Your data is your story.

Signing in with Google or Facebook

If you choose “Continue with Google” or “Continue with Facebook”, that provider tells us your name, your email address (if you allow it) and an account identifier it issues for Applystead. We store the identifier with your account so the same sign-in finds it next time, and we use the name and email only as your account details. We ask for nothing else: no contacts, friends, posts or files, and we never post on your behalf. Google tells us whether it has confirmed your address; Facebook does not, so an address from Facebook never opens an existing Applystead account, and a Facebook sign-in stops working for an account whose address is later proven by a password reset or by Google.

Assistant and the Mac app

Assistant keeps the calls you save: each transcript with its title, times, notes and the interview or calendar event it is filed under. Before each interview you schedule, our private AI service writes a briefing from your interview records, your notes and the job description. Saved calls stay until you delete them or your account, and they are included when you export your data.

The Applystead Assistant Mac app records only after you choose Start listening, and stops when you stop it or hide the app. It turns speech into text on your Mac with Apple’s speech recognition; when macOS has no on-device model for the language you chose, Apple’s speech service does it instead. Applystead never receives or keeps audio. A transcript reaches your account only when you choose Save call transcript.

When you ask the Mac app a question, the question, the part of the transcript it needs and any screen text you chose to capture go to our private AI service to answer it; we don’t keep them. Connecting the app stores a connection token in your Mac’s keychain for 30 days, and you can disconnect a Mac at any time from the Assistant page. When you choose Record on my Mac, we keep which interview you asked to record, and when, for up to 7 days.

The Applystead Autofill browser extension is retired: connections made with it no longer work and expire within 30 days. Until then we keep each one’s device name and connection time, which you can delete with Remove under Connected devices on the Assistant page.

Record a call only when everyone on it agrees; in many places the law requires it.

AI assistants and agents (ChatGPT, Claude and others)

Applystead's connector (applystead.com/mcp) lets AI assistants and agents such as ChatGPT and Claude search open jobs, look up a company's open roles and check whether a job posting is still open. These job search tools need no account, sign-in or personal data, and they only read what Applystead's public job and company pages already show.

What job search receives: only what your assistant sends for the tool it uses, such as search words and filters, a company name or a job posting link. It does not receive your conversation, cookies or anything about your Applystead account; an assistant may add details of its own to a request, such as anonymous user, session or organization identifiers, your language or an approximate location, which the connector ignores and does not keep. Requests are not stored and the words, names and links in them are not logged. We keep only totals of requests by assistant (ChatGPT, Claude or other, told apart by the request's origin or user agent, which we don't keep), by tool and by outcome. To limit requests per minute, we keep a one-way hash of the address a request comes from (of its /64 network for IPv6), never the address itself.

Links to Applystead pages in its answers name the assistant (for example utm_source=chatgpt), so we can count how many visits and sign-ups came from each assistant: visits are counted in totals that name no one, whatever your analytics choice, like any other tagged link, and with analytics on a visit is also measured as described under Analytics below. Links to an employer's own posting are not changed.

Connecting your account: the connector's other tools act on your own Applystead account, and only once you connect it. When an AI app first needs your account, it opens an Applystead page where you sign in (or create an account) and choose what that app may do: see your account; change your setup, profile and settings; apply to jobs (send applications after you approve each one, or turn on automatic applying, which then sends them without asking each time); send email from your Applystead mailbox; manage your membership and purchases; and delete your account with the code we email you. Deleting your account is never chosen for you. Applystead then gives that app your own account information and only the actions you allowed, with the same plan, limits and approvals as in Applystead itself. A connected app cannot change your password, two-step sign-in or sign-in email, or create API keys, and payments always happen on a payment page you open: plan, term and trial changes are confirmed by you on your Membership page. In ChatGPT, the connector offers no plans, upgrades or purchases and opens no payment page; it shows only your own plan and what you pay for it. You manage your membership in Applystead.

What a tool answers, such as your profile, your applications, your mailbox or the documents of an application ready for your review, goes to the AI app you connected and is handled under that app's own privacy policy. Give an app only the permissions you want it to have. What an app changes or sends for you is kept, and deleted, exactly as if you had done it in Applystead, as described in the rest of this policy.

For each connected app we keep the name it gave us, the website it identifies itself with (for an app registered directly with Applystead, the address it returns to after sign-in instead), the permissions you chose and when it was connected and last used. Sign-in codes and access tokens are stored only as one-way hashes. An app that takes a key instead of signing in uses an API key you create in Agents & API with agent permissions: for it we keep its name, its first characters, its permissions and when it was created and last used, and the key itself only as a one-way hash; it is shown to you once, when you create it.

