PRIVACY POLICY

Last Updated: April 8, 2026

I. INTRODUCTION

Credible Inc. d/b/a McCoy (“McCoy”) operates the McCoy platform, including the McCoy mobile app (“the App”), the McCoy web app for viewing McCoy Reels and Targeted Reels at mccoy.io (“the Web App”), and the McCoy IQ portal (“McCoy IQ”) (collectively, the “Services”). This Privacy Policy explains how we collect, use, and share information when you use our Services.

If you choose to use our Services, then you agree to the collection and use of information in relation to this policy. The Personal Information that we collect is used for providing and improving the Services. We will not use or share your information with anyone except as described in this Privacy Policy.

1. INFORMATION COLLECTION AND USE

For a better experience, while using our Services, we may require you to provide us with certain personally identifiable information, including but not limited to email address, first and last name, username, profile photo, linked social media accounts, location (city/state), skills, salary preferences, relocation preferences, and any content you create or submit on the platform — including McCoy Reels, Targeted Reels, custom content and custom messages, feed posts, comments and replies, chat messages, and job application materials. The information that we request will be retained by us and used as described in this privacy policy.

The app does use third-party services that may collect information used to identify you.

The following third-party services receive information about you as part of the Services:

• Firebase / Google (Crashlytics): The Android app uses Firebase Crashlytics for crash reporting. Crash reports are sent to Google and may include technical device data and user identifiers present in application logs at the time of the crash. Note: Firebase Analytics is disabled on both iOS and Android — no behavioral analytics are sent to Google. Governed by Google’s Privacy Policy.
• Meta (Facebook SDK): The iOS app includes the Facebook SDK. We have disabled automatic behavioral event logging (FacebookAutoLogAppEventsEnabled = false). No advertising ID is collected. Governed by Meta’s Privacy Policy.
• TikTok: The iOS app includes the TikTok Open Platform SDK for video sharing only. When you tap “Share to TikTok,” TikTok receives the video and device metadata (device model, OS version, app bundle ID) needed to process the share. No behavioral event logging or advertising tracking occurs. The Android TikTok SDK is not active. Governed by TikTok’s Privacy Policy.
• OneSignal: Push notification service. Receives your email address, first name, last name, and profile completion status (whether you have added an about section, a Reel, or shared to feed) to determine which notifications to send you. Governed by OneSignal’s Privacy Policy.
• Anthropic: McCoy uses Anthropic Claude across both the McCoy Consumer App and McCoy IQ. In the Consumer App, Claude powers career insights generation, AI conversation rooms, audience suggestions, script writing, and onboarding prompts. In McCoy IQ, Claude powers challenge question recommendations, content generation, role insights, content moderation, brand extraction, role room conversations, and challenge coaching insights. Data Use Restriction: McCoy has a Data Processing Addendum with Anthropic that requires Anthropic to: (1) process your data only to fulfill the specific feature requested; (2) NOT use your data to train, fine-tune, or improve AI models; (3) delete your data after request processing completes (typically within 24 hours); and (4) comply with GDPR Article 28 service provider obligations if your data includes EU resident information. Your data is NOT sold, shared with third parties, or retained for any purpose beyond fulfilling your immediate request. For Anthropic’s full privacy practices, see Anthropic’s Privacy Policy at https://www.anthropic.com/privacy.
• OpenAI: OpenAI is used in the McCoy Consumer App only, for text-to-speech conversion. OpenAI’s API converts text content to spoken audio for the playback feature. Only the text to be spoken is sent to OpenAI — no profile data, personal information, or job recommendations are transmitted. OpenAI is not used in McCoy IQ. Data Use Restriction: McCoy has a Data Processing Addendum with OpenAI that requires OpenAI to: (1) process your data only to fulfill the specific feature requested; (2) NOT use your data to train, fine-tune, or improve AI models; (3) NOT retain your data beyond 7 days for any reason; and (4) comply with GDPR Article 28 if your data includes EU resident information. Your data is NOT sold or shared with third parties for any purpose beyond fulfilling the specific recommendation request. For OpenAI’s full privacy practices, see OpenAI’s Privacy Policy at https://openai.com/privacy.
• JobData API (jobdataapi.com): The McCoy mobile app uses JobData API to search for and display job listings. Your job search parameters — including job title, location, skills, and experience level — are derived from your profile and sent to JobData API to retrieve matching listings. Governed by JobData API’s Privacy Policy.
• HeyGen: McCoy IQ Users can generate AI avatar videos. Scripts used to generate these videos are sent to HeyGen for processing. Governed by HeyGen’s Privacy Policy.
• Stripe: Payment and billing information for McCoy IQ subscriptions is processed by Stripe. McCoy does not store payment card data. For annual subscriptions, Stripe sends renewal reminder emails approximately 7 days before each renewal date, including the renewal amount and a cancellation link. Governed by Stripe’s Privacy Policy.
• AWS (Amazon Web Services): McCoy’s infrastructure runs on AWS. Your data — including media files, database records, and logs — is stored on AWS servers in the United States. Governed by the AWS Customer Agreement.
• Slack: McCoy uses Slack for internal operations. Certain account events — including account creation, in-app reports, feed posts, and account deletion — may generate operational notifications to our internal Slack channels, which may include your name, email address, and the content of your report or post.

