this privacy policy explains how applyied ("applyied," "we," "us") collects, uses, shares, and protects information when you use our website and job application tracking service (the "service"). it also explains the choices and rights you have. by using the service, you agree to the practices described here. this policy is incorporated into our terms of service.
1. information we collect
we collect the following categories of information:
account information: the email address, name, and password you provide when you create an account. passwords are stored in hashed form by our authentication provider (firebase authentication) and are never visible to us. if you sign in with google, we receive your google account email and basic profile information.
application data: the job applications you choose to track, including company names, role titles, locations, dates, statuses, status history, links, and personal notes.
job posting links: if you paste a posting link to fill the form, our server requests that page and reads a handful of factual fields out of it. the link itself is saved with your application because it is one of the fields you are saving. the page's text is not. see section 7.
resume review inputs: if you use the bring-your-own-key resume review, your pdf is read locally in your browser and the extracted text (plus any job description you paste) is sent directly from your browser to the ai provider you selected. this content does not pass through or get stored on applyied's servers.
technical information: our hosting and infrastructure providers automatically log basic request data, such as ip address, browser and device type, pages requested, and timestamps, used for security, abuse prevention, debugging, and capacity planning.
2. cookies and local storage
we do not use advertising cookies or third-party analytics trackers. we use browser storage for the service to function:
authentication state, kept by firebase so you stay signed in.
interface preferences, such as your dashboard view, sort order, and filters.
a cached list of your recruiting seasons, so navigation renders quickly.
autocomplete suggestions derived from your own applications.
your ai api keys, if you use bring-your-own-key features: session storage by default, local storage only if you choose "remember on this device."
this data stays on your device and can be removed by clearing your browser storage. because we do not respond to them differently, "do not track" signals have no effect, there is no cross-site tracking to disable.
3. how we use your information
to provide the core service: tracking, syncing, and displaying your applications, seasons, and stats.
to create and secure your account and authenticate your sign-ins.
to protect the service from abuse, including applying rate limits to features that make outbound requests on your behalf.
to maintain, debug, secure, and improve the service, including investigating abuse.
to communicate with you about your account, such as security or service notices.
to comply with legal obligations and enforce our terms of service.
we do not sell your personal information, we do not use it for advertising, and we do not track you across other websites. we have not sold or shared personal information as those terms are defined under u.s. state privacy laws.
4. legal bases for processing
if you are in the european economic area or the united kingdom, we process your information on these legal bases: performance of a contract (providing the service you signed up for), legitimate interests (securing and improving the service, preventing abuse), consent (where you choose to use optional features, which you can withdraw by stopping use of the feature), and compliance with legal obligations.
5. how we share information
we do not sell your personal information. we share it only as described here:
service providers: google firebase (authentication and database hosting) and vercel (website hosting and delivery) process data on our behalf to run the service. firestore access rules are scoped so only your signed-in account can read or write your data.
sites you link to: when you use job posting link autofill, our server requests the page at the link you gave it. that site receives the request and the technical metadata any web request carries, such as the requesting ip address and a user-agent string identifying applyied. we do not send your name, email, account identifier, or application history with it, and the request is not attributable to you by the site that receives it.
ai providers you choose: bring-your-own-key features send your submitted content directly from your browser to the provider you selected (anthropic, openai, google, or groq), under that provider's privacy policy, see section 6.
legal and safety: we may disclose information if required by law, legal process, or governmental request, or where necessary to protect the rights, safety, and security of applyied, our users, or the public.
business transfers: if applyied is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction, subject to this policy's commitments.
aggregated or de-identified data: we may use and share data that can no longer reasonably identify you (for example, overall usage statistics) for any purpose.
