Privacy Policy

Account information. Your email address and, optionally, your name — either entered directly at signup or provided by Google if you use "Continue with Google". If you sign in with Google, we receive your Google account ID, email address, name, and whether Google considers that email verified. We do not receive your Google password.

Content you provide. Job applications, companies, contacts, interview notes, and resume/cover-letter text you enter or upload to track your job search.

Files you upload. Resumes, cover letters, and other documents you attach to an application, stored via Cloudinary.

Usage data. Basic technical data generated automatically by any web request — IP address, user agent, and timestamps — used for security (e.g. rate limiting, refresh-token theft detection) and diagnostics, not for tracking or advertising.

• To provide the Service: storing and displaying your applications, documents, and interview data.
• To generate AI interview-prep content: the job description, your resume highlights, and related application details you provide are sent to a third-party AI provider (Anthropic's Claude, or Google's Gemini) to produce prep material at your request.
• To send transactional email: account verification, and optional reminders/notifications about your applications.
• To keep the Service secure: authentication, session management, and abuse prevention.

We do not sell your data, and we do not use it for advertising or third-party marketing.

The following providers process data on our behalf, only as needed to run the Service:

• Google — Sign-In (OAuth), if you choose to use it.
• Anthropic / Google Gemini — AI-generated interview preparation content.
• Cloudinary — file storage for uploaded documents.
• Resend — transactional email delivery.
• Railway and Vercel — application hosting and the database.

Each operates under its own privacy policy governing how it handles data on our behalf.

The Service uses two strictly-necessary, HttpOnly cookies to keep you signed in (an access token and a rotating refresh token). Neither is readable by JavaScript, and neither is used for tracking or advertising. We do not use third-party analytics or ad cookies.

We retain your account and content for as long as your account exists. This is a small, independently-run project without a self-service account-deletion flow yet — to request deletion of your account and associated data, contact us at the address below and we will process the request promptly.

Passwords are hashed with Argon2 and never stored in plain text. Sessions use rotating, hashed refresh tokens with theft detection. Traffic is encrypted in transit (HTTPS) in production. No method of transmission or storage is 100% secure, but we take reasonable measures appropriate to a project of this size.

The Service is not directed at children under 13, and we do not knowingly collect information from them.

We may update this policy as the Service changes. Material changes will be reflected by updating the date at the top of this page.

Questions about this policy or a data request? Email abushamasanad@gmail.com.