Privacy

• Account: your email address and a password (handled by our sign-in service; we never see the password itself).
• Profile and resume: what you type or confirm, and resume files you upload (PDF or Word). We read the text from the file and use it to fill in your profile and a private website draft automatically. You can edit or remove anything afterwards.
• Photo: only if you upload one. It's stored privately and shown on your website only if you publish it with the photo turned on.
• Applications and emails: the jobs you save, drafts, and emails you choose to send.

Your website stays a private draft until you press Publish. Publishing makes a separate public copy at firstcircuit.ai/your-name with only the sections you left visible. Your email is hidden unless you turn it on; phone numbers, addresses and account details are never included. Unpublish any time and the public copy is removed.

If you connect Gmail, Google asks your permission for three things only: your basic sign-in identity (openid), your email address, and permission to send email (gmail.send). We can't read your inbox. We store Google's long-lived refresh token encrypted on our servers, never in your browser. Short-lived access tokens are created from it only when you press Send on an email you've reviewed, and are not saved. Disconnect from Settings and we delete the stored token; you can also remove access in your Google Account.

AI features are off until you turn on AI processing. When on, the relevant parts of your profile, resume text and a job posting are sent to an AI model through the Lovable AI gateway to draft emails, suggest resume edits or read your resume. Your resume text can automatically shape your profile and website draft, which you can edit afterwards. Nothing is sent or published until you press Send or Publish yourself. Turn it off any time in Privacy settings.

We share only what each service needs to do its job:

• Lovable — hosting, database, file storage, sign-in and the AI gateway.
• AI model providers reached through that gateway — only when AI processing is on.
• Google — Gmail sending (if you connect it) and web fonts (your browser requests them, like any website).
• Job sources (Greenhouse, Ashby, Adzuna, The Muse) — we search with job terms and locations, not your name or contact details.
• Perplexity and Apollo — company research and finding public recruiting contacts. We send company names and roles, not your profile.
• Stripe — payments for Plus. Stripe collects your card details directly; we only keep your plan, subscription status and a customer reference.

We don't sell your data or use it for advertising.

Each student's records are walled off in the database so other students can't read them. Authorized team members can access accounts when needed for support or administration, and the providers above process data to deliver their part of the service. Sending, payments and admin actions are checked on the server. We keep your data while your account exists. We haven't set fixed deletion schedules yet; if you ask us to delete your account, a team member handles it and tells you when it's done.

• Edit or remove profile details, resumes, photo and website content yourself at any time.
• Turn AI processing and email sending off, or disconnect Gmail, in Privacy settings.
• Ask for a copy of your data, a correction, or deletion of your account from Privacy settings. Requests are reviewed by a person; you'll see the status there.

Signed in? Use the request form in Privacy settings — that's the fastest way to reach us about your data. Cookies and browser storage are explained on the cookies page.