Privacy Policy

Last updated: October 6, 2026

1. Introduction

Litmus ("we", "us", or "our") respects your privacy. This Privacy Policy explains how we collect, use, and protect your information when you use our platform at www.litmushiring.com ("Service").

2. Information We Collect

Account Information: Name, email address, and profile details provided during sign-up or through third-party authentication (e.g., Google).

Assessment Data: Code submissions, commit history, assessment responses submitted by candidates, and records of AI assistant usage during the assessment (e.g., prompts sent to Claude Code, GitHub Copilot CLI, or similar tools, and the tool's responses), to the extent such activity occurs within the Platform, through Platform-provided or connected tools, or is otherwise made available to Litmus. Candidates are shown a disclosure describing what the Litmus assessment client records and asked to acknowledge it before starting an assessment. In a workspace that Litmus hosts, assessment data can also include a recording of what the terminal displays, with the time each part appeared. Characters a candidate types that the terminal shows on screen are part of that recording.

Walkthrough Recording: After submitting an assessment, candidates record a short video walkthrough explaining their work. Video and audio are uploaded to Litmus storage. Audio is transcribed by Deepgram to support evaluation, and by OpenAI's Whisper when Deepgram can't produce a transcript. Spoken answers to questions asked during an assessment are transcribed by OpenAI. The video, audio, and transcript are visible to the hiring company that invited the candidate.

Live Interviews: When a hiring company runs a live interview through Litmus, a Recall.ai notetaker can join the video call. It records the call's video and audio, including any shared screen, and Recall.ai transcribes the recording. Audio from the call can also be transcribed by Deepgram. The recording and transcript are visible to the hiring company.

Customer-Provided Context: When a hiring company links external systems to Litmus — for example, source-code repositories (via the Litmus GitHub App), issue trackers (Linear, Jira, GitHub Issues, Notion), or applicant tracking systems (Ashby, Greenhouse, Lever) — content and records from those systems flow into Litmus to enable assessment generation, candidate invitations, and pipeline tracking. Content from connected source-code and issue-tracker systems may be transmitted to AI providers named in §4 to produce relevant assessments. We use this content to provide the Service to the applicable hiring company and do not use it to train or improve Litmus's general assessment, grading, AI, or product systems, except as permitted by our agreement with that company.

Google Calendar: If you connect your Google Calendar, Litmus reads your calendar events (read-only access) to show your busy times on the interview availability grid and to let you pick the meeting you are on when creating a live-interview link. We store a credential so this works without reconnecting, and your choice of which of your calendars to read. Event details are shown only to you. If you choose a meeting to create a live-interview link, the details you confirm from it (the candidate's name and email address, and the meeting link) become part of that interview session in Litmus, where they are visible to the candidate and to members of your organization like any other session. We store nothing else from your calendar, and we do not sell calendar information or use it for advertising. You can disconnect at any time from Settings, which deletes the credential. Litmus's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Usage Data: Pages visited, features used, browser type, and device information collected automatically.

Payment Information: Billing details processed securely through Stripe. We do not store credit card numbers on our servers.

3. How We Use Your Information

To provide and maintain the Service
To manage your account and authenticate your identity
To process payments and manage subscriptions
To send transactional emails (e.g., assessment invitations, account notifications)
To improve the Service and develop new features
To ensure security and prevent fraud
For candidates, to administer assessments, preserve assessment integrity, generate or support evaluation outputs, provide submissions and related assessment metrics to the hiring company that invited the candidate, and maintain platform security
For candidates, to develop, train, test, and improve Litmus's own assessment, grading, integrity, and AI systems, and for internal research, analytics, and benchmarking — using candidate submissions and assessment activity data (not company-provided data), as described in the Candidate Platform Agreement. Where a candidate submission or assessment activity data includes or reflects company-provided content, we handle that company-provided content under our agreement with the applicable hiring company and do not use it for model training or unrelated product-improvement purposes except as permitted by that agreement.
To create and use de-identified, aggregated, or anonymized data derived from candidate submissions and assessment activity for research, analytics, product development, and reporting
To support automated and AI-assisted assessment administration, grading, integrity review, transcription, analytics, and evaluation outputs, which may be considered by the hiring company as part of its own candidate evaluation process — hiring companies are responsible for their own hiring decisions

4. Information Sharing

We do not currently sell personal information or share personal information for cross-context behavioral advertising as those terms are used under California privacy law. If that changes, we will update this Policy and provide any required opt-out mechanism before doing so. We may share information with:

