What we collect,why we collect it,and how to take it back.

Account details you provide: name, email address, and authentication identifiers, including data from Google or GitHub sign-in if you choose to use them.

Career data you add or upload: resumes, profile information, GitHub and LinkedIn evidence, target roles, companies, contacts, and notes.

Activity data generated as you use Atlas: saved jobs, applications, outreach, follow-ups, and the outcomes that power scoring and recommendations.

Technical data: device, browser, and basic usage logs needed to operate and secure the service.

To run the core product: parsing your documents, scoring candidate strength, company quality, and match fit, and keeping applications and outreach on one timeline.

To improve ranking over time using outcome data. Learning happens on structured signals, not on your private context, and nothing you wrote is surfaced to another user.

To communicate with you about your account, support requests, and service changes that actually affect you.

To keep the service secure, prevent abuse, and meet legal obligations.

The GitHub connector, the LinkedIn import, and the browser extension are all optional, and Atlas works without any of them. Each only widens the evidence it can read.

GitHub is requested with read-only scopes (read:user, user:email), listed on the connectors page before you authorise.

Reply detection runs entirely in the browser extension. It reads sender, subject, and date from mail already open in your browser to move a tracked application forward; the message body never leaves the page, and Atlas holds no mail access of its own.

Access tokens are stored encrypted and can be revoked from inside the product at any time. Revoking a connector does not delete the work built on top of it.

We rely on a small set of processors to operate Atlas, including Supabase for database and storage infrastructure, and Google and GitHub for optional authentication.

These providers process data only as needed to deliver their service to us, under their own security and privacy commitments.

We do not sell your personal data, and we do not share it with advertisers.

We keep your data for as long as your account is active, or as long as needed to provide the service.

You can delete your account at any time. We remove or anonymise your personal data within a reasonable period afterwards, except where we are required to retain something for legal or security reasons.

You can access, correct, export, or delete your personal data from inside the product or by contacting us.

Export covers your profile, applications, contacts, and outcome history in a format you can actually use elsewhere.

You can withdraw consent for optional processing and disconnect linked accounts at any time.

If you believe your data has been handled improperly, contact us and we will look into it directly.

We use encryption in transit, encryption of stored credentials, access controls, and infrastructure-level protections.

No system is perfectly secure. We work to limit the blast radius of any single failure and to respond quickly to anything that could affect you.

Questions about this policy or about your data can be sent through the contact page, and they reach a person rather than a queue.

We may update this policy as the product changes. Material updates are reflected in the date at the top of this page.