Taleproof Privacy Policy

This Privacy Policy explains how Taleproof handles personal information when you visit taleproof.com, use Score My Stories, improve a story with Quick Story Boost or AI Coach, create an account, make a purchase, contact us, or join the separate Story Bank early-access list.

Score My Stories assesses behavioral-interview stories you submit. Story Bank is a future offering. Its marketing opt-in is separate from creating an account or using Score My Stories.

1. Who is responsible for your information?

Taleproof is a business operated by an individual in California, United States. That operator decides why and how the personal information described in this policy is used and is its controller where data-protection law uses that term.

The operator’s full legal identity and business contact details are provided in Legal operator and contact details. That identification forms part of this Privacy Policy.

Privacy questions and requests: privacy@taleproof.com.

Some providers are independently responsible for particular activities, such as operating a payment account or improving a security service. Section 5 explains the relevant distinctions.

2. Information we collect

Stories and assessments

We process story text, titles, saved drafts, revisions you choose to assess, and the resulting scores, feedback, and assessment reports. These materials can contain information about your work, employers, colleagues, achievements, and decisions.

Please remove unnecessary personal details and use role descriptions or pseudonyms where practical. Do not submit confidential information you are not authorized to share. The service is not designed for identity documents, financial-account credentials, or sensitive information such as health information or information revealing religion, political views, or sexual orientation.

Story Improvement

When you use Quick Story Boost or AI Coach, we process the questions we ask you, the answers you give, your AI Coach conversation, the revised stories the service generates, their assessments, and records of each Story Upgrade journey, such as whether it was reserved, used, or released. Revised stories are generated from your story and your answers, so they can contain the same kinds of information.

Accounts and profiles

We process your email address, account identifier, verification status, and any profile information you provide. Email/password authentication is handled through Supabase.

When you choose Google sign-in, Google provides authentication and basic profile information, which may include your name, email address, profile picture, and Google account identifier. This does not give Taleproof your Google password or, by itself, access to Gmail or Google Drive.

Purchases and credits

We keep information needed to recognize purchases, provide assessments and Story Upgrades, maintain balances of assessment credits and Story Upgrades, and handle payment questions. This includes order and payment-provider identifiers, the purchased offer, amount and currency, payment status, and related credit, refund, and dispute records.

You enter payment-card information into the payment provider’s checkout. Taleproof does not collect or store your full card number or card security code in its application database. Stripe and Link handle payment information and may provide transaction or billing information needed for fulfilment, support, reconciliation, fraud prevention, and legal compliance.

Security and operational records

We use session and authentication information, browser-recognition identifiers, and relevant browser, device, and network information to operate and protect the service.

For guest abuse prevention, we keep hashed IP addresses and related usage history. These are pseudonymous identifiers, not anonymous information. Infrastructure and security providers also receive network information, including IP addresses, when processing requests.

We keep limited usage, resource-use, and error records. These can include technical identifiers associated with a request or submission, timestamps, processing status, service usage, and diagnostic information. We use them to maintain reliability, prevent duplicate processing and misuse, investigate failures, reconcile assessment activity, and manage the resources needed to provide the service.

Communications and the Story Bank waitlist

When you contact us, we receive your message, contact details, and the information you include.

When you separately join the Story Bank early-access list, we collect the information requested by the form, such as your first name, email address, and role category. We also record your consent and its date, subscription status, and relevant referral or campaign information. Our email provider processes recipient and delivery information to send messages and handle delivery problems.

Website analytics

We use Plausible to understand website visits. This can include visited page URLs, referral sources, permitted campaign information, browser and device information, and approximate location derived from network information.

Plausible’s measurement does not use analytics cookies or persistent browser storage. We do not send submitted story text or full assessment reports to Plausible as analytics data. This does not mean that every page URL or referral value is necessarily anonymous.

Measurement runs only on the public taleproof.com website. Query-string values other than a fixed list of referral and campaign parameters are removed before an event is sent, and pages whose addresses can carry sign-in, password-reset, or unsubscribe tokens are excluded from measurement entirely.

3. Why we use information

We use information to provide and save assessments, reopen your work, operate accounts, fulfil purchases, maintain credit balances, and answer service questions. We also use it for security and abuse prevention, reliability and troubleshooting, limited website measurement, and necessary account, purchase, and service communications.

For Story Improvement, we use your story, its assessment, and your answers to identify what the story is missing, generate Quick Story Boost and AI Coach questions, produce a revised story grounded in what you provided, check that the revision stays consistent with it, assess the revised story, and let you save, reopen, and continue the work.