Service Providers: Third parties that help us operate the Service, for example Clerk for authentication, Stripe for payments, Resend for email, Railway for application hosting and our database, Cloudflare R2 for storage and backups, and Vercel for hosting and Blob storage. Candidate recordings and transcripts are stored with Vercel Blob, Cloudflare R2, and Railway, and live interview recordings are stored with Recall.ai. Beyond storage and hosting, these are the providers that receive candidate audio, video, or transcripts to process them: Anthropic, for assessment generation and grading, which can include transcripts and still images from walkthrough videos; Deepgram, for transcribing walkthrough and interview audio; OpenAI, for transcription when Deepgram can't produce a transcript and for spoken answers to assessment questions; and Recall.ai, for recording and transcribing live interview calls. When an assessment lets a candidate's code use AI services through Litmus, the requests that code sends go to the provider the assessment uses: OpenAI, Anthropic, OpenRouter, or Voyage AI. These providers process information on our behalf under contract and are restricted from using it for their own independent purposes, including training their own general-purpose models on it.
Website Visitor Identification: On our public marketing pages only, we use RB2B, a visitor identification service, which may use cookies and similar technologies to identify the business, and in some cases the professional profile, of a person visiting those pages. RB2B does not run on sign-in, candidate, assessment, shared report, or company account pages.
Hiring Companies: When you submit an assessment as a candidate, the hiring company that invited you can view your submission, walkthrough recording, transcript, related assessment activity, and evaluation outputs, as applicable to the assessment
Legal Requirements: When required by law, regulation, or legal process

Submission Ownership: Upon submission, Litmus owns your rights in the specific expression embodied in your assessment submission, effective immediately and not conditioned on whether you are hired. You retain ownership of anything you brought in (pre-existing code, open-source dependencies, general skills and know-how, and independently developed materials). Litmus licenses your submission to the hiring company solely for evaluating your candidacy and related hiring-decision purposes — the company may not use it in its own products, for commercial development, or for model training. The full terms, including these ownership and license terms, are in the Candidate Platform Agreement you accept before accessing assessment content or submitting assessment work. Nothing in this Privacy Policy changes the ownership, license, confidentiality, or use restrictions set out in that agreement.

5. Data Security

We implement appropriate technical and organizational measures to protect your data. However, no method of transmission over the internet is 100% secure, and we cannot guarantee absolute security.

6. Data Retention

We retain different categories of information for different periods depending on the purpose for which they are processed. Account and billing data are retained for as long as your account is active and as needed to comply with legal and accounting obligations. Candidate submissions, video walkthroughs, interview recordings, audio, transcripts, and assessment activity data are kept until they are deleted, except as described in the next two sentences. Apart from those exceptions, they are not deleted automatically after a set period, and hiring companies can't set a retention period for them. If we refuse a submission after receiving it, we keep the refused upload for 30 days so it can be recovered if the refusal was a mistake, and then delete it. Recordings of a hosted workspace's terminal may be deleted automatically: an earlier recording one day after a newer one replaces it, and every recording 30 days after it was made. Security and audit logs may be retained for longer periods where reasonably necessary. De-identified, aggregated, or anonymized data may be retained and used after account deletion where permitted by law and where it no longer identifies you. You may request deletion by contacting us, subject to legal, security, contractual, and operational retention requirements.

7. Your Rights

Depending on your location, you may have rights to:

Access, know, and receive a copy of your personal information
Correct inaccurate information
Request deletion of your data
Request portability of your data
Object to or restrict certain processing
Opt out of the sale or sharing of personal information, or of targeted advertising or profiling (we do not currently engage in any of these — see §4)
Withdraw consent where processing is based on consent
Appeal a decision on a privacy request

We will not discriminate against you for exercising rights under applicable law. To exercise any of these rights, contact us at support@litmushiring.com; we may need to verify your identity before fulfilling a request. If you are in the EEA, UK, or Switzerland, our legal bases for processing include performance of a contract, legitimate interests (operating and securing the Service, administering assessments, preventing fraud and unauthorized assistance, and improving assessment and grading systems), compliance with legal obligations, and consent where required — and you have the right to lodge a complaint with your local supervisory authority.

8. Cookies

We use essential cookies for authentication and session management. We may use analytics cookies to understand how the Service is used.

9. Children's Privacy

The Service is not intended for users under 18. We do not knowingly collect information from children.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page.

11. Contact

If you have questions about this Privacy Policy, contact us at support@litmushiring.com.