Our privacy policy, in plain words.

11. Who we are

YapApply is run by Ken Milstone-Turner in Toronto, Ontario, Canada. In this policy, "YapApply", "we" and "us" mean Ken and the employees and contractors who work on YapApply.

Ken is responsible for how YapApply handles personal information, and is the person to contact about it. For people in Quebec, Ken is the person in charge of the protection of personal information. Write to hello@yapapply.com.

We follow Canada's federal privacy law for businesses, the Personal Information Protection and Electronic Documents Act (PIPEDA). We give the same care to everyone who uses YapApply, wherever they live.

22. What we collect

On yapapply.com

• Your email address, if you join the early-access list, and which of the page's two forms you used.
• Visit counts. Cloudflare Web Analytics counts visits without cookies and without following you to other sites. It records the page, the site that sent you, your browser and device type, and your country.
• Your IP address and browser details reach Cloudflare, which serves the site and blocks attacks. We don't keep them. The site's fonts come from our own server, so your browser doesn't contact Google or any other font service.

Your account

• The email address you sign in with.
• Your password. You type it on our page and we pass it straight to WorkOS, our sign-in service. We never store it. WorkOS keeps it scrambled so it can't be read back.
• Sign-in records: when you signed in, your IP address and your browser. We and WorkOS use them to keep your account safe and to stop bots.

What you tell YapApply

• Your profile: your name, the contact details you add (email, phone, city, links), the roles you're aiming for, and notes.
• Your career history: employers, job titles and dates; the stories you tell about your work and what came of it; skills; schools and courses; certifications, awards, languages, interests and memberships; and things you tell us you haven't done.
• Files you upload: resumes (PDF, Word, text or a picture) and the PDF of your LinkedIn profile, plus the text we read from them.
• Jobs: postings you paste or link, your answers to follow-up questions, application questions and the answers you keep, and your application tracker (status, dates, interview rounds and notes, offers and pay).
• What YapApply writes for you: resumes, cover letters, LinkedIn text and answers, and earlier drafts, including your own version of a line before you asked for a rewrite.
• Your setup answers: where you are in your search and the role you want.

Your voice

When you talk instead of typing:

• The recording stays in your browser until it's turned into text. If that can't happen right away (say your connection drops), it waits on your device for up to 14 days, then it's deleted.
• To turn it into text, we send the audio to Cloudflare's speech-to-text service. We keep the text, never the recording.
• On a computer, Chrome and Edge show your words live while you talk. For that preview, the browser sends the audio to its maker's own speech service (Google for Chrome, Microsoft for Edge) under that company's privacy terms. If you'd rather it didn't, use another browser, or YapApply on your phone, where the live preview is off.

Records we make while you use YapApply

• A record of each AI request: what we sent the AI and what it wrote back. Kept 90 days.
• Usage records: which step ran, which AI model, how long it took, its size and its cost. None of your words.
• What you do with AI-written lines (kept, edited or removed), as counts. None of your words.
• Flagged text: when our safety check flags something as junk or as instructions aimed at the AI, the first 2,000 characters of it. Kept 30 days.
• Error reports when something breaks: what went wrong, on which page, and your browser type, never what you typed. Kept 30 days.

What we don't ask for

We never ask for your Social Insurance Number, banking or card details, government ID or date of birth. YapApply won't write answers to application questions about your identity, your pay or your right to work. It leaves those to you.

Sensitive details, other people, and promises you've made

Your stories might touch on things you'd usually keep private, like a health issue behind a gap, a disability, your immigration status or caring for family. Share only what you're comfortable with. We treat everything you write as sensitive and protect it that way.

If your stories mention other people, like a manager, a client or a reference, share only what you have a right to share, and leave out details a resume doesn't need.

The same goes for the work itself. Before you tell YapApply about a project, think about any non-disclosure agreement or confidentiality rules you've agreed to with a current or past employer, client, partner or anyone else you've worked with. Leave out confidential names, numbers and details, or describe them in general terms, like "a national retailer" instead of a client's name. YapApply can't know what you've promised to keep private, so that part is up to you.

33. How we use it

We use your information only to:

• Run YapApply for you: ask follow-up questions, organise your career history, compare it with the jobs you add, and write and check your documents.
• Keep your account and YapApply secure: sign you in, stop bots and abuse, and make sure nobody can reach anyone else's information.
• Send the emails you need: invitations, sign-in codes, password resets, and a notice when your password changes or your account is deleted. If you joined the early-access list, the email that lets you in.
• Fix problems and make the writing better. The people who run YapApply read AI request records and error reports to find out what went wrong. They also re-run past requests, on the same AI model or a different one, to check that a change works before it goes live. No AI model learns from them.
• Understand how YapApply is used, in totals, like how many resumes were written this week.
• Meet our legal obligations.

We don't:

• sell, rent or trade your information;
• show ads, or let advertisers track you;
• use what you write to train or tune any AI model. If we ever want to, we'll ask for a separate yes, and saying no will never limit what you can do in YapApply;
• send you marketing email unless you've said yes to it separately. We don't send any today.

You give your consent to these uses when you join the early-access list or use YapApply. You can take it back any time (see section 9), though YapApply can't work for you without the information it needs.

