Privacy Policy

Understudy helps you find jobs and apply to them. To do that we store the information you give us and use it only to run your job search.

What we collect

• Account details: email, name, and profile photo if you sign in with Google.
• Your resume (the PDF and the text we extract from it) and the profile you fill in: contact details including your home address, work authorization and citizenship, salary expectation, preferences, optional self-identification answers, and answers you save so we can reuse them.
• Applications you prepare or send through Understudy: the resume attached, cover letters, every form answer, statuses, and receipts.
• Screenshots of the application form as it was filled in, so you can see what happened on a send. They show whatever was on the page, including your contact details.
• Outreach (optional, for accounts that signed in with Google): for companies you applied to, the names, roles, public profile links and work email addresses of people there who might help, which Understudy finds on the company's own website, in public GitHub activity and in public search results, or builds from the company's published email pattern. Plus the emails it drafts for you, when they were sent and whether anyone replied. These are other people's business contact details: we use them only to draft and send the emails you ask for, and delete them with your account.
• Basic details your extension reports (its version and whether it is online), so we can tell why an application did not send.
• Basic usage and cost logs (for example, how many AI calls your account made), and counts of sign-in attempts, kept against a one-way hash rather than the address or IP itself, which we use for rate limiting.

How we use it

• To match you with jobs, write cover letters, fill application forms, and submit applications you approve (or that you allow Autopilot to send).
• Autopilot is turned on when you finish setting up and have uploaded a resume. It sends applications that fit your preferences without asking for each one, up to the daily limit in Settings, and you can switch to Review mode at any time. When a form asks for self-identification (gender, race, veteran status, disability) and you have not answered, Understudy uses the plain default shown in your profile (for most of them, “decline”), and Home asks you to confirm them. They are your answers on your applications: check them.
• Job descriptions, your profile and the text of your resume are sent to AI models, through OpenRouter and, as a backup when those fail, Anthropic (Claude), to score matches, fill forms and draft documents. The resume PDF itself is never sent to a model. Whether a model provider logs or trains on what it receives is set by their policies and our account settings with OpenRouter and Anthropic, not by anything in the app, so we can't promise on their behalf. We never sell your data and never use it for advertising.
• When you apply, your information is sent to the employer's application system (for example Greenhouse, Lever, Ashby or Workday). That is the point of the product.

Where your data is

The database is Neon (managed Postgres). The app and its background jobs run on Vercel. Applications normally go out from your own browser through the extension; a headless browser on Vercel can send some of them instead, only when your extension has not been online for a while and only for a few application systems. Looking for people to contact (Outreach) sends the company name and the person's name to GitHub and to Brave's search API; no part of your resume or profile goes with those searches. Payments go through Stripe, which handles card details directly (we never see them). Account emails (password resets, application updates and reminders) go through Resend. AI models are reached through OpenRouter; the models we use by default are GLM (Z.ai), DeepSeek and Gemini (Google). OpenRouter picks which provider actually serves each request, and not all of them are in the United States. When none of those models answers, the request goes to Anthropic (Claude Haiku) directly.

Cookies and analytics

Understudy uses no advertising, analytics or session-recording tools, and no tracking pixels. We do not track where visitors came from beyond the referral link you may have used. The cookies we set are our own and only do what you asked for: staying signed in, remembering a referral link for 30 days, completing a Google sign-in or a checkout, and (for 180 days) remembering which Google account to offer you on sign-in. Your theme and filter choices are kept in your browser's local storage and never sent to us. Signing in with Google loads Google's sign-in script, which Google runs under its own policy. The demo video on the home page loads from YouTube only when you press play. Our hosting provider (Vercel) keeps ordinary server logs (IP address, page and time) for security and debugging. Because we do not track you across sites there is nothing to opt out of, and we honour browsers' Global Privacy Control signal by default.

Browser extension

The Understudy extension fills and submits the applications you approved, in a background tab in your own browser. It is set up for job application sites (Greenhouse, Lever, Ashby, Workday and similar), Understudy itself and Gmail. Many employers host their application on their own careers site, so Chrome shows the extension asking for access to all websites; Understudy uses that only to open and fill an application you approved, in the tab it opened for it, and not on pages you are browsing. It sends Understudy the result of each application, the form fields it could not answer, and, when an application ends without a confirmation, a short excerpt (up to 160 characters) of what the employer's page said. It does not collect your browsing history.

Gmail

If you connect Gmail in Settings, Understudy reads your mail on the server for three things only, all tied to applications you sent through it:

• security codes an employer's application system emails before it accepts an application (for example Greenhouse);
• account verification and password-reset links from employer application systems (for example Workday), for accounts Understudy created for you;
• confirmation, rejection, interview and online-assessment emails from the employers you applied to (looked for over the last 90 days), so your tracker shows what really happened and which applications moved forward.

Searching for receipts and for interview or assessment invitations reads only the sender, subject and preview line of matching mail, and matches it to your applications with fixed rules, not an AI model. Looking for a security code or an account link opens the full text of the few emails that match that search, because the code or the link is in the body. From a matching email we keep only the sender, the date, its Gmail message id and a short excerpt of the subject (at most 200 characters), stored on that application as evidence. Codes and links are used once and not stored. No other mail is read, stored, forwarded, shown to people, used for advertising, or used to train AI models. Understudy's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. You can disconnect Gmail in Settings at any time, which revokes our access at Google.

