Privacy

What we store

• Your account: email and name, held by our sign-in service. If you signed up with a password we never see it; if you signed in with Google we receive only your email, name and profile picture.
• Your profile: everything you type in (basics, About, experience, education, skills, projects), plus your photo if you upload one.
• Resumes you upload: we read the text to fill your profile. The extracted text is processed and the file itself is not kept.
• GitHub: if you connect it, the public information about the repositories you choose. We do not store your GitHub token; it is revoked right after we verify who you are.
• Applications: the job descriptions you paste or pick, the resumes generated for them, and your chat with the assistant.
• Job search: what you're looking for, the jobs matched to you, and the jobs you save or mark as applied.
• Outreach: contacts you upload, the drafts written for them, the resume PDF attached to a send, and whether each email went out.
• Your mailbox, if you connect Gmail or Outlook: its address and the provider's refresh token, so queued emails can leave your own mailbox. Details below.
• Billing, if you pay: your plan, the payment or subscription id from Razorpay (in India) and Dodo Payments (everywhere else), and until when it runs. Card and UPI details go straight to Razorpay (in India) and Dodo Payments (everywhere else) and never reach us.
• Usage counters: how many resumes, uploads and emails you used each day, so limits can be enforced.

Where it lives

On servers in India run by Amazon Web Services, our cloud provider. It stays encrypted there, and it is never sold or rented to anyone.

Who else processes it

• Amazon Web Services: our cloud provider. The app, its data and files, our own notification emails and the AI that writes your resume all run there. Your profile and the job description are sent to the AI to write your resume, and are not used to train it. Your outreach never goes through our email.
• Google: when you sign in with Google, to confirm who you are. When you connect Gmail, to send the emails you queued from your own mailbox.
• Microsoft: when you connect Outlook, Hotmail or Microsoft 365, to send the emails you queued from your own mailbox.
• Razorpay (in India) and Dodo Payments (everywhere else): payments, if you take a paid plan. You give them your payment details directly; they tell us only that a payment went through, or that a subscription started, renewed or ended.
• GitHub: only when you connect it, and only to read the public repositories you choose.
• Job boards and public job feeds: when you open a job we fetch its page. We send no personal data with those requests.
• r.jina.ai (Jina AI): used as a fallback to read a job page when a site blocks us. It receives the job's URL, never your profile.

We do not share your data with anyone else, and we never sell it.

If you connect Gmail or Outlook

Your outreach is only ever sent from a mailbox you connect. Connecting Gmail asks Google for gmail.send, plus your address; connecting Outlook asks Microsoft for Mail.Send and User.Read, the latter only to learn your address. Each lets us hand the provider a message to send as you, and nothing else: we cannot read, search, label, download or delete anything in your mailbox, because we never ask for the permission that would allow it.

Every message sent this way is one you wrote and queued yourself. It leaves your mailbox, appears in your own Sent folder, and replies come straight back to you. We are not a party to the conversation.

The provider's refresh token is stored in a row of its own, encrypted at rest, and read only by the server code that sends a single email. It is never returned to your browser and never leaves our servers. Disconnect on the Connections page and it is deleted here, and for Gmail it is revoked with Google as well. You can also cut us off yourself under your Google Account permissions or your Microsoft account's app permissions.

OneProfile's use of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. We do not use Google user data for advertising, we do not sell or transfer it, we do not use it to train any model, and no human here reads it, except where you ask us to in support, where the law requires it, or where it is needed to investigate abuse or a security incident.

How long we keep it

• Your account data: until you delete it. Deleting your account removes everything immediately, except a short note that the account existed (your name, email, country, when you joined and left, your plan and your reason if you gave one), kept for two years for payment and support questions. Ask support and we remove that too.
• Usage counters: the day-by-day ones about 40 days, the monthly ones about 13 months.
• Job postings we collect from public boards: up to 45 days. These are public postings, not personal data.
• Your mailbox token: until you disconnect it or delete your account, whichever comes first.

Two things are not ours to delete. Razorpay (in India) and Dodo Payments (everywhere else) keeps its own record of payments for as long as Indian tax law requires it to, and emails you already sent sit in your own mailbox and in the recipients'. Deleting your account here cannot reach either.

Your choices

• Take your data: Export your data on your Account page gives you everything, as JSON, CSV or plain text.
• Delete everything: The Delete account button on your Account page removes your data, your photo and your login. It cannot be undone.
• Correct anything: edit your profile at any time.

If you are in the EU or the UK, these cover your rights to access, correct, export and erase. If you are in India, the same applies under the DPDP Act. Write to support@1profile.app if anything is unclear.

Cookies

Only two, and both are needed to keep you signed in: a session cookie and a refresh cookie. They are httpOnly, so no script can read them. We use no analytics, advertising or tracking cookies.

Counting visits

To know how many people visit and where they came from, we count page views ourselves, without cookies and without any outside analytics service. For each view we keep only the page, the site that sent you (for example LinkedIn) and your country, added to a daily total. To count a visitor once a day, we make a one-way code from your IP address and browser, mixed with a secret and the date, so it changes every day. The code can't be turned back into either, and it is deleted within two days. Your IP address itself is never stored.

Security

Data is encrypted in transit and at rest. Your photo sits in a private bucket and is served only to you. Passwords are handled by our sign-in service and never reach our own database. No system is perfect: if something goes wrong that affects you, we will tell you.

Children

This service is not for people under 16.

Contact

Questions, or a request about your data: support@1profile.app.