Privacy policy

IamCandidate is a personal workspace for managing a job search: applications, companies, contacts, referrals, interviews, resumes, documents, email, notes, skills, certifications and links. It consists of the IamCandidate web app, the IamCandidate server (API) and the optional IamCandidate browser extension, together “the Service”.

The Service is operated by its independent developer (“we”, “us”). For anything in this policy, contact ganeshguru8681@gmail.com.

Account information

Your name, email address, role (user or admin) and password. Passwords are stored only as a salted scrypt hash — we never store or see the plain password.

Content you add

Everything you enter or upload into your workspace, for example:

• Job applications, companies, interviews and their notes, statuses and dates.
• Contacts and referrals — names, job titles, companies, email addresses, phone numbers and LinkedIn URLs of people you choose to record.
• Resumes (including LaTeX source), documents and files you upload, such as certificates or offer letters.
• Notes, tasks, projects, skills, certifications, bookmarks and email templates.

Email (SMTP) settings

If you connect your own mailbox, we store its SMTP host, port, username, sender name and address, and password. The password is encrypted with AES-256-GCM and is never returned to the browser. Emails you send and drafts you save are stored in your workspace.

Google Drive

If you connect Google Drive, we request the drive.readonly, openid and email scopes. We store an encrypted refresh token and your Google email address, list files only when you browse them in IamCandidate, and copy a file into IamCandidate only when you choose to import it. We never write to, modify or delete anything in your Drive.

Browser extension

Only when you open the extension (its toolbar icon or Alt+K) does it read the current tab — job posting details on job pages, or a person's name, headline, location, current company and profile URL on LinkedIn profile pages. Nothing is sent until you click save. The extension does not run in the background or read your browsing history.

Technical data

Our servers keep standard request logs (such as time, route, status code and IP address) to operate and secure the Service, and an activity history of changes in your workspace that you can see in the app.

We use your information only to provide the Service to you:

• to sign you in and keep your account secure;
• to store, display, search and sync the content in your workspace;
• to send email through your own SMTP server when you ask us to;
• to import files from Google Drive and compile LaTeX resumes when you ask us to;
• to show your dashboard, notifications and activity history;
• to diagnose problems, prevent abuse and keep the Service running.

We do not sell your data, use it for advertising, build marketing profiles, or use it to train machine-learning models. The Service contains no third-party analytics or advertising trackers.

Use of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.

Where data-protection laws such as India's Digital Personal Data Protection Act, 2023 or the GDPR apply, we process account data and workspace content to perform our agreement with you, connected-service data (SMTP, Google Drive) on your consent — which you can withdraw by disconnecting the service — and logs on our legitimate interest in operating a secure Service.

The Service runs on Amazon Web Services in the Asia Pacific (Mumbai) region, ap-south-1. Structured data is stored in Amazon DynamoDB and files in a private Amazon S3 bucket.

• All traffic is encrypted in transit with TLS; S3 rejects non-TLS requests.
• Files are encrypted at rest and reached only through signed links that expire within minutes.
• Every record is partitioned by your user ID, so one account cannot read another's data.
• SMTP passwords and Google tokens are encrypted with AES-256-GCM.
• Each server function has only the minimum cloud permissions it needs.
• LaTeX is compiled in an isolated function that has no access to secrets.

No system is perfectly secure. If we become aware of a breach affecting your data, we will notify you as required by law.

We share data only in these cases:

• Infrastructure providers. Amazon Web Services hosts and processes data on our behalf.
• Services you connect. Your SMTP provider receives the emails you send; Google receives the requests needed to list and download the Drive files you pick.
• Workspace administrators. Admin accounts can create, disable and delete user accounts.
• Legal reasons. When required by law, or to protect the rights and safety of users or the Service.

IamCandidate does not use advertising or tracking cookies. The web app uses your browser's local storage for your session token, theme and layout preferences. The extension stores its session token, server settings and an unsaved draft in the browser's extension storage. Sessions expire after 12 hours, and signing out removes them.

In demo mode, all workspace data lives only in your browser's local storage and never reaches our servers.

• Workspace content is kept until you delete it or your account is deleted.
• Activity history is deleted automatically after 365 days.
• Server logs are kept for 30 days.
• Deleting an account removes its data and stored files. Encrypted backups used for disaster recovery expire on their own within 35 days.

You can, at any time:

• view, edit and delete your content directly in the app;
• download your documents;
• disconnect Google Drive or remove your SMTP settings;
• change your password;
• ask us for a copy of your data, a correction, or deletion of your account by writing to ganeshguru8681@gmail.com.

You can also revoke IamCandidate's access to Google at myaccount.google.com/permissions. We respond to requests within 30 days. If you are unhappy with our answer, you may complain to your local data-protection authority.

When you add contacts or referrals, you are responsible for having a legitimate reason to record that information, and for keeping it accurate. We process it only on your behalf, to show it back to you. If you believe your information was added to someone's workspace and want it removed, contact ganeshguru8681@gmail.com.

The Service is not intended for anyone under 18, and we do not knowingly collect their data.

If we change this policy, we will update the date at the top of this page, and for significant changes we will let you know in the app or by email before they take effect. See also our terms and conditions.

Questions, requests or concerns about privacy: ganeshguru8681@gmail.com.