44. How the AI works with your information

• We use AI models from two companies, Anthropic and OpenAI. They read the files you upload, ask follow-up questions, and write and check your resumes, cover letters, LinkedIn text and answers. Which company handles which task changes as their models improve, so either may receive any of what's below.
• Each time YapApply reads, writes or checks something, it sends the AI your profile (name, city, target roles and notes) and your career history, plus whatever that task needs, like a job posting or a file you uploaded. It doesn't add your email address or phone number, but the AI will see them if they're printed on a resume you upload.
• Both companies' terms for business customers say they don't train their models on what we send. They may keep it for up to 30 days to check for abuse, then delete it.
• AI can get things wrong. YapApply writes only from what you've told it and checks each line against your stories, but you read and approve everything. YapApply never sends an application or a message for you.
• No automated decisions about you. YapApply's fit checks and suggestions are advice for you, and you decide what to do with them. YapApply doesn't make decisions about you, and it sends nothing to employers.

55. Who else handles your information

These companies help us run YapApply. Each may use your information only to provide its service to us, must protect it, and has its own privacy terms.

When you paste a link to a job posting, our server visits that page to read it. The job site sees a visit from YapApply's server, not from you, and we send it nothing about you.

We share your information with anyone else only:

• when the law requires it, such as a court order. Where the law allows, we'll tell you first;
• to protect someone from serious harm;
• if YapApply is sold or merged, with the new owner, who must keep to this policy. We'll tell you before your information moves, so you can delete everything first if you'd like;
• with your OK.

66. Where it's stored

YapApply's database and files are stored by Cloudflare in North America, and they aren't kept in Canada. Anthropic, OpenAI, WorkOS and Resend handle information in the United States.

While your information is outside Canada, the laws of those countries apply to it, and their courts, police and national security agencies may be able to get it. For people in Quebec, this means your information is transferred outside Quebec. We chose these companies for their security and for their promises about how they use data.

77. Who at YapApply can see it

Your account is just for you. The people who run YapApply can read what you type and upload, and what the AI writes for you, using our admin tools. Today that's Ken. Later it may also include employees and contractors who work on YapApply. They look only to fix problems and to check and improve the writing.

Everyone with access must keep your information confidential, and gets only the access their work needs. The admin tools have their own sign-in, and opening your AI request records, flagged text or documents in them is logged.

88. How long we keep it

When you delete everything

Delete everything (in Settings, under Your data) removes your account, your sign-in, every record in our database and every file you uploaded, straight away. A few copies take a little longer to go:

• Backups. Our database keeps a restore history for up to 30 days, so it can be rebuilt after a failure. Your information ages out of it within 30 days. If we ever had to restore from it, we'd delete your information again straight away.
• The AI companies delete what we sent them within 30 days.
• Your email address stays in Resend's delivery records and, if you joined it, on the early-access list at WorkOS. Ask us and we'll remove it.
• Our admin log keeps a note that a record was opened: an account number and a time, with none of your words.
• Copies you've made, like a downloaded resume or a document saved to your own Google Drive, are yours to delete.

99. Your rights and choices

• See and download it. Download a backup (in Settings, under Your data) gives you one file with your profile, career history, jobs and documents. For anything else we hold about you, including your uploaded files or a list of who we've shared it with, email us.
• Correct it. Edit anything in the app, or ask us.
• Delete it. Use Delete everything in Settings, or email us. To come off the early-access list, email us.
• Take back your consent. Stop using YapApply and delete everything. Any separate yes you give us later, like one for marketing email, can be taken back on its own without changing anything else.

We answer requests within 30 days, for free. We may ask you to confirm it's you, usually by writing from the email address on your account. If we can't do something you ask, we'll tell you why.

If you have a concern, tell us first at hello@yapapply.com and we'll try to put it right. You can also complain to the Office of the Privacy Commissioner of Canada (1-800-282-1376) or, in Quebec, the Commission d'accès à l'information.

1010. How we protect it

• Everything travels encrypted, and it's stored encrypted.
• Each person can reach only their own records. The app checks this on every request.
• The cookie that keeps you signed in can't be read by scripts on the page, and works only on our site.
• Passwords are handled by WorkOS, which also checks them against passwords known to have leaked.
• Our admin tools have their own sign-in, and opening your records there is logged.
• We keep only what YapApply needs, and delete records on the schedule above.

No system is perfectly secure. If a breach of our safeguards creates a real risk of significant harm to you, we'll tell you and the Office of the Privacy Commissioner of Canada as soon as we can, and we keep a record of every breach, as the law requires.

1111. Cookies and browser storage

• yapapply.com sets no cookies. Cloudflare Web Analytics counts visits without them.
• The app sets one cookie, which keeps you signed in for up to 30 days. The app needs it to work, and it isn't used for tracking.
• The app also keeps a few things in your browser's own storage: unsent drafts (30 days), voice recordings waiting to become text (up to 14 days), and small settings like which lists you've folded. Signing out deletes waiting recordings. Delete everything clears all of it on the device you use.
• No advertising or tracking cookies, on either site.

1212. Age

YapApply is for people 16 and older. If we learn that someone under 16 has an account or has joined the early-access list, we'll delete their information. If you're 16 or 17, everything in this policy applies to you, and we treat your information as sensitive.

1313. Schools, career centres and employers

No school, career centre or employer can see your YapApply account. If a school or career service offers YapApply in future, we'll tell you exactly what it would see, if anything, before you join, and it will see your information only if you say yes. YapApply never sends anything to an employer: you decide what goes out.

1414. Changes to this policy

We'll post any change here with a new date. If a change matters, like a new use of your information or a new kind of company receiving it, we'll tell you in the app or by email before it takes effect, and ask for your OK where the law requires it.

1515. Contact us

For questions, requests or concerns about your information, write to hello@yapapply.com.

Ken Milstone-Turner, YapApply, Toronto, Ontario, Canada.