Aiko Privacy Policy

DRAFT — for attorney review before publication. Written from what the Aiko code does as of 2026-09-30; the Gmail and application-tracking parts as of 2026-10-02, when optional reply tracking was added. Bracketed items are decisions or facts still to be supplied. Do not publish with brackets in it.

Effective date: [date]
Who we are: [Legal entity name — currently Branden Greene, sole proprietor] ("Aiko", "we").
Contact: support@aikoapply.com · [Google Voice number] · [postal address]

Aiko is a job-application service at aikoapply.com, with an optional Chrome extension. You upload a résumé, answer a short profile survey, and Aiko finds matching jobs and prepares and submits applications to employers on your instruction. This policy explains what we collect, why, who sees it, and what you can do about it.

1. What we collect

Your résumé. The file you upload and the structured data we extract from it: name, contact details, links, work history, education, skills, projects and activities. We keep the original file so it can be attached to applications.

Your profile survey. Answers you give once and we reuse across applications: work authorization and sponsorship status, citizenship status where an employer asks it, availability and start date, salary expectations, address, pronouns, links, and how you would like certain recurring questions answered.

Voluntary self-identification. Many employers' forms ask for gender, race or ethnicity, veteran status, disability status, sexual orientation and gender identity. If you choose to answer these in your profile, we store your answers and enter them on those forms exactly as you gave them. If you leave them blank, we select the form's "decline to answer" option. We never infer any of these from your name, résumé or anything else. Because these are sensitive categories, we collect them only with your explicit choice to provide them, and you can remove them at any time. [Attorney: confirm the consent basis and wording for GDPR Art. 9 / CPRA sensitive personal information.]

Application records. For every application Aiko prepares or submits: the posting, the answers entered on each field, any cover letter or written answer generated for you, the outcome, and a diagnostic log. During automated filling we may also save a screenshot of the completed form for troubleshooting.

Application tracking. For every application submitted since tracking was introduced on 6 October 2026, its tracking status — Pending, Needs action, Interview, Rejected or Offer — and the history of that status: each change, when it happened, and whether it came from Aiko itself, from the Chrome extension, or from you. Where a status came from an email, we also store the time that email was received and a link to it. The link opens the message in your own Gmail; it contains your Gmail address and Gmail's identifier for the message, and nothing of the message itself. If you dismiss an email as wrongly matched, we keep its link so the same message is not matched to that application again. We also record when your extension last checked for replies.

Email verification codes. Some employers' application systems (Greenhouse) email you a short code to confirm your address. If you enable this in the Chrome extension, the extension looks in your own Gmail, in your own browser, for that email while a code is expected. It reads the sender, subject and preview line of unread inbox mail to find it. It does not open messages, read message bodies or send mail, and unless you turn on reply tracking (next) it does not look at your inbox at any other time. Only the code itself is sent to your Aiko account, where it is entered on the form and then discarded.

Replies to your applications (optional, off by default). The Chrome extension has a setting, "Track replies to my applications". It is off unless you turn it on, and while it is off the extension reads nothing for this purpose. While it is on:

• Every 15 minutes, the extension reads the sender, subject and preview line of the unread mail in the inbox of each Gmail account signed in to that browser (up to three), together with when each message arrived and Gmail's identifier for it.
• At most once a day, for an application that has had no confirmation three days after you sent it, or that has a reply the extension could not classify, the extension searches Gmail for that employer's name in a background tab that it opens and closes, and reads the same things from the list of results. It stops doing this two weeks after you sent the application, or two weeks after it first saw the reply it could not classify.
• In that same tab it repeats the search narrowed by a fixed list of rejection phrases (such as "unfortunately" or "not moving forward") and, if you applied to more than one job at that employer, by each job's title, and notes which results are still listed. Gmail's own search looks inside the messages to answer this; the extension learns only whether a message contains one of those phrases or names that job, never the message's text.
• It never opens a message, never reads the text of a message beyond its preview line, and never sends mail.
• Deciding whether a mail is a reply to one of your applications, and what kind of reply, happens inside your browser. The sender, subject and preview text, and what the narrowed searches found, are not sent to us — only the status they lead to.
• For each reply it finds, the extension sends your Aiko account which application the reply is about, a status, the time the mail was received, and the link described under "Application tracking" above. Nothing else: our server refuses a report that contains any other field.

The matching is done by simple rules and can be wrong. You can turn the setting off at any time, and the reading stops.

Browser session data on our servers. When Aiko submits an application from our servers, it uses a browser profile that keeps cookies for the employer application sites between runs, so that repeated applications look like the same returning visitor. That profile holds cookies for those sites only. It never holds your Google, email or other personal logins.