A connected app's access lasts an hour at a time and renews while you use it; an app that has not renewed it for 90 days must be connected again. A key works until you revoke it. Disconnect an app or revoke a key in Agents & API at any time and it stops working at once. Changing your password or recovering your account ends every app connection and the agent permissions of every key: the key's other API permissions keep working, and you create a new key to use with an agent. Deleting your account deletes your connected apps and keys. Your data export lists your connected apps. Questions: email hello@applystead.com.

Voice input

When you choose the microphone beside a chat box or a form field, your browser records until you stop, for up to two minutes. The recording is sent to our speech-to-text service only to turn it into text for that box, and neither Applystead nor that service keeps the audio. The text is added to the box, and nothing is sent until you send it.

Export and deletion

Export or delete your data from Account. Cancel renewal in Membership first. Deletion pauses application intent and closes unfinished checkout before erasure. It cannot retract applications already received by employers. Minimal billing ownership and event identifiers remain to prevent delayed callbacks restoring deleted accounts. A minimal invite reward record tied to a recent payment remains for up to 120 days after that payment (see Invites from members). Stripe retains legally required billing records.

To delete your account and everything we received from Facebook or Google, including the account identifier: sign in, open Account and choose Delete account. Confirm with your password, or with a code we email to the account’s address, which works for accounts opened with Facebook, Google or an emailed sign-up link. Or email hello@applystead.com from the address on the account and we delete it for you. Removing Applystead from your Facebook or Google settings stops further sign-ins but does not delete your Applystead account.

Recruiter search

Recruiters using Applystead Talent can search for members and message them in their Applystead Mailbox. What they see: your display name (your first name and last initial), your headline, your city and state, your work history (job titles, employers, dates and summaries), your education, your skills and your certifications. Your desired minimum pay is shown only if you turn it on. Your work authorization is shown only as described below.

What they never see: your email address, phone number, street address, birth date, demographic or EEO answers, veteran or disability status, national ID numbers, salary history, your résumé text or your application history. You decide whether to share your contact details with a recruiter who messages you: choose Share my contact details on their message.

Defaults: existing members become visible 30 days after we email them about recruiter search, and not before we have; new members with a plan become visible once they finish setting up. In states whose law requires your permission, your work authorization is shown only if you turn it on; elsewhere it is shown unless you turn it off. The companies you're hidden from start as your current employers (recruiters there can't find you; other recruiters still see your work history), and you can add or remove any company.

To turn it off, open Account → Recruiters and turn off Let recruiters find me. Your profile leaves search within minutes. If your browser sends a Global Privacy Control signal, recruiters can't find you until you choose Keep me visible. You can also turn off automated fit scoring there: recruiters' AI fit scores then skip you.

Retention: messages from recruiters stay in your Mailbox until you delete them or your account. Your profile is removed from search when you turn recruiter search off or delete your account. Recruiting organizations keep their records of introductions for up to 4 years.

Information about people at employers

To help members reach the right people about roles they applied to, Applystead keeps limited professional information about people who work at employers, such as recruiters and hiring managers. See what we hold and ask us to share, delete or stop using it.

Advertising measurement

Outside the European Economic Area, the United Kingdom and Switzerland, when analytics are on and neither Global Privacy Control nor Do Not Track is set, Applystead tells Google Ads, Meta, LinkedIn and OpenAI (for ads in ChatGPT) when an account signs up, finishes setting up its profile, starts a free trial or pays, tells Meta when an account first opens checkout, and tells Meta when a visit from one of our Meta ads loads our page, so our ads can be measured and improved. A trial or a first checkout is reported only when it happens after advertising measurement started for your account, or, if you created your account right after arriving from one of our ads, after the account was created. We never do this in the European Economic Area, the United Kingdom or Switzerland.

What we send: a SHA-256 hash of your account email, a hashed account identifier, the ad click identifier when you arrived from one of our ads, your country, your browser’s user agent and IP address, the time of the signup, profile completion, first checkout, trial start or payment, and the payment amount for purchases. For a free trial start, Meta also receives the monthly price the trial will charge once it ends. When you have added them to your profile, Meta also receives SHA-256 hashes of your phone number, first and last name, city and, for a US address, state and ZIP code; no other company receives them. For a visit from one of our Meta ads, Meta receives only its own ad click identifier, your browser’s user agent, IP address and country, the page you arrived on and the time, with nothing about any account. LinkedIn receives only the email hash, LinkedIn’s own ad click identifier, the time, and the payment amount for purchases. OpenAI receives only the same email hash and hashed account identifier, OpenAI’s own ad click identifier, the time, and the plan and payment amount for purchases and trials; never your country, user agent or IP address. We never send your resume, answers, form contents or job search data. If you signed up with Facebook, Google Ads, LinkedIn and OpenAI receive only their ad click identifier (and, for OpenAI, the hashed account identifier), never your email hash. No advertising script from any of these companies runs on our pages.