We may also review Story Improvement records held in accounts internally, to understand and improve the quality of Story Improvement. That review is not publication, advertising, or training of general-purpose AI models.

We use a separate Story Bank marketing opt-in for early-access messages. We also process information needed for applicable recordkeeping obligations, lawful requests, disputes, and protection of legal rights.

Where data-protection law requires a lawful basis, we rely on:

• Contract: processing necessary to provide the service you request, including guest assessments, accounts, saved work, purchases, and related support.
• Legitimate interests: proportionate security, abuse prevention, reliability, troubleshooting, recordkeeping, and limited measurement of website use, and internal review of account Story Improvement records to improve the quality of the service, subject to your rights and any applicable consent requirements. Our interest in processing incidental information about other people that you lawfully include is to provide the requested assessment without unnecessary use of their information.
• Consent: the separate Story Bank marketing opt-in and any other processing for which applicable law requires consent.
• Legal obligations: processing required by applicable tax, accounting, consumer-protection, or other law. Where keeping information is necessary to establish or defend a claim rather than legally compulsory, the relevant basis is our legitimate interest in doing so.

Reading or acknowledging this policy is not blanket consent to marketing or unrelated uses. You can withdraw consent without affecting processing that was lawful before withdrawal.

You do not have to provide optional profile or marketing information. Without information necessary for a feature, such as a story for assessment or an email address for an account, we cannot provide that feature.

4. AI processing

We send your submitted story and the instructions needed to assess it to Anthropic through its API. Anthropic returns material used to produce your Interview Readiness, PROOF, and STAR assessment.

When you use Quick Story Boost or AI Coach, we also send Anthropic the relevant story text, its assessment findings, and the answers you give, so that it can write the questions, generate a revised story and smooth how your answers read within it, check the revision against your story and answers, and assess the revised story. Which of these steps run depends on the path you choose. Anthropic does not receive your password or payment details.

This automated feedback is for your interview preparation. It is not a hiring decision or a guarantee of an employment outcome. Feedback can be inaccurate or incomplete, so check it before relying on it.

A revised story is AI-generated from your story and your answers. It can still misstate or overstate something, so read it before you save or use it.

Anthropic’s standard commercial API terms restrict training on customer content. Its published standard API retention period is up to 30 days, subject to exceptions for safety enforcement, legal requirements, particular services or agreements, and model-specific handling. Those exceptions can involve longer retention. See Anthropic’s commercial data-retention information.

Provider retention is separate from Taleproof’s saved-record periods in section 7. This policy does not promise zero retention or simultaneous deletion from every provider system.

We do not obtain permission through this policy to publish your stories as examples or testimonials or use them for unrelated advertising.

5. Who receives information?

We use providers for the following parts of the service:

Authorized people supporting Taleproof may access information when needed for support, troubleshooting, security, or legal compliance. We may disclose information to professional advisers or authorities where reasonably necessary to comply with law or valid legal process, or to establish or protect legal rights.

Using Taleproof does not make your saved stories public. Providers acting independently have their own privacy notices and rights processes; this does not remove Taleproof’s responsibility for the processing it controls.

6. Cookies and browser storage

We use necessary cookies and similar storage to keep you signed in, secure authentication, recognize a guest browser, preserve an in-progress draft, and continue requested purchase flows.

The guest-recognition cookie is set for up to 365 days from issuance. Other session, sign-in, and purchase-continuation information is used for the relevant session or limited period needed for the feature. Some draft information is stored in your browser for the session.

Clearing browser storage can sign you out or remove access to browser-associated work. It does not itself delete server-held information or create an entitlement to additional complimentary assessments.

Plausible’s measurement is separate from these necessary cookies. Google, Cloudflare, and the payment provider may use their own cookies or similar technologies when their features are used.

Because the cookies and storage Taleproof itself sets are limited to those necessary for the features you request, and our website measurement neither stores nor reads information on your device, we do not present a cookie-consent banner. Where website measurement is based on our legitimate interests, you can object to it as described in section 9, and you can control provider cookies through your browser or through those providers’ own settings.

Our application does not implement a separate response to the older browser “Do Not Track” setting. Independent sign-in, security, and payment providers may collect information over time and across services under their own privacy terms. Taleproof does not use submitted stories for cross-site behavioral advertising. Any legally applicable opt-out rights remain available.