2. LOG DATA

We want to inform you that whenever you use our Service, in a case of an error in the app we collect data and information (through third-party products) on your phone called Log Data. This Log Data may include information such as your device Internet Protocol (“IP”) address, device name, operating system version, the configuration of the app when utilizing our Service, the time and date of your use of the Service, and other statistics.

IP Address: When you use our Services, our servers automatically receive and log your IP address. We use IP addresses for security purposes (detecting suspicious login activity and preventing abuse), rate-limiting, and approximate geolocation to determine which legal rights apply to you (for example, whether you are located in California or the European Union). IP addresses are stored in server infrastructure logs and are automatically deleted after 90 days. We do not sell or share IP addresses with advertising networks or use them to build behavioral profiles.

Analytics and Support: We collect behavioral analytics data to understand how the Services are used, improve our product, and diagnose technical issues. Analytics events may include your email address, name, username, and the text of certain in-app interactions (such as search queries, content you engage with, and errors reported).

Retention Period: Analytics data is retained while your account is active. When you delete your account, analytics data associated with your account is anonymized (personal identifiers are removed) so it cannot be linked back to you. Anonymized data may be retained indefinitely for aggregate analysis. For analytics events not linked to a user account, data is automatically deleted after 365 days from the date of collection. After 365 days Exceptions to deletion/anonymization: (1) you have an open support ticket (deleted when ticket closed); (2) data is needed to investigate a reported violation or security incident (deleted upon resolution or after 90 days, whichever is sooner); or (3) legal hold is imposed by law enforcement. Analytics data associated with deleted accounts is purged within 30 days of account deletion.

3. COOKIES

Cookies and Tracking Technologies:

McCoy’s application surfaces (iq.mccoy.io, mccoy.io) do not use cookies. Authentication is handled via browser local storage (IndexedDB), and our first-party analytics system uses API key headers rather than cookies.

The McCoy marketing website (mccoy.io) previously used Google Tag Manager and Google Analytics, which set third-party cookies. These have been removed. No McCoy web property sets third-party cookies.

Mobile App SDKs: The iOS and Android apps include Firebase Analytics (app usage metrics sent to Google), Firebase Crashlytics (crash reporting), and OneSignal (push notifications). The iOS app also includes the Facebook SDK with advertiser ID collection disabled — app event logging is used for crash reporting only, not advertising. The iOS TikTok SDK is used solely for the share-to-TikTok feature and does not perform behavioral tracking.

Do Not Track: McCoy does not use third-party analytics, cookies, or tracking technologies on any platform. Do Not Track browser signals are honored by default — there is nothing to disable.

4. SERVICE PROVIDERS

We work with third-party service providers as described in Section 1 above. Each vendor receives only the data necessary to perform their function. A complete list of sub-processors is available at mccoy.io/privacy/sub-processors.

5. SECURITY

We value your trust in providing us your Personal Information, thus we are striving to use commercially acceptable means of protecting it. But remember that no method of transmission over the internet, or method of electronic storage is 100% secure and reliable, and we cannot guarantee its absolute security.