If you arrive from one of our ads before you have an account, this browser keeps the ad click identifier until you sign up, for no more than 30 days. When you arrive from one of our Meta ads, our server keeps that ad click identifier, your browser’s user agent, IP address and country and the page you arrived on only until it has reported the visit to Meta, and deletes them within an hour, whether or not the report succeeds. With your account we keep your country, browser user agent and IP address from your latest visit: they are replaced at each visit and deleted 30 days after the last one. An ad click identifier is deleted 30 days after the click. Global Privacy Control, Do Not Track or “Keep analytics off” stops advertising measurement and deletes the ad details we kept, as does opening your workspace from the European Economic Area, the United Kingdom or Switzerland.

Referral links

Affiliates in the Applystead affiliate program (applystead.com/affiliates) share referral links (applystead.com/r/…) and earn a share of what the accounts they refer pay. If you open one outside the European Economic Area, the United Kingdom and Switzerland, and neither Global Privacy Control nor Do Not Track is set, this browser keeps a cookie holding only the link’s code and the time you opened it, for up to 60 days. If you create an account in that time, it is credited to the affiliate who shared the link and the cookie is deleted. Accounts that already existed are never credited. Every visit to a link also adds one to that link’s monthly click count, which holds nothing about you.

The affiliate who referred you sees only totals: clicks, how many accounts each of their links brought and the commissions those accounts’ payments earned. They never see your name, email or anything you do in Applystead. We read your payments only to calculate that commission.

An affiliate account is separate from an Applystead account. For it we keep the affiliate’s name, sign-in email, a hash of their password, how they are paid (the payout method and its account: a PayPal or Wise email, a Venmo username, a Cash App $Cashtag, or a USDC wallet address and its network), their links with the names they give them and their totals, payout requests and payouts. Download my data in the affiliate portal exports all of it. Closing the affiliate account deletes the name, the sign-in email, the payout account and the password hash and stops its links; payout and commission records keep only identifiers and amounts.

Invites from members

Applystead members can share a personal invite link (applystead.com/i/…). If you open one, this browser keeps a functional cookie named applystead_invite, holding only the link’s code and the time you opened it, for up to 60 days, wherever you are. It only carries the invitation to the account you create: it is not used for advertising or measurement. If you create an account in that time, your account records who invited you and when (the inviting member’s account id and link code), and the member who invited you sees that a friend joined and, later, that free days were earned, with dates. They never see your name, email or anything you do in Applystead. The cookie is removed as soon as your account has used it.

Opening a link or confirming your email earns nothing by itself. When the new account’s first paid month clears (30 days after its first paid subscription payment of more than $0, on any plan or term; a later charge, such as an upgrade or a switch of term, does not count), and that first payment has not been refunded or disputed, each of you receives 30 free days, once: 30 days of Standard on an account without a plan, or 30 days added to a paid membership, which moves its next charge 30 days later (a Lifetime or complimentary Premium membership receives nothing extra). Free days tied to a payment that is later refunded or disputed may be reviewed by our staff and withdrawn. The inviting member receives at most 3 rewards in any 24 hours and 12 in any year; past those limits the new member still receives theirs. No free days are given to either account when the new account uses the inviting member’s own email address, including that address with a +tag added or, for Gmail, with dots added or removed. We keep a record that the reward was given and which payment earned it (the payment’s id, never its amount), the free days’ start and end on each account, and for a paid membership the voucher and the new charge date. Download my data includes your invite link, who invited you, the friends who joined with your link (dates and states only) and your rewards. Deleting your account deletes your invite link, your invite and reward records, and removes your account from the inviting member’s list, leaving only an anonymous line. One exception: while a refund or dispute of the payment that earned a reward is still possible (120 days after that payment), we keep a minimal record linking that payment to the reward (internal account ids, the payment’s ids and date, and the free days or vouchers given, never your name or email) and any open review of it; it is deleted when those 120 days end. When a member who invited others deletes their account, their account id is removed at once from the reward records and reviews of everyone they invited, and a reward earned by one of them afterwards does not name the deleted account. When any payment is refunded or disputed, we note only the payment’s id and the notice’s id and type, to check whether it earned free days; the note is deleted after a day, or, for a payment that earned free days, replaced by its review once Stripe confirms the refund or dispute (or deleted if it does not).