Privacy Policy | JobPilot

1. Who we are

JobPilot is operated by Maya Tech Lab, F-703 Vastu Puja Height, Mota Varachha, Surat, Gujarat 394101, India ("JobPilot", "we", "us"). We are responsible for the personal data described in this policy.

This policy covers the JobPilot iPhone app (an Android app will follow) and the website findjobpilot.com. For any privacy question or request, email [email protected].

2. Information we collect

We collect the information you give us, some information from your device when you use JobPilot, and purchase information from the app stores.

Account details: your email address and name, from email sign-in, Sign in with Apple, Google sign-in or your profile, and a user ID from Firebase. You can also start as a guest without an email.
Content you add: resumes and everything in them (such as contact details, phone number, city or address, work history, education and skills), your career profile (target roles, city or region), job posts you paste, tailored resumes, cover letters, application answers, interview practice answers, tracker entries, notes and reminders.
Interview practice: you can type or speak your answers. Speech is turned into text on your device. We receive only the text, never the audio.
Purchases: your subscription status and history, from the Apple App Store and RevenueCat. We never see your card details.
App usage: which screens and features you use (Google Analytics for Firebase). We use it for product analytics only. It does not collect your advertising ID, and Google ad signals are off.
Crash and diagnostic reports (Sentry). We remove emails and phone numbers from these reports and use a hashed user ID.
A push notification token (Firebase Cloud Messaging), so we can send the notifications you allow.
App Check data (Firebase App Check with Apple App Attest), which confirms that requests come from the real JobPilot app.
Ad measurement events on iPhone, described in "Cookies and analytics" below.

3. How we use your information

We use your information to run JobPilot and keep it safe. We do not sell your personal data, and we never share your resume or profile with advertisers.

Where GDPR or UK GDPR applies, we rely on these legal bases: to perform our contract with you (providing the app), our legitimate interests (security, fraud prevention and improving JobPilot), your consent (optional website cookies and iOS ad tracking), and legal obligations.

To provide the features you use: resume and match scores, tailored drafts, interview practice, the tracker and PDF export.
To process your content with AI, as described in the next section.
To protect JobPilot and you, for example with App Check and rate limits that stop abuse and fraud.
To answer your support requests.
To improve JobPilot using aggregated analytics.
To send account and reminder notifications, and transactional emails such as the confirmation that your account was deleted.
To measure how well our ads work.

4. How AI processes your resume

To create scores and drafts, we send the relevant resume, profile and job content to Anthropic's Claude API. Anthropic processes it for us, on our instructions.

Under Anthropic's commercial terms, content sent through the API is not used to train their models. Anthropic keeps it only for a limited period set out in its terms.

The AI never invents experience. It only rewords what is already in your resume. A missing skill is added only when you tap "I have this". Every draft is a suggestion for you to review.

To avoid paying twice for the same work, we cache AI results by a fingerprint of the content. These cache entries expire within 30 days.

We share personal data only with service providers that help us run JobPilot. They act on our instructions and may use the data only to provide their service to us.

Anthropic: AI processing of resume and job content (Claude API).
Google Firebase: sign-in, analytics, push notifications and App Check.
MongoDB Atlas: our database.
Cloudflare: website hosting, and R2 storage for the resume files you upload.
DigitalOcean: our application servers.
RevenueCat: subscription management.
Apple: payments and Sign in with Apple.
Sentry: crash reports.
Resend: transactional email.
Meta: ad measurement only, as described in "Cookies and analytics".
Authorities, when the law requires it.

6. Cookies and analytics

Website: we use Google Tag Manager with Google Consent Mode v2 and a cookie banner (Accept, Reject or Preferences). Until you choose, only necessary cookies are used. Optional analytics and ad measurement run only after you accept. You can change your choice any time with the cookie settings link in the footer.

iPhone app: the Meta (Facebook) SDK receives only these events: app install or first open, registration, trial start and subscription purchase (plan, price and currency). Purchase events may also be sent to Meta by RevenueCat from its servers.

Your device's advertising ID (IDFA) is shared with Meta only if you allow tracking when iOS asks. You can change this any time in iPhone Settings, under Privacy & Security, then Tracking. We turn on Meta's Limited Data Use option. We never send your name, email, resume or profile to Meta. We do not use TikTok.

7. How long we keep your data

We keep your account and content while your account exists. You can delete a single resume at any time.

When you delete your account, your access ends immediately. Your data is removed right away in practice, and always within 30 days.

Deletion record: a one-way hash with no readable personal data, kept up to 2 years to prove the deletion and prevent abuse.
Subscription and purchase records: kept by Apple, Google and RevenueCat under their own policies and tax laws.
AI cache entries that cannot be linked to you: expire within 30 days.
Database backups, if any: expire on their normal schedule, within 30 days.

8. Your rights

Depending on where you live, you can ask to access, correct, delete or get a copy of your personal data, and to object to or limit some uses. You can withdraw consent at any time. We will not treat you differently for using your rights.

To make a request, email [email protected] from the address on your account. We may need to confirm it is you. We reply within the time the law allows. There is no in-app data export yet, so email us for a copy of your data.

GDPR (EU) and UK GDPR: you have the rights above, plus the right to complain to your local data protection authority, such as the ICO in the UK.
CCPA / CPRA (California): you can ask what we collect and why, and ask us to delete or correct it. We do not sell personal information. If sending ad measurement events to Meta counts as "sharing" under California law, you can opt out by keeping iOS tracking off and emailing us.
India (Digital Personal Data Protection Act 2023): you can ask for a summary of your data, and for correction or erasure. You can raise a grievance with us, and then with the Data Protection Board of India.
Other regions: email us and we will help under your local law.

9. Deleting your data

In the app: open Settings, scroll to Danger zone and tap Delete account.

On the web: go to findjobpilot.com/delete-account, enter your account email and confirm with the link we email you.

We delete your profile, resumes and files, tailored resumes, cover letters, answers, matches, tracker entries, reminders, interview practice, notification tokens and the analytics link to your account.

Deleting your account does not cancel an App Store subscription. Cancel it in iPhone Settings: tap your name, then Subscriptions.

10. Security

Your data is encrypted in transit (HTTPS/TLS) and encrypted at rest by our providers. Resume files are private and never available at a public link. Only people who need access to run JobPilot have it.

No system is perfectly secure. If a data breach affects you, we will tell you and the authorities as the law requires.

11. Children

You must be at least 16 to use JobPilot. If we learn that someone under 16 has an account, we delete it.

12. International transfers

We store and process data mainly in the United States. Our providers may also process it in other countries.

When data leaves your country, we use the safeguards the law requires, such as contracts with our providers and the standard contractual clauses where they apply.

13. Changes to this policy

If we make an important change, we will tell you in the app or by email before it takes effect. The date at the top of this page shows when the policy last changed.

14. Contact us

Email [email protected] for privacy questions and requests.

Post: Maya Tech Lab, F-703 Vastu Puja Height, Mota Varachha, Surat, Gujarat 394101, India.

If you are not happy with our answer, you can contact your local data protection authority.

Questions about this document? Email [email protected] or use the contact form .