Internal Access: Authorized McCoy employees and vetted contractors may access your personal data as necessary to operate, maintain, and support the Services — for example, to investigate a technical issue, respond to a support request, or fulfill a legal obligation. All such personnel are bound by written confidentiality agreements and are granted access only to the data necessary for their specific role. Access is revoked promptly upon the end of any employment or contractor relationship.

6. LINKS TO OTHER SITES

This Service may contain links to other sites. If you click on a third-party link, you will be directed to that site. Note that these external sites are not operated by us. Therefore, we strongly advise you to review the Privacy Policy of these websites. We have no control over and assume no responsibility for the content, privacy policies, or practices of any third-party sites or services.

7. CHILDREN’S PRIVACY

Children’s Privacy

McCoy is a career platform designed for working professionals. You must be at least 16 years old to use the Services. When you create an account, you will be asked to confirm that you are 16 or older.

We do not knowingly collect personally identifiable information from anyone under 16 years of age. If we discover that someone under 16 has created an account, we will immediately delete the account and all associated data. If you believe someone under 16 is using McCoy, please contact safety@mccoy.io.

8. CHANGES TO THIS PRIVACY POLICY

We may update our Privacy Policy from time to time. Thus, you are advised to review this page periodically for any changes. We will notify you of any changes by posting the new Privacy Policy on this page. When we make material changes, we will notify active users through an in-app notice on next open of the iOS and Android apps, and through a banner on next login to McCoy IQ.

9. CONTACT US

If you have any questions or suggestions about our Privacy Policy, do not hesitate to contact us at privacy@mccoy.io.

Data Rights Requests

Under California law (CCPA/CPRA), Virginia (CDPA), Colorado (CPA), Connecticut (CTDPA), and other applicable state laws, you have the right to:

1. Know: Request what personal information we collect and how we use it
2. Delete: Request deletion of personal information we hold about you
3. Correct: Request correction of inaccurate personal information
4. Portability: Request a portable copy of your data in machine-readable format
5. Opt-Out of Sale/Sharing: Request that we stop selling or sharing your data
6. Opt-Out of Profiling: Request that we stop using your data for automated profiling that may affect you significantly (CPRA only)
7. Non-Discrimination: We will not deny services, charge higher prices, or discriminate against you for exercising your rights

How to Submit a Request:

You can submit a request by:

• Web Form: Visit mccoy.io/privacy/requests to submit your request online
• Email: Contact privacy@mccoy.io and clearly state which right you are exercising (e.g., “Request to Know,” “Request to Delete”)
• Authorized Agent: If you designate an authorized agent to submit requests on your behalf, provide a signed power of attorney or authorization letter

Request Processing Timeline:

• Acknowledgment: We will acknowledge receipt of your request within 5 business days
• Completion: We will process and complete your request within 45 calendar days. If your request is complex or if we deny it, we will provide written notice explaining the reason within the 45-day period
• Extensions: For complex requests, we may extend the response period by an additional 60 days. We will notify you of any extension and explain the reason within the initial 45-day period

Identity Verification: To protect your privacy and prevent unauthorized access, we verify your identity before processing data rights requests. Verification typically requires:

• Confirmation of your email address associated with your account
• For sensitive requests (deletion, portability), we may request a photocopy of a government-issued ID (which we will not retain)

Request Exceptions: We may deny requests in these circumstances:

• You cannot be verified as the account holder
• The request conflicts with a legal obligation (e.g., we are required to retain data for tax, legal, or regulatory purposes)
• The request seeks information of another individual (privacy of third parties)
• Your account is subject to a violation investigation or legal hold (we will explain the reason and retention period)

Account Deletion vs. Data Deletion:

• Account Deletion: Deletes your profile, content, and contact information. However, some data may be retained per Section 10 (violations under investigation, legal holds)
• Data Deletion Request: Requests deletion of specific categories of data while keeping your account active (e.g., delete activity logs but keep profile)

Questions or Disputes: If we deny your request or you believe we failed to process it correctly, you can:

• Contact our Privacy Officer at privacy@mccoy.io
• File a complaint with your state’s Attorney General or Privacy Commission
• For California residents, file a complaint with the California Privacy Protection Agency (CPPA) at www.cppa.ca.gov

10. DATA RETENTION

We retain your personal information for as long as your account is active or as needed to provide the Services. Specific retention periods:

