Privacy Policy

• Account: email address and password (stored as a salted hash, never in plain text).
• Verification: your school email, or a proof document (student ID, enrollment letter, or transcript excerpt) if you verify a non-university email — used only to confirm eligibility, and reviewed by a human when automatic verification doesn't apply.
• Profile: name, school, graduation date, target roles, skills, work experience, coursework topics, portfolio/ LinkedIn/GitHub links, personal essays, an optional profile photo, resume file and extracted resume text, and an optional transcript file.
• Outreach content: drafts and sent messages you create through the Service, and, if you attach one, the resume version sent with them.

Nothing below is connected automatically — each integration requires you to explicitly authorize it, and you can disconnect any of them at any time from your Profile settings.

• Gmail / Outlook: if you connect a mailbox, we use it to send outreach email as you (with your review before sending). Separately, and off by default, you can opt in to "reply detection" — we check only the specific email thread a piece of outreach was sent through, never your inbox generally, to determine whether it received a reply and classify it (e.g. interested, interview, rejection, auto-reply). We do not store the text of any reply — a reply's content is read once, used to produce that classification, and discarded immediately after.
• GitHub: if you connect GitHub, we request read-only access (never write access) to your public profile and repository data — repository names, descriptions, primary languages, language breakdowns, topics, and activity dates — to surface real, verified technical evidence for your resume and outreach. We never modify, create, or delete anything in your GitHub account.

• Basic usage and device information (such as browser type and general access logs) for security, debugging, and abuse prevention.
• An anonymized, aggregate signal of whether you clicked "Apply" on a role and briefly returned to the tab afterward — used only to improve our sense of which roles are genuinely useful to surface, never to track your activity on the external site you applied to.
• Your access token is stored in your browser's local storage (not a third-party tracking cookie) to keep you signed in.

• To create, secure, and maintain your account.
• To verify your eligibility as a student or recent graduate.
• To generate AI-assisted resume rewrites and outreach drafts, grounded only in evidence you've provided (your resume, experience, skills, coursework, links, essays, and, if connected, your verified GitHub repositories) — never invented or drawn from other users' data.
• To identify hiring signals and company/contact information relevant to your job search, and to surface a personalized, ranked view of companies worth your attention.
• To send you transactional email (password resets, email verification, and — if you don't turn it off — a weekly digest of relevant activity and, where applicable, a one-tap prompt to tell us whether outreach turned into an interview).
• To detect and prevent fraud, abuse, and violations of our Terms of Service.

To provide AI-assisted features (resume tailoring, outreach drafting, hiring-signal summaries, and reply classification), we send relevant data — such as your resume text, skills, and the specific content needed for that feature — to third-party AI model providers (which may include OpenAI, Anthropic, and Perplexity, depending on the feature) for processing. We don't permit these providers to use your data to train their own models outside of providing the response back to us. AI processing is scoped to what a feature needs — for example, our reply-detection classifier only ever sees a single reply's text at the moment of classification, and that text is discarded immediately after.

We also rely on other third-party providers to operate the Service, including:

• Company, contact, and hiring-signal data providers, used to enrich information about employers and contacts you're researching — this is data about companies and public professional contacts, not additional data collected about you.
• Amazon Web Services (AWS), for hosting, file storage, and transactional email delivery.
• Google reCAPTCHA, on registration and login, to distinguish real users from automated abuse.

Each of these providers processes data under its own privacy practices and only to the extent necessary to provide their service to us.

• We don't sell your personal information.
• We don't read your email inbox generally — reply detection, when you opt in, is scoped to the exact threads you sent through the Service, nothing else.
• We don't write to, post from, or modify your connected GitHub account.
• We don't let AI invent facts, metrics, or accomplishments on your resume or in outreach — every generated claim has to trace back to evidence you actually provided.

We share information only in these circumstances:

• With the third-party providers described above, solely to provide the Service.
• With a company contact when you choose to send them outreach — at that point, the content of your message (which may include your name, resume, and anything else you chose to include) is shared with that recipient, as you intended.
• If required by law, legal process, or to protect the rights, property, or safety of MyFirstRole, LLC, our users, or others.
• In connection with a merger, acquisition, or sale of assets, subject to the receiving party honoring the commitments in this Policy.

We retain your account data for as long as your account is active, plus a reasonable period afterward for legal, security, and record-keeping purposes. You can delete your account at any time from Profile > Security > Delete account. Deleting your account removes your profile, resume/transcript files, credit history, connected integrations, outreach drafts, tracked jobs, fit scores, watchlist, and verification record. Shared data that isn't specific to you — such as a company's public hiring signals — isn't tied to your account and isn't affected.

• Access and correction: you can view and edit most of your profile data directly in the Service.
• Deletion: delete your account at any time, as described above.
• Integrations: connect or disconnect Gmail, Outlook, or GitHub at any time from Profile > Integrations; reply detection can be turned off independently of disconnecting your mailbox.
• Email preferences: the weekly digest can be turned off from your Profile settings; account-security email (password reset, email verification) can't be turned off, since it's needed to keep your account secure.
• Depending on where you live, you may have additional rights under laws such as the GDPR or CCPA/CPRA — including the right to request a copy of your data or object to certain processing. Contact us at contact@myfirstrole.ai to exercise these rights.

We use industry-standard safeguards — encrypted connections, hashed passwords, access controls, and scoped, least-privilege access to third-party integrations — to protect your data. No system is perfectly secure, so we can't guarantee absolute security, but we work to protect your information and will notify you as required by law if a breach affects your data.

MyFirstRole is intended for college students and recent graduates and isn't directed at children. We don't knowingly collect personal information from anyone under 16. If you believe a minor has provided us information, contact us at contact@myfirstrole.ai and we'll take appropriate action.

We're based in the United States and process data there and, where our infrastructure providers operate, in other countries. By using the Service, you understand your information may be transferred to and processed in a country different from your own, which may have different data protection laws.

We may update this Privacy Policy from time to time. If we make material changes, we'll take reasonable steps to notify you (such as an in-app notice or an email) before they take effect.

Questions about this Policy, or requests about your data? Reach us at contact@myfirstrole.ai.

See also our Terms of Service.