6. bring-your-own ai api keys
your api key is stored only in your browser: session storage by default (cleared when the tab closes), or local storage if you choose "remember on this device." it is never transmitted to, stored on, proxied through, or logged by applyied's servers.
requests go directly from your browser to the provider you selected. the content you submit is handled under that provider's own privacy policy and terms, not ours; providers may retain or process it according to their policies. do not submit content you are not comfortable sharing with that provider.
usage is billed to your key under your agreement with the provider. you are responsible for all charges.
security of the key on your device is your responsibility: anyone with access to your device or browser profile could use a remembered key. use a dedicated, spend-limited key; avoid "remember" on shared devices; revoke the key from the provider's console if you believe it was exposed. clearing the key field in the app, or clearing browser storage, removes it from your device.
your resume pdf is parsed locally in your browser; the file itself is never uploaded to applyied or, unless the provider's api requires it, to anyone else, only the extracted text is sent to your chosen provider.
7. job posting link autofill
you can paste a link to a job posting and have the add form filled in for you. this is what that does:
each fetch happens because you asked for it. our server requests the single page at the link you pasted, at the moment you press the button. we do not crawl, index, follow links off that page, or fetch anything you did not paste.
the request is made by our server rather than your browser, so the site receives our infrastructure's ip address and a user-agent string naming applyied, not your device, your browser, or anything identifying you.
we request only pages that are publicly reachable over https. we do not sign in, send credentials or cookies, or attempt to get past a paywall, login wall, or any other access control. requests to private, internal, loopback, or link-local network addresses are refused outright.
we read a small number of factual fields out of the page: the employer name, the role title, the location, and any team named in the title. no language model is involved and nothing is generated, the fields are read from the page's own published markup.
the rest of the page is discarded as soon as those fields are read. we do not store, log, republish, redistribute, or train on posting content, and the posting text never reaches your account. only the fields that land in the form are kept, and only if you choose to save the application.
autofilled fields can be wrong or out of date, they are only as good as what the posting published. check them before you save.
you are responsible for the links you submit, including whether you are permitted to access the page. see the terms of service.
8. data retention
we retain your account and application data for as long as your account is active. if you delete your account, we delete your personal information within a reasonable period, except where retention is required for legal, security, fraud prevention, or backup-integrity purposes, in which case we retain only what is necessary, for only as long as necessary. technical logs held by our infrastructure providers rotate on their standard schedules.
9. security
we use industry-standard safeguards: encrypted connections (https) for all traffic, managed authentication with hashed credentials, per-user database access rules enforced server-side, and least-privilege access to infrastructure. no method of transmission or storage is completely secure, so we cannot guarantee absolute security. if we learn of a breach affecting your personal information, we will notify you and the relevant authorities as required by applicable law.
10. international data transfers
we are based in the united states and our service providers store data in the united states or other countries where they operate. if you use the service from outside the u.s., your information will be transferred to and processed in countries whose data-protection laws may differ from yours. where required, our providers rely on recognized transfer safeguards (such as standard contractual clauses).
11. your rights and choices
depending on where you live (including under the gdpr, uk gdpr, and u.s. state privacy laws such as the ccpa/cpra), you may have the right to:
access the personal information we hold about you, and receive a copy of it.
correct inaccurate information.
delete your information.
export your data in a portable format.
object to or restrict certain processing, and withdraw consent where processing is based on consent.
not be discriminated against for exercising any of these rights.
you can exercise the most important ones directly: export your application data and delete your account from the settings page. for anything else, contact us at the address below and we will respond within the timeframe required by applicable law. if you are in the eea or uk, you also have the right to lodge a complaint with your local supervisory authority.
12. children's privacy
the service is not directed at children under 13, and we do not knowingly collect personal information from children under 13 (or below the applicable age of digital consent in the eea/uk, which ranges from 13 to 16). users under the age of majority may use the service only with the consent and supervision of a parent or legal guardian, as described in the terms of service. if you believe a child under the applicable age has provided us personal information, contact us at team@applyied.com and we will delete it promptly.
13. third-party links
the service links to third-party sites, such as job postings you save and ai provider consoles. those sites have their own privacy practices, which we do not control and are not responsible for. review their policies before providing them information.
14. changes to this policy
we may update this privacy policy from time to time. when we do, we will revise the "last updated" date above and, for material changes, provide additional notice where appropriate (such as an in-app message). changes apply going forward from their effective date.
15. contact us
questions about this policy or your information? email us at team@applyied.com.