• Account data (profile, McCoy Reels, Targeted Reels): Retained while account is active; deleted on account deletion.
• Chat messages: Retained while account is active; deleted on account deletion.
• Media files (profile photos, video reels): Retained while account is active; deleted on account deletion.
• Analytics events: Retained for as long as necessary for support and product improvement.
• McCoy IQ McCoy IQ Respondent video responses: Retained while the McCoy IQ Respondent’s account is active.
• Reviewer notes and ratings on McCoy IQ Respondents: Retained for up to 3 years from last review.
• McCoy IQ organization records (no active subscription after trial/promo expiry): Deleted 90 days after expiry.
• Firebase Crashlytics crash reports: Subject to Google’s retention policy.
• Server infrastructure logs (including IP addresses): Automatically deleted after 90 days.
• Violation hold: Content or account data (including profile data, messages, media, IP logs, and device metadata) associated with a reported or flagged violation of our Terms of Service, Community Guidelines, or applicable law — where the report or flag was received before a deletion request is submitted — may be retained as follows:
  • Civil Violations (Community Guidelines): Up to 90 days from the date of the report, or until investigation concludes and enforcement action is taken (removal, suspension, termination), whichever is sooner. After the hold period expires, data is automatically deleted.
  • Potential Criminal Activity or CSAM: Data is retained until McCoy receives a legal hold order from law enforcement or a court order requires longer retention. Once the legal hold is lifted, data is deleted within 7 business days.
  • Legal Hold from Law Enforcement: If we receive a valid court order, subpoena, or legal preservation notice requiring retention, we will retain data as specified in the legal process. After the legal process concludes, data is deleted within 7 business days unless the order requires otherwise.

Investigation Timeline: We will conclude investigations within 30 days of the violation report. You will receive notice of the outcome (violation confirmed, no violation, or inconclusive).

Deletion Confirmation: After the violation hold period expires, we will automatically delete the data and send you a confirmation email within 7 business days.

11. ACCOUNT DELETION

You can delete your account at any time from the Settings screen in the iOS or Android app, from your account page in the McCoy IQ portal, or from the account management page at mccoy.io. When you delete your account, we permanently delete your profile, McCoy Reels, Targeted Reels, job applications, chat history, feed content, challenge responses, and associated media files. Deletion is permanent and cannot be undone. Exception: any content or account data associated with a reported or flagged violation received before your deletion request was submitted is subject to the violation hold described in Section 10 and will be deleted automatically once that hold expires.

12. DATA PORTABILITY

You have the right to download a copy of your personal data at any time. You can do this from the Settings screen in the iOS or Android app, from the account page in the McCoy IQ portal, or from the account management page at mccoy.io. Your data will be provided as a downloadable JSON file containing your profile information, McCoy Reels, job applications, and activity data. If you have difficulty accessing the download feature, you may also contact us at privacy@mccoy.io.

13. McCOY IQ — McCOY IQ RESPONDENT DATA

McCoy IQ — McCoy IQ Respondent Data and Automated Decision-Making Rights

If you participate in McCoy IQ as a McCoy IQ Respondent, your submitted video responses may be reviewed by third parties or organizations.

Review and Ratings:

McCoy IQ Users may view your video responses and add private notes and ratings to your McCoy IQ Respondent profile (such as “strong McCoy IQ Respondent,” “needs improvement,” or numerical scores). This data is retained for up to 365 days from the last review date.

Important for EU/EEA McCoy IQ Respondents: If you are based in the EU/EEA, reviewer notes and ratings on your response history may constitute “automated decision-making” under GDPR Article 22 if they are used to make hiring decisions. You have the right to:

• Request a human review of any hiring decision
• Obtain an explanation of how your response history was assessed
• Ensure the decision-maker is a human, not solely an algorithm

McCoy’s Role in Decision-Making:

• No Automated Scoring: McCoy does not automatically score, rank, or filter McCoy IQ Respondent video submissions. McCoy does not use facial recognition, emotion detection, or other biometric analysis on your videos.
• AI Tools (Not Evaluators): AI features (such as integration with Claude) are optional tools that McCoy IQ Users may use to assist with McCoy IQ Respondent review. These tools assist with content creation and challenge design but do not evaluate McCoy IQ Respondents or make final decisions. The McCoy IQ User makes all final decisions based on their review.
• McCoy IQ User Autonomy: McCoy IQ Users are responsible for all decisions concerning application or platform usage, including McCoy IQ Respondent evaluation. McCoy does not override McCoy IQ User judgment or impose algorithmic decisions.

