Privacy Policy

What we collect

• Account data. When you register, we store your email address and — for password sign-in — a salted bcrypt hash of your password (never the plaintext). If you sign in with Google, GitHub, or LinkedIn, we store your verified email and a provider identifier so we can recognise you next time; we do not keep the provider’s access tokens. Connecting Gmail or Google Calendar is a separate, opt-in step that does store a token — see “Gmail and Google Calendar”.
• Job activity. If you save, view, apply to, or track a job, we store that interaction (the job, timestamps, application stage, and any notes you add) so we can show you your pipeline.
• CV / résumé. If you upload a CV, we store the file and the text we extract from it, and a language model reads it into your profile: roles, experience and skills. An AI match analysis sends the relevant parts of your CV, together with the job posting, to a language model as well. In both cases your name, email address, phone number, postal address and links are removed first, by a detection model that runs on our own servers. Tailoring a CV or writing a cover letter sends the CV you are editing and the job posting (see “Third-party services”).
• Current pay. If you choose to tell us what you earn, we store the amount, currency and period. It is optional and never shown to anyone. It only counts toward salary ranges built from many people at once, and it is never shown next to your name or your employer.
• Find me (talent network). If you switch it on, we publish an anonymous profile built from your CV: role titles, level, skills and years of experience. Your name, employer, contact details and photo are never part of it. Switching it off removes it.
• Auto-apply. If you start an auto-apply and approve the answers we prepared, we submit your tailored CV and those answers to the employer’s own application form. Nothing is sent before you approve it.
• Today’s 10. If you turn on the morning email or push, we store that choice and the date of the last one we sent, and use your profile and CV to pick the jobs, as the recommendations page does.
• Posting summaries. When you ask for a posting to be summarised in your language, only the posting’s own text goes to our language-model provider. Nothing about you is sent, and the summary is kept so the next reader of the same posting gets it without another request.
• Privacy settings. We store whether you want discreet notifications and which companies you have hidden from your feed. The app lock is kept only on your phone and never reaches us.
• API keys. If you create a personal API key, we store only a SHA-256 hash of it. The key itself is shown once at creation and is unrecoverable afterwards.
• Technical data. Standard request logs (IP address, user agent, timestamps) and, where you allow it, product-analytics cookies (see “Cookies”). We do not sell your data or build advertising profiles.

How we use it

We use your data to run the service: authenticate you, remember your saved and tracked jobs, match jobs to your CV, deliver any digests you subscribe to, and keep the platform secure and working. We do not sell your personal data or use it for third-party advertising. A small number of Findyet staff with moderator access can see your account when they need to help you, look into abuse or fix a problem: the files you uploaded, the CVs you built, mail sent or received through your Findyet address, and your conversations with the assistant. Each time they open one of these, it is recorded with who did it. This never includes mail read from your Gmail. The emails we send you carry a tiny image, and when your mail app loads it we note that the email was opened. We use this only to count how many of each kind of email get read, so we know which ones are worth sending. If your mail app does not load images, we see nothing.

Cookies

When you sign in, we set a single HttpOnly, SameSite=Lax session cookie holding a signed token. It is strictly necessary for keeping you logged in and cannot be read by JavaScript. Logging out clears it. This cookie is always set and needs no consent.

For product analytics we use Google Analytics and PostHog, which set their own cookies and, in PostHog’s case, may record a session replay with all inputs masked. These are non-essential. They load only after you accept them in the cookie banner — reject and nothing loads. You can change your choice at any time via “Cookie settings” in the footer.

Job listings

The jobs we display are aggregated from public company career boards and other public sources. We normalise and deduplicate them; we do not own this content, and a role closes in our catalogue once it disappears from its original source.

Salary estimates and market data

Salary estimates are the middle range of open postings for the same role and level that state a salary, together with pay figures people chose to share. A range is shown only when it rests on enough postings or answers, so no single person’s figure can be read from it.

The Türkiye jobs map shows open-position counts published by İŞKUR, the Turkish employment agency, on its public Open Jobs Map. They are İŞKUR’s figures and are labelled as such.

A company’s reply rate is counted from applications people track here whose replies we can see, added up across everyone. It appears only once enough applications are counted, and it never shows who applied.

