Privacy Policy

1. What we collect

Different actions create different data. Here is everything we collect, by source.

When you sign in

• Google OAuth (Sign in with Google): we receive your email address, name, and profile picture URL. We use the openid, email, and profile scopes. This is the same data Google shows you on the consent screen.
• Email one-time code (OTP): you give us an email address. We send a 6-digit code to that address. No Google scopes are involved. The code expires in 5 minutes.
• Session cookie: after sign-in we set an auth_token cookie on .applyguide.net. It is HTTP-only, Secure, and used to keep you signed in.

When you upload a résumé

• The PDF you upload. We store the original file in Amazon S3.
• The parsed sections. We extract structured fields (name, contact info, summary, experience, education, skills) and store them in DynamoDB so we can re-render and edit the résumé.
• Pipeline captures. We save the inputs and outputs of each AI call (parse, optimize, tailor) to a private S3 bucket so we can debug quality issues and improve the prompts. Access is restricted to the founder.

When you tailor against a job description

• The job description text you paste. We send it to OpenAI as part of the tailor prompt. We store it inside the short-lived "fit session" record for that tailor run.
• The fit result. Score, verdict (Apply / Hold / Skip), keyword overlap, and the rewritten bullets.

When you pay

• Stripe handles all payment data. Card numbers never reach our servers. We receive your Stripe customer ID, subscription status, plan, and billing email.

Automatically, on every visit

• IP address and user agent. Recorded in server logs for rate-limiting and abuse prevention.
• Cookies and local storage for sign-in state, feature flags, and analytics (see Analytics & advertising).

2. How we use it

• Run the product. Parse your résumé, score it against a JD, generate the tailored version, render the PDF, deliver it back to you.
• Bill you. Pass your Stripe customer record between our servers and Stripe to manage subscriptions and one-time purchases.
• Send transactional email. Sign-in codes, receipts, account notices. Sent through AWS SES from support@applyguide.net or noreply@applyguide.net.
• Debug and improve. Founder-only access to pipeline captures so we can fix bad outputs. We do not currently sell, license, or hand pipeline captures to anyone else.
• Measure marketing. Anonymous (and pseudonymous, after sign-in) analytics so we know which channels and pages work. See Analytics & advertising.
• Prevent abuse. Rate-limit signup spam, OTP brute-force, and tailor flooding. Block obvious automated traffic.

We do not train external AI models on your résumé. The model providers we use (OpenAI, Anthropic) operate under their API terms, which prohibit training on API customer data by default. We do not opt in to any training-on-customer-data program.

3. Subprocessors

We rely on the companies below to actually run ApplyGuide. Each one only receives the data it needs to perform its job. A full table with links lives at /legal/subprocessors and is the source of truth.

If we add or replace a subprocessor we will update the table at /legal/subprocessors. Material changes will be flagged in-app.

4. Analytics & advertising

Be honest: we run ad-attribution and product-analytics scripts on the web app. They are listed here so you know what is firing.

• PostHog — product analytics, plus session replay. Session replay records the pages you interact with as a playback. This means if you have a résumé visible on screen, that visible content can appear in the recording. We use this to debug bugs and watch user flows. Replays are scoped to our PostHog project; only the founder views them. You can opt out via the link in Section 10.
• Google Analytics 4 and Google Ads — page views and conversion events tied to a pseudonymous cookie.
• Meta Pixel + Conversion API — page events and conversion events tied to a pseudonymous Meta cookie. We send hashed email on conversion when available.

We are working on a cookie consent banner. Until it ships, you can opt out of behavioral analytics by:

• Using a browser-level Do Not Track / private mode that blocks third-party scripts; or
• Emailing us via the bug-report channel (see Section 15) and we will manually disable analytics for your account.

5. Gmail (opt-in legacy feature)

ApplyGuide started as a Gmail job-application tracker. That feature still exists in the codebase and is opt-in only. You will not give us any Gmail access unless you specifically click "Connect Gmail" and complete the Google consent screen.

If you do connect Gmail:

• We request the gmail.readonly scope.
• We can read your messages to identify job applications. We cannot send, delete, modify, or forward email.
• We cannot access your contacts, calendar, drive, or other Google services.
• OAuth tokens are encrypted at rest using Fernet (AES-128-CBC with HMAC-SHA256).
• Email metadata (subject, sender, date, snippet) we extract is stored in DynamoDB tied to your account.

Revoking access: visit Google Account Permissions to disconnect ApplyGuide. Revoking on Google's side stops new email reads. To erase email data already stored, also delete your ApplyGuide account (see Section 9).

ApplyGuide's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not transfer Google user data except as needed to provide the feature, and we do not allow humans to read Google user data except (a) with your explicit consent, (b) for security investigations, or (c) where required by law.

6. Chrome extension

Our Chrome extension has its own privacy policy at /legal/extension-privacy.html. It only acts on pages where you click Analyze, sends the job description to our server, and does not touch Gmail.