Your Rights If Your Data Flows Through AI Tools:

If a McCoy IQ User uses McCoy IQ’s AI Developer Tools (such as integration with Claude or other AI assistants) to analyze your responses, your data flows to that AI provider. The processing is:

• Transient: Your data is processed to generate summaries/insights and then deleted (typically within 24–48 hours)
• Not Retained by AI Provider: The AI provider (e.g., Anthropic) does not retain your data or use it to train models
• Controlled by McCoy IQ User: The McCoy IQ User decides whether to use AI tools; you don’t have a separate opt-out for McCoy IQ User’s use of AI tools

14. BIOMETRIC DATA

Biometric Data — Video Content Consent. Our platform allows you to submit video content (reels and challenge responses in McCoy IQ) that may contain your facial image and voice. Under state biometric privacy laws (particularly the Illinois Biometric Information Privacy Act [BIPA]), facial geometry that could be derived from your video is considered “biometric information” and is subject to specific legal protections.

McCoy’s Use of Video Content: McCoy does not extract, analyze, process, or use facial geometry from your videos for any purpose, including:

• Facial recognition or identification
• Emotion detection or sentiment analysis
• Age estimation or demographic inference
• Training facial recognition models
• Sharing with third parties (including social media platforms you share to)

Your videos are stored as-is and displayed to other users on the platform (McCoy App Users, McCoy IQ Users, McCoy IQ Respondents, or other parties) without any facial processing or biometric analysis.

Your Biometric Data Rights (BIPA Compliance): Because facial geometry in your video may constitute biometric information under BIPA and California law, we must:

1. Obtain Your Written Consent before you submit video content
2. Inform You that we are collecting biometric information
3. Disclose the Purpose for which we collect biometric information
4. Disclose Retention Period how long we retain your biometric information
5. Provide Data Security measures protecting your biometric information
6. Prohibit Sale We will never sell, lease, trade, or profit from your biometric information

Biometric Consent — Before Your First Video Upload: When you first attempt to submit a video (Reel or IQ Challenge Response), you will receive a consent form.

After First Consent: You will receive this consent form once. If you upload additional videos later, you will see a reminder of your previous consent (not a full form). You can withdraw consent at any time by deleting videos or your account.

BIPA Compliance Certification: McCoy certifies that:

• Biometric information (facial geometry from videos) is collected only with written consent
• Biometric information is retained only while necessary to fulfill stated purposes
• Biometric information is NOT sold, leased, traded, or used to train models
• Biometric information is protected using encryption and access controls consistent with industry standards
• Data subject has right to request access, deletion, and information about uses
• We maintain records of all biometric data collection and destruction

Data Security for Biometric Information:

• Storage: Videos are stored encrypted on AWS servers in the United States
• Access Control: Only authorized McCoy staff (content moderation, abuse prevention) can access video content; access is logged and audited
• Transmission: Videos are encrypted in transit using TLS 1.2+
• Deletion: When you delete your account or request video deletion, videos are permanently deleted from our cloud storage systems within 7 business days

For Illinois Residents (BIPA Enforcement): If you are a resident of Illinois and believe McCoy has violated your biometric privacy rights, you can:

• Contact our Privacy Officer at privacy@mccoy.io for a resolution
• File a civil suit against McCoy (BIPA allows damages of $1,000–$5,000 per violation per person)
• Contact the Illinois Attorney General

Contact for Biometric Data Requests: To request access to, deletion of, or information about your biometric data:

• Email: privacy@mccoy.io
• Include “Biometric Data Request” in the subject line
• Specify: (1) which videos, (2) what information you want, (3) delete or access request
• We will respond within 15 business days

15. AI DEVELOPER TOOLS

AI Developer Tools and API McCoy IQ offers an API and developer tools, including an MCP (Model Context Protocol) server, for use with AI coding assistants such as Anthropic’s Claude. These tools allow developers to integrate McCoy IQ data into AI-powered workflows.

