Privacy Policy

ApplyJi is a job-search tracker that helps you organise applications, track statuses, and surface insights from your Gmail inbox. We are data minimalists: we collect only what is necessary to deliver the service and never sell your personal information.

By creating an account and using ApplyJi, you agree to the practices described in this policy.

We collect the following categories of personal data:

• Account data — your name, email address, and (if applicable) profile picture, provided when you sign in via Google OAuth.
• Application data — job titles, company names, statuses, notes, and dates you enter manually into ApplyJi.
• Parsed email metadata — when you grant Gmail access, we read email headers and body text solely to extract structured job-application signals (sender domain, subject keywords, detected status). Raw email content is never stored. See Section 3 for full details.
• Usage data — page views, feature interactions, and browser/device type collected via privacy-respecting analytics to improve the product.
• Support communications — messages you send us via email or in-app contact forms.

ApplyJi requests the https://www.googleapis.com/auth/gmail.readonly OAuth scope. This is the minimum required to detect job-related emails. Here is exactly what we do — and do not — do with that access:

The parsing pipeline runs in memory on our servers. The only data persisted to our database is the structured metadata result (e.g. "Interview invite from Acme Corp, 12 May 2025"). Original email text is discarded immediately after parsing.

You can revoke Gmail access at any time from Google Account Permissions or from your ApplyJi Settings page. Revoking access stops all future email scanning; previously extracted metadata is governed by our retention policy in Section 7.

We use your data exclusively to:

• Create and maintain your account and authenticate your sessions.
• Populate and update your job application tracker automatically.
• Send transactional emails (account verification, password reset).
• Respond to support requests.
• Analyse aggregated, anonymised usage patterns to improve ApplyJi (no individual profiling).
• Comply with legal obligations.

We do not use your data for advertising, behavioural profiling, or training machine-learning models.

All user data is stored in Supabase, a managed Postgres platform with SOC 2 Type II certification. Data at rest is encrypted with AES-256; data in transit is protected by TLS 1.2+.

Access to production databases is restricted to authorised team members via short-lived credentials and enforced with row-level security (RLS) policies so that each user can only access their own records.

Despite these measures, no system is 100% secure. If you believe your account has been compromised, contact us immediately at applyjiii@gmail.com.

We do not sell, rent, or trade your personal information. We share data only with:

• Supabase — database and authentication provider (data processor under a DPA).
• Google LLC — solely to authenticate via OAuth and to read Gmail on your behalf when you grant permission.
• Payment processor — billing details for paid plans are handled by our payment provider and never stored on ApplyJi servers.
• Law enforcement — only when required by a valid legal process, court order, or to protect the safety of our users.

We retain your data for as long as your account is active. When you delete your account:

• Your profile, application records, and extracted metadata are deleted within 30 days.
• Anonymised, aggregated analytics data may be retained indefinitely.
• Billing records are retained for 7 years as required by tax and accounting regulations.

To delete your account, go to Settings → Account → Delete Account, or email us at applyjiii@gmail.com.

Regardless of your location, you have the right to:

• Access — request a copy of the personal data we hold about you.
• Correction — ask us to correct inaccurate or incomplete data.
• Deletion — request that we delete your personal data ("right to be forgotten").
• Portability — receive your data in a machine-readable format (CSV/JSON).
• Withdrawal of consent — revoke Gmail access or marketing email consent at any time.
• Objection — object to certain processing activities.

To exercise any of these rights, email applyjiii@gmail.com with the subject line "Privacy Request". We will respond within 30 days.

If you are located in the European Economic Area (EEA) or the United Kingdom, the following additional rights and information apply under the General Data Protection Regulation (GDPR) and UK GDPR.

Legal bases for processing:

• Contract — processing necessary to deliver the service you signed up for.
• Consent — Gmail access and marketing emails (you may withdraw at any time).
• Legitimate interests — security monitoring and fraud prevention.
• Legal obligation — compliance with applicable law.

You have the right to lodge a complaint with your local data protection authority (e.g., ICO in the UK, CNIL in France) if you believe we have mishandled your data. We encourage you to contact us first so we can resolve any concern directly.

International transfers: Supabase may process data in data centres outside the EEA. Such transfers are covered by Standard Contractual Clauses (SCCs) approved by the European Commission.

If you are a California resident, the California Consumer Privacy Act (CCPA) as amended by the CPRA grants you additional rights:

• Right to Know — request details about the categories and specific pieces of personal information we collect, use, disclose, or sell.
• Right to Delete — request deletion of your personal information subject to certain exceptions.
• Right to Opt-Out — we do not sell or share personal information for cross-context behavioural advertising. There is nothing to opt out of.
• Right to Non-Discrimination — we will not discriminate against you for exercising your CCPA rights.
• Right to Correct — request correction of inaccurate personal information.

To submit a verifiable consumer request, email applyjiii@gmail.com. We will respond within 45 days.

We use only essential cookies required for authentication (session token) and security (CSRF token). We do not use advertising cookies or third-party tracking pixels.

You can control cookies through your browser settings. Disabling essential cookies will prevent you from signing in to ApplyJi.

ApplyJi is not directed to children under 16 years of age. We do not knowingly collect personal information from anyone under 16. If you believe we have inadvertently collected such information, please contact us and we will delete it promptly.

We may update this policy from time to time. When we make material changes, we will notify you via email (at the address associated with your account) and/or by posting a prominent notice on the app at least 14 days before the change takes effect. The "Effective date" at the top of this page always reflects the most recent version.

Continued use of ApplyJi after a change becomes effective constitutes acceptance of the revised policy.

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please reach out: