and the Meta SDK in the app, see "Ads measurement" below); we do not show other companies' ads.

2. Data we collect

We only collect data that you give us or that is needed to run the service.

Category	What	When
Account	Your name, e-mail address, mobile number, the sign-in method you chose and, for Google sign-in, the account identifier Google gives us. Passwords (e-mail sign-in) are stored only as a salted bcrypt hash.	When you create an account or verify an e-mail / phone number
Verification	One-time codes we send and whether they were used, plus the time and channel (WhatsApp or e-mail).	During sign-in and verification
Profile	Everything you enter in your profile: headline, summary, key skills, IT skills, employment history, projects, education, certifications, resume details (file name and text you provide), your profile photo (if you add one: we keep only a 512-pixel square copy, with the photo's hidden details such as location and camera removed), career preferences (roles, cities, salary, shift, job and employment types), basic details (experience, location, salary, notice period), online profile link, personal details (such as date of birth, category, work permit, address, disability status, career break) and languages.	When you edit your profile. All of these are optional; a new account starts empty.
Activity	Jobs you apply to (with any cover note), jobs you save, the status an employer sets on your application, and your profile completion score.	When you use the app
App install	A random installation identifier and secret created by the app on first launch (not a hardware or advertising identifier), the app version, the Android version (API level), when the installation first and last checked in with our server, and — once you sign in — which account uses it. From app version 1.5.8, also the Firebase Cloud Messaging token of the installation (used for the silent check in section 3 and, only if you turn notifications on, for the notifications described there).	Automatically: a check-in when the app starts and about once a day in the background while it is installed
App usage & crashes	From app version 1.5.8, unless you turn it off in Settings: which screens you open and a few actions (for example signing up — the method only —, applying to or saving a job, saving a profile section), with the app version, Android version, phone model, language and an approximate location (country, region and city, which Google infers from your IP address; the IP address itself is not stored by Google Analytics), linked to a random app-instance identifier created by Google's Firebase Analytics. If the app crashes, Firebase Crashlytics records the technical crash report (the code location of the error, app and Android version, phone model, free memory and storage). No name, e-mail, phone number, resume or profile text, job contact details or account identifier is ever sent with these events.	Automatically while you use the app (you can switch it off)
Ads measurement (app)	From app version 1.7.4, unless you turn off "Share usage statistics, crash reports and ads measurement" in Settings: Meta's SDK (App Events) records that the app was installed and opened, a completed sign-up (only the method: phone, Google or e-mail), a job page opened and a successful application (only the job's number), with your device's advertising ID, app and Android version and device model. No name, e-mail address, phone number, resume or profile text is sent to Meta. QA Hunt uses it to measure and target its own ads on Facebook and Instagram. You can also reset or delete the advertising ID in your phone's settings (Google → Ads).	While you use the app (you can switch it off)
Website visits	On qahunt.com, Google Analytics 4 records the pages you view, where you came from, clicks on the Google Play and contact links (only where on the page you clicked), your browser and device type and an approximate location (country, region and city inferred from your IP address, which Google Analytics does not store), using first-party cookies (_ga). The Meta Pixel records the same page views and link clicks with Meta's cookie (_fbp), so that QA Hunt can show its own ads on Facebook and Instagram to people who have visited qahunt.com; no name, e-mail address or phone number is sent to Meta. Neither is loaded if your browser sends a "Do Not Track" or Global Privacy Control signal, and neither runs on the interview room, the recruiter / admin panels or in the app.	When you visit the website
AI screening interview	Only if a recruiter invites you and you agree to the consent shown before the microphone starts: your voice goes from your browser straight to OpenAI, which runs the AI interviewer for the conversation (QA Hunt does not record the audio). We keep the text transcript, when the interview started and ended, and the scores the recruiter sees. The transcript is graded by Anthropic (Claude).	During an interview you start from the Apply tab
Device & sessions	Sign-in sessions (an opaque device label such as "android/1.0", session creation and expiry times) so you stay signed in and can be signed out. Our servers also keep standard request logs (time, request path, status, IP address) for security and troubleshooting.	Automatically

We do not collect precise location, contacts, photos, hardware identifiers, or any data from other apps on your device. The device's advertising ID is read only by the Meta SDK for ads measurement (above), and only while that Settings switch is on. The phone model is recorded only with the usage statistics, crash reports and Meta events described above. Firebase usage statistics and crash reports are never used for ads; in Google Analytics, Google signals and ad personalisation are switched off. The only advertising tools are the Meta Pixel on the qahunt.com website and the Meta SDK in the app (section 2), used to measure and show QA Hunt's own ads.