Keeping application mail out of your inbox. If you press “Set it up in Gmail” in Settings, Google asks you to let Understudy manage your Gmail filters and labels (the gmail.settings.basic and gmail.labels permissions). We use that permission once, at that moment, to create one label named “Applications” and five filters that move employers' application confirmations, rejections, equal-opportunity surveys and privacy notices into it. These permissions cannot read your email. We don't keep them: no long-lived token is requested or stored, and we don't read, change or delete any of your other labels or filters. You can delete the label and the filters in Gmail at any time.

Separately, if the extension is installed and you are signed in to Gmail in the same browser, it can read your inbox through your own Gmail session to spot a confirmation or a security code. What leaves your browser is the result (which application it confirms) and a short excerpt of that one employer email, at most 160 characters, kept on the application as evidence. Nothing else from your inbox is sent. Removing the extension stops it.

Sending outreach email. If you press “Allow sending” on the Outreach page, Google asks you to let Understudy send email as you (the gmail.send permission). It is used only to send the outreach emails you approve or have switched on Auto-send for, and their follow-ups, from your own address, at a limited pace each day. Understudy does not read your mail with that permission. You stay the sender: write only to people you are comfortable contacting, and turn Auto-send off or disconnect Gmail whenever you like. Replies arrive in your own inbox.

Your Understudy address

If you turn this on in Settings, your applications go out with an email address of ours (for example alex.kim@example.com) in place of your own, so that security codes and account links employers email in the middle of an application reach Understudy without you connecting Gmail. Understudy keeps what arrives at that address: the sender, subject and text, for 14 days (the sender and subject for 90). It reads those messages with fixed rules, not an AI model, for the same three things as above: security codes, account links and employer replies. Messages that look like a person writing to you (a recruiter, a rejection) are passed on to your own email address; you can change that to everything or nothing. Turning it off stops new applications using the address and mail sent to it is refused. Mail is received through Cloudflare, which sees it in transit and keeps none of it.

Applying while your computer is off

If you turn on “Apply while your computer is off” in Settings, applications you approved are sent from a browser we run in the cloud when none of yours is online. It is the same extension, with a temporary sign-in for your account that is deleted when the session ends; your answers and resume are held in that browser only while it works and its profile is deleted afterwards. It needs the Understudy address above or Gmail connected, so it can read an emailed code. Employers see the application come from a data centre, not from your connection.

Employer accounts

Some application systems (for example Workday) require an account per employer. If Understudy creates one for you, its password is stored encrypted and used only to sign in and send your applications there. You can see these accounts, and the password, in Settings. The account belongs to you and lives at that employer, so it keeps existing even if you delete your Understudy account.

Your rights

Wherever you live, you can ask us for a copy of your data, to correct it or to delete it, and to object to how we use it. If you are in California, the EU, the UK or another place with a privacy law, that law gives you these rights by name, and we honour them for everyone. Some of what we hold (your citizenship and work-authorization status, and any self-identification answers) is sensitive: we use it only to fill in your applications and to match you to jobs you can take, never to advertise or to infer anything about you. We do not sell your personal information or share it for advertising. To use a right, email us (below); we answer within 30 days. You can also complain to your local data-protection authority.

If you are outside the United States, your data is processed in the United States and by the providers listed above, in the US and elsewhere, and by using Understudy you ask us to do that. Understudy is for people 18 and over.

Who can see your data

You can. So can the people who run the service, through admin pages: every account's email, plan and application counts; and, for the operator, your resume, your profile and each application with the answers that went with it, and the errors applications failed with. We look at these to check that applications go out correctly and to fix the product. Your first applications also get a second automated review, and one it isn't sure about waits until the operator or you look at it. Optional self-identification answers are never sent to that review. Nobody else has access.

Your control

• Nothing is submitted in Review mode until you approve it.
• You can edit or delete any saved answer, download your applications as CSV, and download the resume on file.
• Download my data in Settings gives you one JSON file with everything we hold about you: your profile, your parsed resume, every application and the answers that went with it, your self-identification answers, your saved answer memory, your matches, your employer accounts and your usage. The resume PDF and the form screenshots are downloaded separately because they are files, not text.
• You can delete your account at any time in Settings. That removes your profile, resume, applications and their archive, answers, screenshots, saved employer accounts and tokens, revokes our Gmail access at Google, and cancels your subscription.

What deletion does not remove

• Applications already sent. They are with the employer and we can't withdraw them.
• The employer accounts themselves (for example a Workday candidate account). They belong to you and live at that employer.

Our rate limiter, which stops someone guessing passwords, counts attempts against a one-way hash of the address and network they came from. It does not store the address or the IP itself, and its counters are deleted after a day.

While your account is open we don't delete old applications, answers or screenshots automatically. They stay until you delete them or delete the account.

If a data incident ever put your information at risk, we would tell you, and the authorities where the law requires it, within the time the law allows.

Security

Data is stored in a managed Postgres database with encryption at rest and in transit. Your Gmail token and your employer-account password are additionally encrypted with a key that is not in the database, so a copy of the database alone would not reveal them. Everything else, including your resume and your answers, is stored in readable form in that database. Access tokens for the extension and MCP server, and your password, are stored hashed and can be revoked any time.

Contact

Questions, or to ask for a copy or deletion of your data: keugenelee11@gmail.com