Data Flows Through AI Providers: When you use these developer tools with an AI coding assistant, the following data may flow to the AI provider:

• Organization details (company name, industry, size)
• Role descriptions and job requirements
• Challenge content (prompts, specifications)
• McCoy IQ Respondent response metadata (submission date, ratings, status)
• Note: McCoy IQ Respondent video responses do NOT flow to AI providers (only metadata)

This data is sent to the AI provider’s API (e.g., Anthropic’s Claude API) to fulfill your request (generating insights, summaries, comparisons, etc.).

Data Processing and Retention: The AI provider processes your data as follows:

• Transient Processing: Data is processed to generate your requested output and then deleted
• Deletion Timeline: Data is typically deleted within 24 hours (or immediately after request completion)
• No Model Training: Under McCoy’s Data Processing Addendum with the AI provider, your data is NOT used to train, fine-tune, or improve AI models
• No Retention: The AI provider does not retain your data for any purpose beyond fulfilling your immediate request

Your Rights:

• Opt-Out: You can choose not to use AI Developer Tools. All McCoy IQ core features function without AI integration.
• Data Subject Rights: You have the right to request what data was processed through AI providers, to request deletion, and to request a portable copy
• Transparency: McCoy will disclose any changes to AI provider partnerships or data handling practices

AI Provider Agreements: McCoy has Data Processing Addenda (DPAs) with all AI providers that include:

• Prohibition on data use for model training
• Deletion of data after request processing (max 30 days retention)
• GDPR Article 28 compliance (if your data includes EU resident information)
• Security standards (encryption in transit, access controls)
• Confidentiality and non-disclosure obligations: For the current list of AI providers and their data handling practices, see mccoy.io/privacy/ai-providers.

Questions About AI Processing: If you have concerns about AI processing of your data:

• Contact privacy@mccoy.io with “AI Data Processing” in the subject
• Request: (1) what data was processed, (2) which AI provider, (3) when deleted
• We will respond within 15 business days.

16. HOW WE SHARE YOUR INFORMATION

We do not sell your personal information. We may share your information in the following limited circumstances:

• Service Providers: We share information with the third-party service providers listed in Section 1 and at mccoy.io/privacy/sub-processors, solely to operate the Services. Each provider is contractually restricted from using your data for any other purpose.
• Legal Process and Law Enforcement: We may disclose your information if required to do so by law, court order, subpoena, or other legal process, or if we believe in good faith that disclosure is necessary to: (a) comply with applicable law or respond to a valid legal request; (b) protect the rights, property, or safety of McCoy, our users, or the public; or (c) detect, investigate, or prevent fraud or security incidents.
• Business Transfer: If McCoy is involved in a merger, acquisition, asset sale, partial asset sale (including a sale of only the McCoy IQ product line or only the consumer app), corporate reorganization, or formation of subsidiaries to which operations are transferred, your information may be transferred as part of that transaction. We will notify you via email or a prominent notice on the Services at least 30 days before your information becomes subject to a materially different privacy policy. If we create a subsidiary that processes your data, that subsidiary will be listed as a sub-processor at mccoy.io/privacy/sub-processors.
• With Your Consent: We may share your information for other purposes with your explicit consent.
• Aggregate and De-identified Data: We may share aggregate or de-identified data — which cannot reasonably be used to identify you — for product improvement, research, or business purposes.

17. CONTENT FEED AND JOB RECOMMENDATIONS

Content Feed: The McCoy app displays a feed of content from other users. The feed order is randomized — it is not ranked by an algorithm that analyzes your behavior, preferences, or engagement history. McCoy does not use machine learning, behavioral signals, or profiling to personalize your feed. Different users see different random orderings, but this randomization is not based on personal characteristics or protected class information.

Job Recommendations: The McCoy app surfaces job listings from a third-party job data provider (JobData API, jobdataapi.com). To generate relevant results, your profile information (skills, experience level, location preferences) and career insights are processed by Anthropic’s API to produce structured search parameters (such as job title, location, and experience filters). These search parameters — not your personal information — are then sent to JobData to retrieve matching listings. Anthropic does not retain your profile data or use it for model training under our API agreement.

Search: You can also search for feed content and job listings directly using the in-app search bar and filters. Search queries you enter are used solely to return results and are not linked to your profile for advertising purposes.