3. How we use it

To create and secure your account and keep you signed in.
To show you job listings and recommendations based on your profile, preferences and applications.
To send your profile and application to the employer behind a job you apply to, and to show you the status they set.
To send verification codes (WhatsApp or e-mail) and essential account messages. We do not send marketing messages by WhatsApp or e-mail.
Push notifications (only if you turn them on). From app version 1.5.9 you can allow notifications in the app (the first time you are asked, or in Settings → Communication & privacy → "Push notifications"). We then notify you when a recruiter views, reviews, shortlists or rejects your application or invites you to an AI interview — the notification names the company and the job you applied to — and, now and then, about new QA jobs. Notifications go through Google's Firebase Cloud Messaging; they never contain your contact details, profile or resume. Turn them off any time in the same Settings switch or in your phone's settings; we keep a record of which notifications were sent and how many were delivered, never their recipients' tokens.
To understand how many installations of the app are in use and how many have stopped being used or were removed. An installation that has not checked in for 30 days is counted as inactive; that alone never counts as an uninstall.
Uninstall detection (only if enabled). When enabled, our server periodically sends a silent push message — nothing is shown on your phone — through Google's Firebase Cloud Messaging to the app's installation. If Firebase reports that the installation no longer exists, we record that the app was uninstalled. This is only noticed when we run this check, so it can happen days or longer after the actual uninstall, depending on how often the check is run.
One goodbye message. If an uninstall is detected this way and your account has a verified mobile number, we may send you a single WhatsApp message saying we are sorry to see you go. We send at most one such message per installation, never while the app is still in use on another of your devices, not if the app was used by more than one account on that phone, and not if you have opted out by replying STOP to any QA Hunt WhatsApp message. This message is currently switched off and is only enabled with an approved WhatsApp template.
To keep the service reliable and safe (rate limiting, abuse prevention, troubleshooting from request logs).
To understand, in aggregate, which parts of the app and the website are used and to find and fix crashes (Google Analytics / Firebase Analytics and Firebase Crashlytics, see section 2). We look at counts and trends, not at individual people.

Google Sign-In — the app uses Android's Credential Manager. Google gives us an ID token that we verify on our server; from it we keep your Google account identifier, name and e-mail address. We never see your Google password.
Mobile number (WhatsApp) — the one-time code is delivered to your number through Meta's WhatsApp Business Platform. Meta processes your number to deliver the message under its own terms.
E-mail — verification codes are sent through a transactional e-mail provider that processes your e-mail address to deliver the message.
Firebase Cloud Messaging (Google) — only if uninstall detection is enabled: the app obtains a messaging token from Google's Firebase service, and our server uses it to send the silent check described in section 3. Google processes the token and the delivery under its own terms.
Meta SDK (Meta Platforms) — in the app from version 1.7.4, while that Settings switch is on: Meta receives the app events and advertising ID described in section 2 and uses them, under its own terms, to measure and target QA Hunt's ads on Facebook and Instagram. Turn it off in Settings → Communication & privacy → "Share usage statistics, crash reports and ads measurement", or reset the advertising ID in your phone's settings.
Meta Pixel (Meta Platforms) — on the qahunt.com website only: Meta receives the page views and link clicks described in section 2, with your browser's IP address and the _fbp cookie, and uses them, under its own terms, to let QA Hunt show its ads on Facebook and Instagram to people who visited the website. You can block it with your browser's "Do Not Track" / Global Privacy Control setting or by blocking third-party scripts, and manage ads in your Facebook / Instagram ad settings.
Google Analytics / Firebase (Google) — Google processes the usage statistics and crash reports described in section 2 on our behalf under its data processing terms. Usage statistics are kept for 14 months, crash reports for 90 days, then deleted by Google.
OpenAI — only during an AI screening interview you start: OpenAI processes your voice, your first name, the job title, the company name and the interview questions to hold the conversation, through a short-lived session our server creates for that one interview.
Anthropic (Claude) — after an AI screening interview: Anthropic receives the text transcript and the interview questions (we do not add your name or contact details; only what you say in the interview is in the transcript) and returns the scores the recruiter sees. Recruiters also use Claude in their panel to draft job descriptions and interview questions; that does not include your personal data.

