Privacy Policy

Effective July 7, 2026

The short version

You forward job-alert and recruiter emails to your personal Hireward address. We parse each email in the request that receives it, keep only the extracted fields (company, role, status, a short evidence snippet), and discard the body. There is no email-body column anywhere in our database. We never connect to your inbox — no OAuth, no read scopes, no background sync.

What we store

Account: your email address and profile (target roles, locations, preferences).
Master resume: the bullets you confirm during onboarding, used to generate tailored resumes.
Extracted job data: company, role title, location, compensation when present, source URL, and our match score.
Application status: the pipeline stage we classified from an ATS email, plus a short evidence snippet (a single quoted line, not the email).
Email metadata: sender domain, subject, received-at, and classification result — never the body.
Billing: your Stripe customer id and plan. Card details live with Stripe, not us.

What we never store

Email bodies or attachments.
Inbox credentials or OAuth tokens — we do not have any.
Card numbers — we do not accept payments yet.

Processors we use

Vercel — application hosting; processes every request.
Supabase (self-hosted, operated by us) — the database holding your profile, resumes, tracked applications and extracted job fields.
Azure OpenAI — resume tailoring and email classification. Content sent for a single request is not used to train models.
Azure Communication Services — transactional email (sign-in links).
Cloudflare — email routing and network.

Your controls

To delete your account and data, write to support@hireward.app from your account email — we remove every row keyed to your user id (profiles, bullets, jobs, applications, events, email metadata, tailored resumes, usage counters) within 30 days, usually much faster. Questions and data requests go to the same address.

Canonical URL: https://hireward.app/privacy · See also Terms of Service.