Technical data. Server logs with timestamps and request paths. We do not use analytics, advertising trackers, or third-party cookies on aikoapply.com. [Confirm still true at launch.]

We do not collect passwords for any site. Aiko never asks you to sign in to an employer system through us and never types a password anywhere.

2. Why we use it

• To find jobs that match you and rank them.
• To prepare applications: answering forms from your résumé and profile, and drafting cover letters and written answers.
• To submit applications you have authorized, and to enter emailed verification codes.
• To show you the status and history of your applications, including — if you turn reply tracking on — whether an employer has confirmed or replied.
• To diagnose failures and improve accuracy.
• To provide support when you contact us.

We do not use your data for advertising, do not sell it, and do not share it with data brokers.

3. Who receives it

Employers you apply to. The whole point. When Aiko submits an application, the employer and its applicant-tracking provider (for example Greenhouse, Lever, Ashby, Workable or Paylocity) receive what you would have entered yourself: your résumé, contact details, answers and any self-identification you chose to provide. Their handling of it is governed by their policies.

AI language-model providers. To draft cover letters and answer open-ended questions, and to pick truthful answers to screening questions, we send the relevant parts of your résumé and profile, the job description and the question to a language-model API. Our current provider is Groq, Inc. We may also use [DeepInfra, Cerebras, Google] as fallbacks. [List exactly the providers configured at launch; remove the rest.] These providers process the data to return an answer and, under their API terms, do not use it to train models. [Attorney: verify each provider's data-use terms and add DPA references.]

Job-data sources. To find jobs we query public job APIs (employer career boards on Greenhouse, Ashby and Paylocity, and aggregators such as Adzuna). These queries contain job titles and a location, not your résumé or identity.

Hosting and infrastructure. [Hosting provider name and region.] Your data is stored on servers in [country].

Legal. We disclose data if required by law, or to protect our rights or users' safety.

Business transfer. If Aiko is acquired or merges, your data may transfer with it under this policy.

Nobody else. We have no advertising partners and no resellers.

4. The Chrome extension

The extension acts only on jobs.lever.co, apply.workable.com and mail.google.com, and only talks to your Aiko account. It stores your on/off settings and a short local activity log in your browser; while reply tracking is on it also stores there the time and result of its last check, the identifiers of messages it has already reported, and when it last searched for each employer — never a sender, a subject or a preview. Its Gmail access is described in section 1. It requests Gmail access only when you enable Greenhouse code reading or reply tracking, and you can revoke it in Chrome at any time. The extension's Chrome Web Store listing repeats these statements and is bound by them.

5. How long we keep it

[Decision needed. Proposed:] Your résumé, profile and application records are kept while your account is active. Screenshots and diagnostic logs are deleted after [90] days. Verification codes are discarded as soon as they are entered. Tracking statuses and email links are kept with the application they belong to and are deleted when it is. If you delete your account, everything is deleted within [30] days, except records we must keep by law.

6. Your choices and rights

• See and edit. Your profile and survey answers are editable at any time in Aiko.
• Correct a tracking status. In "Track applications" you can set an application's status yourself at any time. If an email was matched to the wrong application you can dismiss it there; its effect is removed and it is not matched to that application again.
• Delete. You can clear your application history in the dashboard, and you can delete your account and all data by emailing support@aikoapply.com. [Add a self-service delete.]
• Withdraw self-identification. Remove any voluntary self-identification answer from your profile at any time; future applications will use "decline to answer".
• Turn off reply tracking. Untick it in the extension and the extension stops reading your inbox for replies. Statuses and links already recorded stay with your applications until you clear your application history or delete your account.
• Revoke Gmail access. Disable it in the extension or remove the extension.
• Regional rights. Depending on where you live, you may have rights to access, correct, delete, export or restrict processing of your data, and to object. California residents have rights under the CCPA/CPRA, including to know, delete, correct and to limit use of sensitive personal information; we do not sell or share personal information for cross-context behavioral advertising. EEA and UK residents have GDPR rights and may complain to a supervisory authority. To exercise any right, email support@aikoapply.com. We will verify your identity by confirming the email on your account.

7. Security

Data is transmitted over HTTPS and stored with access limited to the people operating the service. No system is perfectly secure; if we learn of a breach affecting your data we will notify you as the law requires. [Describe encryption at rest and access controls at launch.]

8. Children

Aiko is for people 18 and older. We do not knowingly collect data from anyone under 18.

9. Changes

We will post changes here with a new effective date and, for material changes, notify you by email or in the app.

10. Contact

support@aikoapply.com · [Google Voice number] · [postal address]