Privacy policy

JobAlong (“we”, “the service”) is operated by [LEGAL ENTITY] of [REGISTERED ADDRESS], the data controller for the personal data described here.

Questions, requests, or complaints: [CONTACT EMAIL]. We answer within 30 days.

This policy is governed by the law of [JURISDICTION].

From your Google account, only after you grant consent, and only through read-only access:

• Email — sender address, subject line, date, and Gmail’s message and thread identifiers, used to detect replies from recruiters and hiring managers and to reconcile applications you forgot to log. To classify a message — rejection, interview invite, recruiter reply — its text is read and up to 4,000 characters of it are sent to the language model; for job-alert digests, up to 20,000 characters, to extract the roles they list. The text is never written to our database: what we store is sender, subject, date and the classification.
• Calendar events matched to your job search — the service reads your upcoming events and compares them against the companies and contacts already in your own pipeline. Attendee email addresses are fetched solely to make that comparison and are processed in memory — never stored, never logged. Only matched events are stored: their times, title, and which company or contact they matched. Unmatched events are discarded entirely, and locations, descriptions and meeting links are never requested from Google at all. Matched titles and times also become interview records, so preparation, follow-up reminders, and notes you add remain available after the meeting.
• Basic profile — your name, email address, and Google account identifier, used to create and identify your account.

From you directly: your résumé (parsed into structured claims you approve individually), your LinkedIn profile URL, optional contact lists you import, your target roles, locations, compensation floor, exclusions, and everything you type into the copilot.

Generated by the service: the roles it finds and verifies, the drafts it prepares for you, your application and outreach history, and an event log of actions taken in your account.

We do not use third-party analytics, advertising trackers, or session recording. We set one cookie, for your signed-in session.

• We never send anything on your behalf. JobAlong holds no permission to send email, submit applications, or message anyone. It prepares; you send. This is enforced by the access we request, not by a setting you could switch off.
• We never sell your personal data, and we never share it with data brokers or advertisers.
• We never use your data to train machine-learning models. The built-in model provider is contractually barred from training on what we send it. If you connect your own ChatGPT account (optional, off by default), your content goes to OpenAI under your own agreement with them — see clause 5.
• We never store your email bodies. Message text is read in transit to classify it, and discarded once that call returns. There is no column for it in our database.

JobAlong’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.

Specifically, data obtained through Google APIs is:

• used only to provide and improve the features you can see in the product — reply detection and classification, application reconciliation, and interview detection from invite emails and matched calendar events;
• never transferred to others except as needed to provide those features, to comply with applicable law, or as part of a merger or acquisition with notice to you;
• never used for advertising, and never sold;
• never used to develop, improve, or train generalised or non-personalised AI or machine-learning models. Where the service calls the built-in language model (see clause 5), the provider is contractually bound not to train on the data sent to it; if you connect your own ChatGPT account, data sent there is governed by your agreement with OpenAI.

Only the scopes gmail.readonly and calendar.readonly are ever requested. If Google were to return any broader permission, the service rejects the connection and stores nothing.

We keep the list of processors deliberately short. Each one receives only what its job requires:

• Anthropic — the built-in language model behind the copilot, résumé parsing, email classification, and draft generation. It receives the text needed for the task at hand, under terms that prohibit training on it.
• OpenAI — only if you connect your own ChatGPT account in Settings, which is optional and off by default. From that moment your model work — the copilot, résumé parsing, email classification, draft generation, and the email text those tasks need — is sent to OpenAI under your account instead of to Anthropic. That includes Gmail-derived data. We send requests with storage disabled, but what OpenAI retains is governed by your agreement with them, not by ours. Disconnecting in Settings stops this immediately.
• Google — the source of the email and calendar data described above, and our sign-in provider.
• Cloudflare — routes traffic to the service and terminates the HTTPS connection at its edge, which means encrypted traffic passes through their network in the clear before reaching us. They act as a network provider, not a recipient of your data: nothing is stored with them.
• [HOSTING] — the server and database, located in [REGION].

• All traffic is served over HTTPS.
• Your Google access and refresh tokens are encrypted at rest with AES-256-GCM under a key held only by the server. They are never included in data exports.
• The database is not reachable from the public internet.
• Backups are taken daily and retained for 14 days.

No system is perfectly secure. If a breach affects your personal data, we will notify you and the relevant supervisory authority as required by law.

We keep your data until you delete it. There is no automatic expiry: your application history and the email metadata behind it stay useful for as long as your search runs, and we would rather be plain about that than advertise a retention window we do not enforce.

When you delete your account, everything is removed immediately — profile, facts, applications, contacts, email metadata, chat history, interview history and notes, commitments, postponed tasks, notifications, and stored Google tokens. Deletion is not reversible. Backups still containing your data age out within 14 days.

The temporary calendar sync cache removes events more than a day after they end. Your separate interview history, including the matched title and time, preparation notes, and follow-up actions, stays with your account until you delete the account.

Disconnecting Google, without deleting your account, stops all further reading and removes the stored credential.

Two of these are buttons in Settings, not requests you have to send us:

• Export everything. A complete JSON file of your profile, facts, settings, companies, roles, contacts, applications, outreach history, event log, email metadata, matched calendar events, interview history and notes, commitments, postponed tasks, notifications, submitted application materials, imports, and chat.
• Delete everything. Immediate and complete removal of your account and all associated data.
• Disconnect Google at any time, keeping the rest of your account.

Depending on where you live, you may also have the right to correct inaccurate data, restrict or object to processing, and complain to your data protection authority. Write to [CONTACT EMAIL] and we will act within 30 days.

You can also revoke JobAlong’s access directly from your Google account permissions page.

JobAlong is for working professionals and is not directed at anyone under 16. We do not knowingly collect their data.

If we change how we handle your data in any way that matters, we will say so by email before the change takes effect — not by quietly editing this page and moving the date at the top.