Overview

This policy explains what information ApplyOS (operated by an individual sole proprietor) collects, how we use it, and the choices you have. ApplyOS is built for students and early-career job seekers, and we only collect what's needed to run the service.

Information we collect

Account information: your email address, and your name if you provide one.
Content you provide: resume text and files, job descriptions, LinkedIn profile text, cover letters, and job-tracker entries you enter to use the product.
Usage data: which features you use and how often (for example, number of scans), used to enforce plan limits and improve the product.
Payment information: handled entirely by Stripe. We never receive or store your full card number. Stripe shares with us only what's needed to manage your subscription (such as plan status and renewal date).

How we use your information

ApplyOS uses AI to draft editable suggestions from relevant application information. Keyword suggestions use selected resume context and the clicked job requirement. Suggested drafts are not verified claims about your experience.

We use your information to: create and secure your account; generate your scans, rewrites, cover letters, and exports; enforce free-plan usage limits; process payments and manage subscriptions; send account-related email (confirmation, password reset, receipts); and respond to support requests. We do not sell your personal information or your resume content to anyone.

Third-party service providers

We share information with the following providers, solely to operate ApplyOS on our behalf:

• Supabase: hosts our database and handles account authentication. Your account data and saved content (resumes, scans, cover letters, LinkedIn reports, job-tracker entries) are stored here.
• Stripe: processes payments. Stripe's own privacy policy governs the payment details you enter at checkout.
• Transactional email: sign-up confirmation and password-reset messages are sent through our authentication provider, Supabase, which may use an email delivery service to send them. Your email address is used for this purpose only. We are confirming the delivery service currently configured and will name it here.
• Upstash: provides rate-limiting infrastructure using your IP address and request pattern; it does not receive your resume or account content.
• OpenAI: where AI-assisted generation is enabled, the resume text and job description you submit for that specific scan, rewrite, or cover letter are sent to OpenAI's API to generate the suggestion. OpenAI processes this text to return a response and does not use API-submitted content to train its models under OpenAI's API terms.
• Logo.dev: shows employer logos next to job listings. ApplyOS sends Logo.dev an employer's name to find that employer's website, and your browser then loads the logo image from Logo.dev, which receives your IP address. No resume, account or application content is sent.
• Adzuna: provides the live job listings in Find Jobs. When you search, we send Adzuna the role you are targeting, the location you have set, and up to four skill keywords taken from your profile, so the results match what you are looking for. We do not send your resume, your name, your email address or any scan result.
• OpenStreetMap (Nominatim): turns coordinates into a city name, only when you use the “use my location” control in Find Jobs and your browser asks your permission first. Your device’s coordinates are sent from our server rather than from your browser, so Nominatim does not receive your IP address, and we do not store the coordinates.

Data storage & security

Your account data and content are stored in our Supabase-hosted database with row-level security, meaning our infrastructure is configured so your data is only readable by your own account (or by our systems for functions like billing, which run with restricted service-level access). Data is encrypted in transit. No online service can guarantee absolute security, but we take reasonable technical measures to protect your information.

Job descriptions and the shared requirement cache

When you run a scan, we analyse the job description to work out what the role actually requires. That analysis is expensive to produce, so we store it and reuse it: the normalized text of the job description and the list of requirements derived from it are kept in a shared cache for up to 180 days after the last time that posting is scanned, and are then deleted automatically.

Two things are worth being explicit about. First, this cache is not tied to your account: it holds no user identifier, and it is not deleted when you delete your account, because at that point it is an analysis of a job posting that other applicants may also be scanning. Second, your resume is never part of this cache. Resume text, your name, your contact details and your scan results are stored separately against your account and are deleted with it.

The cache is readable only by our own server processes. Its contents are never exposed to other users: what another person's scan reuses is the derived list of requirements, never text you pasted.

Data retention & deletion

We retain your account and content for as long as your account is active. You can permanently delete your account and all associated data at any time from Settings, or by contacting us at the email below. We may retain minimal records where required for legal, tax, or fraud-prevention purposes even after account deletion. As described above, cached job-description analysis is retained for up to 180 days after a posting is last scanned, independently of account deletion.

Scans run while you are signed out are not stored on our servers. Without an account there is nothing to attach a scan to, so the resume text and the result are returned to your browser and no copy of them is written to our database. The two exceptions are described elsewhere on this page and both are visible to you: the job-description analysis is cached for up to 180 days and never includes your resume, and a scan you explicitly ask us to hold while you sign in is kept for 30 minutes in that one browser tab. Once you have an account, scans you run while signed in are stored against it and are deleted when you delete it.