We share personal data only in these cases:

Employers you apply to. When you apply to a job, the employer or recruiter who posted it can see your name, contact details, profile and application. That is the purpose of the service.
Service providers that process data on our instructions to run QA Hunt: our hosting providers (see section 6), Meta for WhatsApp delivery and for ads measurement (the Meta Pixel on the website, the Meta SDK in the app), Google (Google Analytics, Firebase Analytics and Crashlytics as described in section 2; Firebase Cloud Messaging, only if uninstall detection is enabled), OpenAI and Anthropic for AI screening interviews (section 2), our e-mail delivery provider, and Cloudflare, which sits in front of qahunt.com to protect it and sees the network traffic.
Legal reasons — if required by applicable law or to protect the rights, safety and integrity of QA Hunt or its users.

We do not sell personal data, and we do not share it with data brokers or other advertisers. The one exception is Meta's ads measurement (section 2 and the provider list above): the Meta Pixel on the website (page views and link clicks, with your IP address and the _fbp cookie) and the Meta SDK in the app (install, app opens, sign-up method, job views and applications by job number only, with the advertising ID), used only so that QA Hunt can measure and show its own ads on Facebook and Instagram. Your name, contact details, profile, resume and the content of your applications are never shared with Meta or any advertiser.

6. Where data is stored

Our application server runs on a virtual private server operated by QA Hunt. The database runs on Amazon Web Services (Amazon RDS) in the ap-south-1 (Mumbai, India) region. Traffic to qahunt.com passes through Cloudflare, and the providers listed in section 5 may process data outside India; we apply the safeguards described below wherever it is stored.

7. Security

All traffic between the app and our servers uses HTTPS (TLS); the app refuses unencrypted connections.
Passwords are stored as salted bcrypt hashes; they never leave your device in clear text and are never stored on it.
Sessions use short-lived access tokens with rotating refresh tokens; signing out invalidates them.
Database access is limited to a dedicated least-privilege account over an encrypted connection, and the database is not reachable from the public internet.
The app does not back up your tokens to cloud backup.

No system is perfectly secure. If we learn of a breach affecting your data we will inform you as required by law.

8. Retention & deletion

We keep your account, profile and application data for as long as your account exists, so that your applications and their statuses remain available to you and to the employers you applied to. Verification codes expire within minutes of being issued. AI screening interview transcripts and scores are kept for 90 days, as the interview consent says. Request logs exist for security and troubleshooting and are rotated.

App-installation records linked to your account are kept while the account exists. Installation records not linked to any account (or whose account was deleted) that are inactive or uninstalled become eligible for deletion once they have had no check-in for 12 months, and are removed during our periodic clean-up.

You can ask us to delete your account at any time — see Account deletion. Deletion removes your account, profile, saved jobs, sessions and applications from our live database and unlinks your app installations from it. Database backups exist for disaster recovery only, are rotated as newer backups replace them, and are never used to restore a deleted account.

9. Your choices

You can view and edit everything in your profile inside the app at any time; every section is optional.
You can withdraw an application from the Apply tab.
You can sign out of all sessions by logging out.
You can opt out of the uninstall goodbye message by replying STOP to any QA Hunt WhatsApp message.
You can switch off usage statistics and crash reports in the app: Settings → Communication & privacy → "Share usage statistics and crash reports". On the website, turn on "Do Not Track" or Global Privacy Control in your browser, or block cookies for qahunt.com.
You can request a copy of your data, a correction, or deletion by e-mailing us (section 12). We will verify the request against the e-mail address or phone number on the account before acting on it.

10. Children

QA Hunt is intended for adults looking for work. It is not directed at children under 18, and we do not knowingly collect data from them. If you believe a child has created an account, contact us and we will delete it.

11. Changes to this policy

We may update this policy as the service evolves. The effective date at the top will change, and material changes will be announced in the app. The current version is always available at qahunt.com/privacy.

12. Contact

QA Hunt E-mail: info@grafo.in Website: qahunt.com · India

See also our Terms of Use and the Account deletion page.