7. Retention and deletion

How long information is kept

These periods apply to the relevant Taleproof-held records, unless you delete eligible information earlier:

Unsubscribing stops Story Bank marketing but does not itself erase the waitlist entry. Limited consent and suppression information may remain to document and respect your choice. Other waitlist information follows the confirmed retention rules above.

Deleting a saved story

Successfully completing the story-deletion operation removes that story, its associated saved assessments, and its Story Improvement records — your answers and the revised stories — from the active application database. It does not erase separate operational, security, or financial records retained for the purposes described in this policy, including content-free records of Story Upgrade use.

Using Delete account

When you successfully complete the in-account Delete account operation, your account identity and saved stories, drafts, assessment reports, and Story Improvement records are deleted from active application systems immediately as part of that operation. This is not an ordinary request placed in a queue to await later deletion. Your access to that account ends, and unused credits and Story Upgrades are forfeited as explained in the Terms.

An ordinary processing review does not remove access to the account-deletion controls. A genuine security or legal restriction may require a different, appropriately limited process.

Assistance, privacy requests, and exceptional failures

You can email privacy@taleproof.com for help with deletion, guest information, or a privacy-rights request. We may need information reasonably necessary to locate the records and verify your identity or authority. Clearing a guest cookie first can make a guest record harder to locate.

If an in-account deletion operation fails, it has not successfully completed. We will not treat a failed operation as confirmation that the account has been deleted. Contact us for resolution. Exceptional failures do not authorize indefinite retention or postpone applicable privacy-rights deadlines.

We handle assisted and emailed privacy requests without undue delay and within the deadlines required by applicable law, and we complete a verified deletion request within 30 days. If a lawful exception or extension applies, we will explain it and any available next steps. Those request-handling rules do not replace the immediate deletion described above for a successfully completed in-account operation.

The account-deletion control does not itself erase the separate Story Bank waitlist entry or delete an independent Google or Link account. You can include Taleproof-held waitlist information in the same emailed deletion request.

Limited retained records and other copies

After account deletion, a minimized financial audit record may remain, detached from the deleted account, for the purposes and periods above. Relevant security or legal records may also remain where necessary and lawful. Detachment does not necessarily make a record anonymous. Retained records are not permission to continue using your deleted story for unrelated purposes.

Content-free accounting records of Story Upgrade use — which journey was reserved, used, or released, and its processing cost — may also remain, detached from the deleted account. They do not contain your story, your answers, or revised stories.

Deletion from active application systems is not simultaneous erasure of every backup or independent provider record. Our hosting provider keeps routine database backups for operational recovery; a deleted record can persist in those backups until they are rotated out of the backup cycle, and it is not restored into the active service except as part of a genuine recovery. Independent providers may keep information they control for their own applicable legal and service obligations; rights requests concerning those records may also need to be addressed to them.

8. International processing

Taleproof operates from the United States, and its application database and hosting are located in the United States. Providers may process information in the United States and other countries where they operate, including outside the country where you live. This policy does not promise that all information remains in one country or region.

Where information is transferred out of the United Kingdom or the European Economic Area, we rely on the data-protection terms agreed with the provider handling it. You can contact privacy@taleproof.com for information about the safeguards applicable to a particular provider and how to obtain a copy, subject to appropriate protection of confidential information.

9. Your choices and rights

You can manage available profile information and saved stories through your account. You can unsubscribe from Story Bank marketing through an email’s unsubscribe link or by contacting us. Necessary account, security, purchase, and service messages are separate from marketing.

Depending on applicable law, you may have rights to access or obtain a copy of your information, correct it, request deletion, restrict processing, obtain portable information, or appeal a decision about a request.

You may object to processing based on legitimate interests, and to direct marketing at any time. Where processing depends on consent, you may withdraw it.

To exercise a right, email privacy@taleproof.com. Please do not send your password or full payment-card details. We will explain any applicable exception or refusal and any available appeal route. We will not discriminate against you for exercising rights where the applicable law prohibits that treatment.

You may also complain to the relevant data-protection authority. In the United Kingdom, this includes the Information Commissioner’s Office.

10. Security and adults-only use

We use authentication, access controls, and security measures intended to protect information and limit access to authorized purposes. No online service can guarantee complete security.

Taleproof is intended for adults aged 18 and over, not children. Contact us if you believe a child has provided personal information so we can investigate and take appropriate action.

11. Changes and contact

We will post changes with an updated effective date. For material changes, we will provide appropriate notice, such as a website notice or email, and obtain consent where required.

Questions and privacy requests

privacy@taleproof.com