Third-party services

We rely on a small set of processors to run Findyet:

• Language-model providers — Google, through Google AI Studio (Gemini models), and OpenRouter, which passes each request to one of the model vendors it lists. CV work runs on Google first: reading an uploaded CV into your profile, tailoring, cover letters, match analysis and ATS reviews. If Google cannot take a request, it goes to OpenRouter instead. OpenRouter also handles the rest, such as describing job postings and, if you have connected Gmail, sorting the hiring mail our keyword vocabulary could not place (see “Gmail and Google Calendar”). Text is sent only to answer a request you made or to describe a public posting. These services may keep requests for a limited time, and on their free plans they may use them to improve their models, which is one reason we strip contact details from your CV before it is read or analysed.
• Product analytics (Google Analytics, PostHog) — measure aggregate usage to improve the product; loaded only with your consent (see “Cookies”). PostHog runs on its EU instance.
• Error monitoring (Sentry) — captures application errors to keep the service reliable; configured without personal-data capture.
• OAuth providers (Google, GitHub, LinkedIn) — only if you choose to sign in with them, to verify your identity and email.
• ChatGPT Actions — if you connect Findyet to a custom GPT, ChatGPT sends your search and tracking requests (authenticated with your API key) to our API. Your use of ChatGPT is also governed by OpenAI’s own privacy policy.

Gmail and Google Calendar

This section applies only if you use the Inbox feature and connect a Google account to it. It is off by default, it is separate from signing in with Google, and nothing below happens for anyone who has not connected one. You can disconnect at any time from your account settings, or revoke the grant directly in your Google account permissions.

• What we read (gmail.readonly). We do not read your whole mailbox. Each sync runs a search for hiring-shaped mail only — messages from recognised applicant-tracking systems, or carrying application and interview wording — and skips mail you sent yourself. We store the matching messages (sender, subject, date, body) so your application inbox and pipeline stages work. Nothing else in your mailbox is fetched, and we never send mail on your behalf.
• Your calendar (calendar.readonly, calendar.events only if you are a mentor taking bookings). Read access shows your interviews alongside your applications. The mentor write scope creates the event and Meet link for a session someone books with you — we create nothing else and delete nothing.
• Automated processing. To decide which application a message belongs to and what stage it signals, we first try a fixed keyword vocabulary that runs entirely on our own servers. Only when that cannot decide do we send the sender, the subject, and the first 4,000 characters of the body to our language-model provider (see “Third-party services”). No human at Findyet reads your mail, except where you explicitly ask us to look at a specific message for support, or where we are legally required to.
• Your Google token. The refresh token that lets us sync is encrypted at rest with AES-256 and is never shown to you or to anyone else. Disconnecting revokes it with Google and deletes the messages we synced from that account.

Findyet’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not sell this data, we do not use it for advertising or to build advertising profiles, we do not use it to train or improve any generalised machine-learning model, and we do not transfer it to anyone except the processors named in this policy and only to provide the Inbox feature you asked for. Google API Services User Data Policy.

CV link tracking

You can turn on link tracking for a single CV. It is off for every CV unless you switch it on, and switching it on for one CV does not affect any other.

When it is on, the links in that CV’s PDF point at Findyet and forward to the real destination. Following one records the time, the browser and operating system family, the device type, and the host — not the full address — of the page the visitor came from. It also records a keyed hash of the visitor’s IP address and browser identity, so that repeat visits can be told from separate people. We do not store the IP address itself, and the hash is keyed with a secret so it cannot be turned back into an address.

These records are deleted after 180 days, and immediately if you delete the CV. Your own clicks are marked as yours and left out of the counts. A recorded open means the link was fetched; company mail systems follow links automatically, so it is not proof that a person read your CV.

Retention

We keep account and activity data for as long as your account exists. When you delete your account, we delete or anonymise your personal data, except where we must keep it to comply with the law. Request logs are retained for a limited period for security and debugging.

Your rights

You can access, correct, export, or delete your personal data at any time — most of it directly from your account settings, or by contacting us. You can also revoke API keys and unlink sign-in providers. If you are in the EU/EEA, UK, or Türkiye, you have the rights granted by applicable data-protection law, including the right to lodge a complaint with a supervisory authority.

Contact

Questions or requests about your data? Email [email protected] .