EndothermisPrivacy Policy
Endothermis (“we”, “us”) helps you find who is hiring and write to them from your own accounts. This policy explains what we collect, why, and the choices you have. We wrote it to be read.
What we collect
- Account. Your name, email address and profile photo from Google sign-in or the email you sign in with.
- Resume and profile. The resume PDF you upload, the text we extract from it, the proof points, headline, school and links we derive, and anything you edit.
- Voice samples. Emails you paste so messages read like you. We keep the samples and a short description of your writing style.
- Gmail and Calendar data, only with your permission. A refresh token so we can send mail as you, the messages Endothermis sends from your account, replies in those threads, and free/busy times from your calendar when drafting a reply. We never read mail outside threads Endothermis started.
- Campaign data. The goals you type, the campaign specs, companies, job postings, the people found for you, messages, replies, stages and notes.
- Chat. What you type into the Endothermis box and what it answers.
- Usage. Server logs with IP address, browser and timestamps, kept for security and debugging.
How we use it
- To run your campaigns: watch job boards, score roles against your spec, find the recruiter or hiring manager, write messages in your voice, send them from your Gmail when you approve, read replies in those threads, and draft responses.
- To show you why a message says what it says, with the research behind every person.
- To keep your accounts safe: daily caps, send windows, bounce tracking and suppression lists.
- To send you a daily digest, if you keep it on.
- To improve the product with aggregate, anonymized numbers such as reply rates per play.
What we do not do
- We do not sell your data, and we never share candidate data with employers or recruiters.
- We do not use your resume, voice samples, messages or threads to train a shared model, and we never show them to another user.
- We do not send mail from our own domain on your behalf, and we do not add tracking pixels or link shorteners to your messages.
- We do not read your inbox beyond the threads Endothermis started.
Google user data
Endothermis’ use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We request the scopes to send Gmail messages, read Gmail threads, and read Calendar availability. We use them only to provide the features above, do not transfer the data except to our hosting providers as needed to run the service, and do not use it for advertising. You can revoke access at any time at myaccount.google.com/permissions; revoking stops all sending.
Shared data
Some data is shared across all users because it is public and makes the product better for everyone: the registry of company job boards, public job postings, and professional contact records (name, title, work email, public profile URL) for recruiters and hiring managers. Reply outcomes feed back only as anonymized aggregates per play and company. One user’s message text is never shown to another.
Recipients of your messages
Every message carries your real name and comes from your real address, so recipients can reply or ask you to stop directly. If a recipient replies “no” or asks not to be contacted, Endothermis suppresses them for all users. Recipients may also email endothermis@gmail.com to be removed from the shared contact records.
Who we share with
Service providers that run the product: Supabase (database, authentication and file storage), Vercel (hosting), Google (sign-in, Gmail, Calendar, and the language models that classify jobs and draft text), and, when configured, contact-data providers used to find work emails. Each receives only what it needs. We will disclose data if the law requires it.
Retention and deletion
We keep your data while your account is active. Delete your account in Settings and we remove your profile, resume, voice samples, campaigns, people, messages, replies and the Gmail connection within 30 days. Emails already sent remain in your Gmail. Shared public records (job boards, postings, professional contact data) are not tied to your account and remain.
Security
Data is encrypted in transit and at rest. Gmail refresh tokens are stored server-side in a table no browser session can read. Access is scoped per user with row-level security. See Data and account safety for the sending limits that protect your accounts.
Your rights
You can access, correct, export or delete your data from Settings or by emailing us. If you are in the EU or UK, our basis for processing your data is the contract with you, and for contacting recipients it is legitimate interest in one-to-one professional contact; we keep a record of source and purpose per contact so requests can be answered. You can complain to your local data protection authority.
Children
Endothermis is for people 16 and older.
Changes
We will post changes here and update the date. Material changes get an email.