Your job hunt is nobody else's business.

Everything below is tied to your account and nobody else's.

• Your email address. It is your account. There is no password: you sign in with a one-time link sent to that address.
• Your Master Profile. Contact details, work history, skills, and the target roles you set. If you bootstrap it by uploading a résumé, the file is read in memory and the extracted text is sent to an AI model to be structured. The file itself is never written to disk or to storage — only the structured profile it produced.
• Your pipeline. Every job you save: company, role, link, location, salary, the full job description text, your status and dates, your private notes, and the drafts AI produced for it (tailored résumés, ATS scores, cover letters, follow-up messages, game plans, coach output).
• Your stories. The situation / task / action / result entries and their numbers.
• Companies and people you research.Company details, and contacts you save or import — names, titles, LinkedIn URLs, email addresses, phone numbers. Those are other people's details in your private workspace. You are the one responsible for what you put there.
• Discovery results. Jobs found by a search run, including the raw payload from the source, plus the run's status and cost.
• Your API keys, encrypted. See the section below.

There is no free-text field anywhere that we read, mine, or feed into anything other than the feature you used it in.

ApplyOS is bring-your-own-key: you paste in a key for DeepSeek, OpenRouter, OpenAI or Gemini, and AI costs land on you rather than on us. The same applies to an Apify token if you connect one for job discovery.

Those keys cannot be hashed the way a password is, because we have to send the real value to the provider. So they are encrypted at rest with AES-256-GCM under a secret that lives outside the database, and only the last four characters are ever shown back to you. That defends against a database leak. It does not defend against someone with access to the running server, and no scheme that has to transmit a live key can. If that matters to you, use a key scoped and budgeted for this app, and rotate it when you stop using it — which is good practice regardless of who is holding it.

If you set no key of your own, AI features fall back to the operator's keys. In that case your prompt content reaches the provider under that account instead of yours.

Every AI feature here is a call out to a model provider. What goes with it is the material the feature needs — your profile and résumé content, the job description, a captured page's text, your notes for a coach or interview chat. What comes back is stored on the record you ran it against.

The provider is whichever key resolves first: your own key, in the order DeepSeek → OpenRouter → OpenAI → Gemini, or the one you marked default. Their terms govern what they do with what they receive, so it is worth reading them for the provider whose key you use. We do not train anything on your data, and we have no arrangement with any provider to let them do so on our behalf.

A short list, and this is the whole list.

• Supabase stores your data and runs the sign-in system, on Amazon Web Services. It also sends your sign-in link.
• Vercel serves the app.
• Your AI provider — DeepSeek, OpenRouter, OpenAI or Gemini, as described above.
• Brave Search receives the search queries behind company research. Your profile is not part of that.
• Apify runs job discovery. It receives your search terms and location, and returns postings. It never receives your résumé or your pipeline.
• Sonar counts visits. It is ours, described in full below.

Nothing here is sold, rented, or shared with an advertiser, a recruiter, a data broker, or anyone else. There is no such deal and there is no product in which one would make sense.

Every table is scoped to a user id, enforced in the database rather than only in the app, so one account cannot read another account's rows.

The thing we will not pretend about: ApplyOS is not end-to-end encrypted, and it is run by one person who administers the database. Your data is encrypted in transit and at rest on disk, which is the same standard the tools you already use hold themselves to — but it is not encrypted in a way that locks the operator out. In practice nobody reads your pipeline, there is no reason to, and nothing about how this works depends on it. But the capability exists, and any app that can restore your account after you lose your laptop is telling you the same thing whether it says so or not.

The optional capture extension saves a job posting straight into your pipeline. When you click its icon on a job page it sends that page's address, title, and visible text to ApplyOS, where an AI pass cleans it into a job record. It does that only when you click, never in the background, and it reads nothing on any other page.

It authenticates with a token you mint yourself in Settings. Only a SHA-256 hash of that token is stored — the plaintext is shown once and is unrecoverable afterwards, so a database leak does not hand over a working write credential. You can revoke a token at any time.

We count visits with Sonar, an analytics tool we wrote ourselves and run on our own server. There is no Google Analytics here, no advertising pixel, and nothing about your visit goes to anyone else.

It records the address of the page you opened, never what is on it. Your profile, your jobs, your notes and your résumés are not part of this and never pass through it.

It keeps one thing on your device: a random ID stored in your browser under the name sonar_pid. It is 28 random characters generated on your first visit. There is no name in it, no email, and nothing from your account. Its only job is to tell us that whoever is reading this is the same person who clicked one of our links a week ago. It stays until you clear it, which makes it a persistent identifier. This app used to describe the tracker as “cookieless, no consent banner needed”, and that stopped being true the day that ID shipped — so we changed the wording rather than let it do quiet work for us.

Alongside it we record the page address, the site you arrived from, any campaign tags on that link, your country, and the broad type of device, browser and operating system you use. Your IP address is used for an instant to build a scrambled fingerprint that changes every day, which is how we count you once instead of six times. The IP itself is not stored.

If you would rather not be counted, open your browser console on any ApplyOS page and run localStorage.setItem('sonar_ignore', '1'). We will skip that browser from then on. Clearing this site's data removes the random ID too.

Until you delete it. Your pipeline is a record you build up over a job hunt, so nothing here expires on a timer and there is no purge job. If that ever changes, this page changes first.

There is no delete button in the app yet. Email busqueneil@gmail.com from your account address and the account is deleted by hand. Deleting the account row removes everything attached to it — profile, jobs, résumés, stories, companies, contacts, discovery results, your stored keys and your capture tokens — because every table cascades from it in the database. Ask for a copy of what we hold on you the same way.

Your keys stop working the moment they are deleted here, but they still exist at the provider. Revoke them there too.

Questions about any of this: busqueneil@gmail.com. You will get a real person, because there is only one.