7. Retention — how long we keep things

• Account record (email, name, settings): for as long as your account exists.
• Résumé PDF and parsed sections: kept until you delete your account. (Note: we are extending account deletion to also remove résumé files from S3 within the next 30 days — see Section 9. Today, account deletion erases your DynamoDB records but the original PDF and parsed sections may remain in S3 until that work ships. We will not access those files except to fulfill the pending deletion or for security investigations.)
• Fit sessions (job description + tailor result): automatically deleted after 3 days via a DynamoDB TTL.
• Saved Jobs items (extension): automatically deleted after 7 days per item via a DynamoDB TTL.
• Chat / interview-prep messages: 30 days for free users, 180 days for Pro, then auto-purged.
• Email OTP records: 5 minutes.
• Server logs (IP, user agent, request paths): AWS CloudWatch default retention. We don't tie raw logs to user profiles outside of incident response.
• Stripe customer / subscription / invoice records: retained per Stripe's policy. Required for tax and accounting.
• Pipeline captures (résumé + JD + AI inputs/outputs in S3): retained until manually purged. Founder-only access. We are reviewing whether to add an automatic lifecycle rule.

8. Security

• All traffic between your browser and our servers uses TLS 1.2 or higher.
• Résumé files in S3 are encrypted at rest with SSE-S3 (AES-256).
• DynamoDB records are encrypted at rest with AWS-managed AES-256.
• Gmail OAuth tokens are encrypted at the application layer with Fernet before they hit DynamoDB.
• Secrets (API keys, JWT signing keys) live in AWS Secrets Manager.
• We rate-limit signup, OTP, and tailor endpoints.

No system is perfect. If you find a security issue please report it via the bug-report channel in Section 15.

9. Your rights — access, export, delete

• Access: the app shows you your résumé, score history, and account email. You can request a full machine-readable export by contacting us (see Section 15).
• Export: we will send you a structured export containing your account record, résumé parsed sections, fit-session metadata, and download links to your original / optimized / tailored PDFs. Available on request.
• Delete your account: Settings → Manage Account → Delete Account. This erases your DynamoDB records (account, résumé parsed sections, fit sessions, applications, chat history). We are extending the deletion cascade to also delete your résumé files in S3; that work is in progress and we expect it live within 30 days of this policy's last-updated date. Until it ships, you can email the bug-report channel to request manual S3 erasure and we will complete it within 30 days.
• Revoke Gmail access: Google Account Permissions.
• Correction: the in-app résumé editor lets you correct anything we parsed wrong. For account-level corrections, contact us.
• Object / restrict processing (EU/UK users): contact us and we will pause non-essential processing and document the request.

10. California residents (CCPA / CPRA)

If you live in California, you have the right to know what personal information we collect, to access it, to delete it, to correct it, and to opt out of "sales" or "sharing" for cross-context behavioral advertising.

We do not sell personal information for money. However, our use of Meta Pixel and Google Ads may qualify as "sharing" under the CCPA because those tools use your data to optimize advertising audiences. You can opt out of this sharing by:

• Emailing us via the bug-report channel (Section 15) with the subject line "Do Not Sell or Share." We will disable Meta and Google ad pixels for your account and respond within 15 business days.
• Sending a Global Privacy Control signal from your browser. We honor GPC where it reaches our pages.

We do not knowingly sell or share information of minors under 16.

11. EU / UK residents (GDPR / UK GDPR)

Our legal basis for processing your data depends on the activity:

• Performance of a contract: running the résumé optimizer, billing you, sending sign-in codes.
• Legitimate interests: debugging, security, abuse prevention, basic analytics.
• Consent: Gmail integration (Google's consent screen), behavioral advertising pixels, and session replay (where required by local law).
• Legal obligation: tax records, response to lawful requests.

You can lodge a complaint with your local data protection authority. In the UK that is the ICO. We do not currently have an EU representative; if you are an EU data subject and need to reach us, use the bug-report channel in Section 15.

Some of our subprocessors (OpenAI, AWS regions, Stripe) are based in the United States. Where we transfer EU/UK personal data to the US, we rely on the recipient's Standard Contractual Clauses or equivalent safeguards.

12. Subscriptions, auto-renewal, and cancellation

ApplyGuide offers three paid tiers:

• Pro Weekly — $8.99 per week, recurring. Renews automatically every week until you cancel.
• Pro Unlimited — $19.99 per month (or $8.99 per month if upgraded from inside the dashboard), recurring. Renews automatically every month until you cancel.
• Three Months — $39.99 one-time. Does not renew. Access expires after three months.

California ARL and similar state laws notice: recurring plans renew automatically at the stated price and cadence until you cancel. You can cancel any time from Settings → Manage Subscription, which opens the Stripe Customer Portal. Cancelling stops future renewals; you keep access until the end of the current billing period.

Refunds: we do not offer refunds for completed billing periods. You may cancel any time to stop future charges. Where required by law, we will honor mandatory refunds (for example, EU consumer cooling-off rights for one-time purchases that have not been used). Chargebacks are processed by Stripe under its standard policies.

13. Children

ApplyGuide is intended for adults aged 18 or older. We do not knowingly collect personal information from children under 13 (or under 16 in the EU/UK). If you believe a minor has provided us data, contact us via the bug-report channel in Section 15 and we will delete the data.

14. Changes to this policy

If we change this policy materially we will update the "Last updated" date at the top and, for significant changes, notify signed-in users in the app or by email. Continued use after the effective date constitutes acceptance.

15. Contact

To exercise any right above, ask a question about this policy, or report a bug, please use the in-app bug report form:

We aim to respond within 5 business days. For requests under GDPR or CCPA we will respond within the timeframes those laws require (typically 30 and 45 days respectively).