Your rights

Depending on where you live, you may have the right to access, correct, or delete your personal information, or to object to certain processing. California residents have rights under the California Consumer Privacy Act (CCPA), including the right to know what personal information we hold and to request its deletion. To exercise any of these rights, contact us at the email below. We'll respond within a reasonable time and verify your identity before making changes.

Cookies & analytics

For signed-in accounts, we record report views and prepared exports in our existing Supabase database, associated with the account ID and timestamp. These learning events contain only the event name, not resume text, job descriptions, cover letters, filenames, page URLs, or email addresses. A prepared export does not prove that a file was saved or an application was submitted.

We currently use only the essential cookies required for you to stay signed in (set by Supabase authentication). No analytics or advertising tracker runs on ApplyOS, and none loads in your browser.

For transparency: our code contains a Meta advertising pixel that was added in preparation for a future advertising campaign. It is switched off, it does not load, and it sends nothing. We will not turn it on without first naming Meta in this policy, describing exactly what it would collect, and giving you a choice about it.

The waitlist form (Tally)

While ApplyOS is in private beta, the plan buttons open a waitlist form hosted by Tally (tally.so) in a new tab. The form is Tally’s, not ours: it is not embedded in this site, and ApplyOS receives nothing from it automatically.

What that means in practice. Whatever you type into that form is submitted to Tally and held by Tally, under Tally’s own privacy policy, and we read it by signing in to their service. Nothing you enter there reaches an ApplyOS account, and joining the waitlist does not create an account, grant access to the product or add you to any mailing list we operate.

We have not independently verified how long Tally retains form responses, how a response can be deleted, or whether they send anything in reply, so we are not going to state those here as if we had.

If you want your waitlist entry removed, email us at the address below and say so. What we can commit to today is this: we will reply, and we will use whatever removal controls Tally provides on the account that holds the form. We are deliberately not promising a deadline, an automated confirmation, or that the entry can be erased from Tally’s own systems and backups, because we have not yet tested those controls ourselves. When we have, we will say precisely what the process is here. Tally publishes its own terms and privacy policy at tally.so.

Information stored in your browser

ApplyOS keeps some information in your own browser rather than on our servers, using the browser’s local and session storage. This is not a cookie and it is never sent to us automatically.

• Sample content. On your first visit we place example resumes and example job applications in your browser so the product is not empty. These are fictional and are not about you.
• Your working copies. Once you use the product, resume drafts, scans and tracked applications are cached in your browser so your work survives a reload. When you are signed in, these are stored under a key tied to your account, so a different account signing in on the same browser cannot read them.
• A scan you chose to keep. If you run a scan while signed out and ask us to hold it while you sign in, the resume text, the job description and the result are kept for 30 minutes in that one browser tab only. You are asked before this happens, and you can discard it at any time.
• Preferences and counters. Small values such as your job-search location and how many free scans this browser has used.

Signing out does not erase these working copies, deliberately: a session can end without warning and we do not want to destroy unsaved work. Deleting your account removes your data from our servers but does not reach into your browser. To clear the browser copies, use your browser’s “clear site data” control for applyos.co, or sign out and clear site data on a shared computer.

Do Not Track and Global Privacy Control

Some browsers can send a “Do Not Track” (DNT) signal or a Global Privacy Control (GPC) signal. ApplyOS does not currently detect or respond to either signal. We are telling you this rather than claiming to honour something we have not implemented. There is nothing for these signals to switch off today, because no analytics or advertising tracker runs on ApplyOS. If we introduce one, we will decide and publish how we respond to these signals before it goes live.

Age requirement and children's privacy

ApplyOS is for adults. Our Terms require account holders to be 18 or over, so the service is not directed to children or teenagers. We do not verify age and we do not ask for a date of birth, which means we rely on that representation rather than on a check: we do not knowingly collect personal information from anyone under 18. If you believe someone under 18 has given us information, contact us at the address below and we will close the account and delete the data.

International users

ApplyOS is operated from the United States, and our service providers (Supabase, Stripe, Upstash, OpenAI, Adzuna, Logo.dev, OpenStreetMap) process data in the United States and other countries where they operate. By using ApplyOS, you consent to your information being processed in these locations.

Changes to this policy

We may update this policy as ApplyOS evolves. Material changes will be reflected in the "Last updated" date above.

Contact

Privacy questions or data requests: support@applyos.co.